Privacy Policy

Last updated: 28 October 2026

CourtPlay is run by Plyvo Apps LLC, a Texas company ("we", "us"). CourtPlay is the app and website players use to join clubs, book courts, buy memberships, sign waivers, check in and play, and the console clubs use to run their facility. This page says what we hold, who else touches it, how long we keep it, and how you get rid of it. We do not sell your personal information, and we do not track you across other apps or websites.

Plyvo Apps LLC, 14657 Beasley St, Frisco, TX 75033.

1. Information we collect

Account information: Name, email address, profile photo (optional) and, if you give it to us, your mobile number.
Profile: Username, bio, skill level, play style, which hand you play with, your home area, your direct-message preference, and — if you add them — your Instagram handle and Strava link.
How you want to play: If you tell us whether you play the women's side, the men's side or either, we store it. It is optional and you can change or remove it at any time.
Location: A home area you save yourself, and — only if you grant permission — your device's approximate location while the app is open, so we can show courts and games near you. The app works without it.
Clubs, memberships and bookings: The clubs you join, your member number at each, the memberships, packages and passes you hold and their history, the courts and programs you book, who you play with, waitlist places, and any credit balance a club holds for you.
What your club records about you: A club may keep a photo for its front desk, answers to questions it asks when you join, tags its staff assign, whether it has blocked you, and — if you claim a tax exemption — the certificate you provide.
Date of birth and family: Some clubs price, admit or require a waiver by age, so they may ask for your date of birth. It is stored once per person, with where it came from (you, a parent or guardian, the club, or an import) and which club verified it, if any. A parent or guardian, or a club, can add a child to the parent's family with the minimum details needed for the child to book and play; there is no separate child account, and the parent can delete it.
Waivers and terms: When you sign a club's waiver we keep the name you signed with, the time, whether it was typed or drawn (and the drawing, if drawn), any initials the waiver asks for, whether the signer was a minor and who signed for them, a fingerprint of the exact text you were shown, your device type, and your IP address and browser identifier. We also record which version of CourtPlay's terms you accepted, and when.
Check-in and member pass: Each time you are checked in we record where, when, for which booking or game, how (at the desk, by your member pass, at a door, or by yourself) and which staff member did it. If you set up a member pass on a phone, we keep a label for that phone, when it was last used, and the pass secret, encrypted so that no app or staff member can read it.
Usage data: Game participation, RSVPs, attendance, scores, standings, and club and group memberships.
Messages: Chat messages you send within clubs and games, and messages a club's staff send to CourtPlay support.
Text messages: If you agree to texts from a club, see §5.
Photos, camera and microphone: Profile and club photos and images you send in chat. On iPhone the camera is used to scan a payment card if you choose that instead of typing it in — the card goes straight to Stripe and we never see or store it. On Android the camera is used to scan an invite QR code. The microphone is used only when you dictate to CourtPlay AI. We do not read your contacts.
Device information: Device type, OS version, app build, and push notification tokens.
Analytics and diagnostics: Screens you open, actions you take, and errors and crashes. This is linked to your account — it is not anonymous. On a real device the app also records a masked replay of your screen: text you type and images are masked before anything is stored. On iPhone, when an error happens, our crash reporter also keeps a masked replay of the moments before it. You can turn the analytics off on iPhone — see §10.
How you found us: If you arrive through a link that names a campaign, or on iPhone through an Apple Ads search, we record that source once, against your account.
DUPR: If you connect a DUPR account we store your DUPR id, your doubles and singles ratings, reliability, entitlements and subscription tier. Your DUPR sign-in tokens are held as encrypted vault references, never in plain text.
Payments: When you pay a club, we record what you paid for, the amount, any refund, and the outcome Stripe reports. Card numbers and bank details live with Stripe, never with us. If you run a club that takes payments, we store your Stripe account id, country, currency and whether Stripe has cleared you to charge and to be paid out.
Guest records: An organizer or a club can add someone as a guest before that person has an account, which creates a record carrying the name they typed. When that person signs up they can claim the record, and the two are merged.
Sign-in provider information: If you sign in with Apple or Google, that provider sends us your name, email address, and profile picture so we can create your account. We receive nothing else: we do not read your friends, posts, photos, or contacts, and we never post anything on your behalf.

2. How we use your information

To provide and maintain CourtPlay's features: bookings, memberships, payments, waivers, check-in and play
To send the notifications you choose to receive — push, email and, if you opt in, text — about bookings, memberships, games, RSVPs and messages
To display your profile and game history to other club members
To give the clubs you join what they need to run your membership (see §4)
To improve the app and fix crashes, using the account-linked analytics and diagnostics described in §1
To build balanced courts in mixed doubles, and to work out which competition divisions and team lineups you are eligible for, using how you want to play. It is not used for advertising or profiling.

3. How we sign you in

On iPhone you sign in with Apple, with Google, or with an email address and password; on Android, with Google or an email address and password. We do not store your password — authentication is handled by Supabase Auth. When you sign up with an email address on the website, Cloudflare Turnstile checks that you are a person.

4. Your club

For the member data a club holds — your membership, bookings, payments, waivers and check-ins at that club — the club is the controller and CourtPlay is its processor, under a data processing agreement. For your CourtPlay account itself (your profile, sign-in, messages and the app), CourtPlay is the controller.

When you join a club, book with it or buy from it, that club sees what it needs to run your membership: your name, photo, email address and mobile number, your bookings, memberships, payments, waivers and check-ins at that club, and anything it records about you (§1). Every staff role at the club sees your email address and mobile number. Staff with permission see your date of birth. Other players never see your email address or mobile number.

A club can connect its own systems to CourtPlay. When it does, the data above — including your email address, mobile number and whether you agreed to the club's marketing emails — can be read by those systems or sent to them. What happens to it there is governed by that club's own privacy practices.

CourtPlay staff can see a club's member records only when the club's owner grants them access to help with a problem. A grant lasts at most 30 days, the owner can revoke it at any time, it never covers the club's money or staff settings, and every record viewed is logged.

5. Text messages (SMS)

We text you a one-time code when you ask for one to confirm your mobile number. A club can send you other texts through CourtPlay only if you opt in for that club. What you agree to, and when, is shown on our text messages page.

What we collect: Your mobile number; a record of your consent — when you gave it, where (for example at sign-up, when joining a club, in settings, or in a list your club imported), the version of the wording you were shown, and who recorded it; every opt-out and opt-back-in; and a log of the texts sent to you and received from you, with their delivery status. The text of a message is deleted once it has been handed to our provider; the log keeps a coded form of your number, not the number itself.
One-time codes: When you enter your mobile number at sign-up or change it, we text a 6-digit code to confirm it is yours. Codes are sent only when you ask for one, expire in 10 minutes, and are not marketing.
What clubs send: Account and membership notices, only after you opt in for that club: renewal reminders, payment failed, membership approved or expired. No marketing texts unless you separately opt in to them.
Your mobile number and consent are never shared or sold. Mobile opt-in data and consent are not shared with or sold to third parties or affiliates for their marketing or promotional purposes.
Who delivers them: Twilio, our text message provider, receives your mobile number and the message so it can deliver it, and passes your replies back to us.
Stop, help and start: Reply STOP to cancel at any time; it stops texts from every club. Reply HELP for help. Reply START to resume.
How often: Message frequency varies. Msg & data rates may apply.
Consent is optional: Consent to receive texts is not a condition of purchase or of joining a club.
Help: email support@courtplay.ai.

6. Who else touches your data

We do not sell your personal information and we do not share it for advertising. These are the companies that process it so CourtPlay can work:

Supabase — our database, sign-in and file storage. It holds everything in §1.
Apple — push tokens and notification text on iPhone; your Apple sign-in. If your iPhone cannot transcribe your dictation on-device, Apple's speech service transcribes it. If you installed the app from an Apple Ads search, Apple tells us which campaign it was.
Google and Firebase — push tokens and notification text on Android (Firebase Cloud Messaging); your Google sign-in; app usage events on Android (Firebase Analytics); app integrity checks on iPhone (Firebase App Check); and the remote settings that decide which features are switched on.
PostHog — usage events linked to your account, and the masked screen replays described in §1, in both apps and on this website.
Sentry — crashes and errors, carrying your account id so we can tell whether a bug is yours, and on iPhone the masked replay of the moments before an error. A crash also carries the identifier of the PostHog recording of that moment.
Stripe — your payment details, name and email when you pay a club or an entry fee, or when a club is paid out.
Twilio — your mobile number and the message, for texts you opted in to (§5).
Anthropic — your message to CourtPlay AI and its recent conversation context, so it can reply. See §7.
Resend — your email address and the message body, for invites, receipts, reminders and the emails your club sends.
Upstash — short-lived counters keyed to your account id, for rate limits and fair RSVP ordering.
Cloudflare — the Turnstile check when you sign up with an email address on the website.
Vercel — hosts this website.
Google Places — what you type into court search and, when your device has a location fix, roughly where you are, so we can suggest nearby courts. The request is made by our servers, not your device.
Google Maps — map tiles and the area of the map you are looking at.
DUPR — your DUPR id and the results of matches you play, if you connect DUPR, so your rating stays current.
Your club — see §4.
Other members — members of clubs you join see your name, photo, profile and game history. They do not see your email address, your phone number, or how you answered the "how you want to play" question: those columns are blocked at the database level and reachable only through named functions that enforce their own rules.

7. CourtPlay AI

CourtPlay AI is an assistant inside the app. We ask before it appears, and you can turn it off.

When you send it a message, that message and up to twenty recent messages from the same conversation are sent to Anthropic so it can reply. If you attach a screenshot, that image is sent too — only when you attach it deliberately, and you see a preview of exactly what will be sent first. A screenshot is raw pixels of whatever was on screen, so check the preview before you send it. The assistant can look up the names of people in your clubs to answer you, and those names go with the request.

We keep a record that a turn happened — which route it took, which model, how long it took, whether it worked. We do not keep the content of your message in that record. Your email address and phone number are never sent: the assistant cannot read those columns.

8. This website

This website loads PostHog to count page views and measure how the site is used, which stores identifiers in your browser. PostHog also records a replay of your visit — the pages you open and how you move through them. We remove the part of a web address after the ? or # before anything reaches PostHog, so a one-time sign-in link or an unsubscribe address is never sent with it. If you arrive through a campaign link, the campaign name is kept in your browser for up to 30 days and saved to your account if you sign up. The site stores your light or dark theme choice in your browser's own storage. Sign-up loads Cloudflare Turnstile, and paying a club loads Stripe. If you sign in on the website, Supabase Auth issues the session.

9. Data storage and security

Your data is stored using Supabase with row-level security policies, and all data is transmitted over HTTPS. Your email address, your phone number, your date of birth, and how you want to play are blocked from direct reads at the database level, not only hidden in the app. Staff access to member records is checked against each staff member's role, and what CourtPlay staff view under a club's grant is logged.

10. Your rights

Access: You can view your data within the app
Deletion: Open your profile, tap Privacy & data, and tap Delete Account in the Your data group, then confirm. This permanently removes your account, your personal data, your profile and chat images, your member passes, and your membership of every club and group. It cannot be undone. Records a club must keep — signed waivers, check-ins, and payments and refunds — stay with that club after you delete your account, detached from it. If you signed in with Apple, we also revoke the Sign in with Apple credential at the same time. If you signed in with Google, deleting your CourtPlay account removes your data from our systems, but CourtPlay may still appear in Google's list of connected apps until you remove it there. If you cannot reach the app, email support@courtplay.ai from your account's email address and we will delete it for you. See §11 for how long residual copies persist.
Data export: Open your profile, tap Privacy & data, and use Download My Data, or contact us. Download My Data covers your account, games and messages; for your club records — memberships, bookings, waivers and check-ins — email support@courtplay.ai and we will provide them.
Analytics opt-out: In the iPhone app, open your profile, tap Privacy & data, and turn off Usage Analytics. It stops the events we send and the analytics SDK's own automatic capture, including screen replay, and it unlinks the events from you. That switch is kept on the device you set it on: it is not an account setting, so it does not follow you to another phone. The Android app and the website do not offer this switch — analytics runs there for everyone, and on the website it runs before you sign in. On the website, your browser's tracker blocking or a private window stops it. If you want your website analytics deleted, email support@courtplay.ai and we will remove them.
Texts: Reply STOP to any text to stop texts from every club (§5).
Change or withdraw how you want to play: Open your profile and use Gender. Removing it cancels your RSVPs for any upcoming Mixed Doubles games but leaves your past games and standings unchanged.
Data a club holds: For the records a club keeps about your membership with it, you can also ask the club directly.
Lawful basis (EEA, UK, Switzerland): Where the GDPR or UK GDPR applies, we process your account information, club, booking and payment data, and messages on the basis of Article 6(1)(b) (performance of the contract you accept by using CourtPlay). How you want to play, texts, and the CourtPlay AI assistant are processed on the basis of Article 6(1)(a) consent, which you can withdraw at any time using the options above. Analytics and crash reporting rely on Article 6(1)(f) legitimate interest in keeping the app working and improving it, and you can opt out as described above. You can also contact support@courtplay.ai to exercise your rights to access, rectification, erasure, restriction, portability, or to object, and to lodge a complaint with your supervisory authority.
California residents: The California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we collect, to delete personal information, to correct inaccurate personal information, to opt out of any "sale" or "sharing" of personal information, and to limit use of sensitive personal information. We do not sell or share personal information for cross-context behavioral advertising. Information about how you want to play is "sensitive personal information" under the CPRA; we use it only for the limited purposes described in §2 and you can change or remove it at any time. To exercise any of these rights, email support@courtplay.ai; we will not discriminate against you for doing so.

11. Data retention

Account data (name, email, profile photo, game history, messages) is retained for the lifetime of your account. When you delete your account, deletion from our active databases occurs promptly, including your profile and chat images. Residual copies in backups are purged within up to 30 days.

Some records are kept after you delete your account, on the ground that they may be needed to establish or defend legal claims, and are then purged:

Payments and refunds: 7 years.
Consent records (including your text message consent and opt-outs): 4 years.
Check-ins: 2 years.
Signed waivers: 3 years after your last visit to the club. The IP address and browser identifier stored with a signature are erased sooner: two years after you signed or 120 days after the signature stopped counting (it expired, or you signed a newer version), whichever is later.

The text of a text message is deleted once it has been handed to our provider.

Aggregated, de-identified analytics data (which cannot identify you) may be retained indefinitely to improve the service.

12. International data transfers

Your data is processed in the United States by the service providers named in §6. For users in the European Economic Area, United Kingdom, or Switzerland, these transfers are protected by Standard Contractual Clauses and by our service providers' data processing agreements, including the standard agreements of Twilio, Cloudflare and Vercel. You can learn more about these safeguards by contacting us at support@courtplay.ai.

13. Children's privacy and the 13+ age requirement

You must be 13 or older to create a CourtPlay account, and sign-up says so. We do not knowingly let a child under 13 create an account.

There is no child account. A parent or guardian, or a club, can enter the minimum details a club needs for a child to book and play — a name and, where the club asks, a date of birth — on the parent's family. The child does not sign in, and the parent can delete the child's details at any time. A waiver for a minor is signed by their parent or guardian. Sign-up stays 13 and older.

If you are a parent or guardian and believe that your child under 13 has provided personal information to us without your consent, please contact us at support@courtplay.ai. Upon verification, we will delete the account and all associated personal information in accordance with the U.S. Children's Online Privacy Protection Act (COPPA), the General Data Protection Regulation (GDPR), and any other applicable laws.

14. Advertising identifiers and tracking

We do not collect the Apple Identifier for Advertisers (IDFA). We do not track users across other apps or websites. No App Tracking Transparency prompt is shown because we do not perform tracking. The Apple Ads attribution in §6 comes from Apple's own attribution service and does not use the IDFA.

We do not collect advertising identifiers on any device: not the Apple Identifier for Advertisers, and not the Android advertising ID.

15. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes through the app.

16. Contact

For privacy questions or data requests, contact us at support@courtplay.ai.