Privacy policy

The controller responsible for Padelmia Social is:

This policy applies to the Padelmia Social website, mobile application, and backend service. Padelmia Social helps players find courts and coordinate games with friends. Court search can be used without an account; account, friend, availability, and game-planning features require authentication.

We process personal data only as needed to provide, secure, and improve the service. We do not sell personal data and do not use it for third-party advertising.

Depending on how you use Padelmia Social, we process:

• Account and profile data — your authentication-provider user ID, email address, display name, initials, invite code, and an optional profile-image URL.
• Friend data — friend connections, favorites, private friend tags, and games played together.
• Location and availability preferences — your selected city, search radius, optional city coordinates, and recurring preferred or available time windows.
• Game-planning data — games you organize or join, invitations and declines, date and time, venue, booking options, booking status, and cancellation information.
• Technical data — IP address and request metadata needed to deliver and protect the service, plus limited device, application, error, and performance information. If you enable push notifications, this includes an app-installation identifier, Expo push token, device platform, app variant, app version, and delivery status.

We use Clerk to provide sign-in and session management. Clerk handles credentials and, when selected, sign-in through Apple or Google. Padelmia Social receives a Clerk user ID, the profile details made available to us, and a verified session token. We do not receive your Apple, Google, or email-account password.

If you add a profile photo, the selected image is uploaded directly to Clerk, which stores and serves the image. Padelmia Social stores the resulting profile-image URL so the photo can appear to friends and other players in your games. You can replace or remove the photo from your profile.

Authentication data is processed to create and operate your account under Art. 6(1)(b) GDPR. Clerk may process data outside the European Economic Area using applicable transfer safeguards. See Clerk’s privacy policy.

Padelmia Social uses Padelmia.com, another service operated by Rocket Solutions S.L., as its provider for club information and live court availability. When you search, our backend sends the relevant search text or parameters, such as city, radius, date, time, and duration, to Padelmia.com. It receives club details, available slots, prices, photos, and links to the club or booking provider.

We do not send your name, email address, friend graph, availability preferences, or authentication token to Padelmia.com for these lookups. The provider request is made server-to-server. Padelmia.com’s separate website policy is available at padelmia.com/en/privacy.

The service and its PostgreSQL database are hosted on infrastructure provided by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). Connection and server logs may include an IP address, access time, request method and path, response status, and similar security and diagnostic information.

This processing is necessary to deliver account features under Art. 6(1)(b) GDPR and reflects our legitimate interest in a reliable and secure service under Art. 6(1)(f) GDPR. See Hetzner’s privacy policy.

The app stores the authentication session in Clerk’s secure token cache. It also stores settings such as account tier, home selection, search filters, and selected friends on your device or, for the web version, in browser local storage. These settings are used to restore your choices and are not advertising trackers.

The public website currently uses no advertising or analytics cookies. It loads fonts from Google Fonts and interface scripts from jsDelivr. Those providers receive the technical information required to deliver the requested files, such as your IP address, browser details, and referrer. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in delivering a usable website).

Your selected city, search radius, and any coordinates associated with that city are used to find nearby courts and calculate distance. Registered users’ choices are stored with their account; anonymous choices remain on the device unless you later save them to an account. Padelmia Social does not currently request continuous or background location access.

Availability windows are used to calculate suitable game times. Friends may see the time windows relevant to planning a game with you. Your stored home coordinates are not shown to other users. This processing is necessary to provide the features you request under Art. 6(1)(b) GDPR.

Other users can see the profile information needed to recognize you, such as your display name and profile image, when they are connected to you or participate in a relevant game. Organizers, invited players, and participants can see the game schedule, venue, lineup, invitations, and participation status as required by the selected game visibility. Your one-sided favorites and friend tags remain private to your account.

Invite codes are intended to be shared. Anyone who receives a valid code may use it to add the corresponding player to their friend list, so only share your code with people you want to connect with.

Court photos may be loaded from Padelmia or an external image host. When your device loads an external image, that host may receive your IP address and request metadata. If you open directions or a booking link, you leave Padelmia Social and interact with a map service, padel club, or booking platform such as Playtomic, Matchpoint, or the club’s own system. Those services process data under their own privacy policies.

Padelmia Social does not complete the court booking and does not receive your payment details or the credentials you use on an external booking platform.

If you choose “Add to calendar,” the app asks for the operating-system calendar permission and writes the selected game to a calendar on your device. Padelmia Social does not read unrelated calendar entries. Your device or calendar provider may sync the event according to the settings and privacy policy of that provider.

If you enable notifications, Padelmia Social uses an installation-specific Expo push token to send game invitations, lineup and booking updates, cancellation notices, and time-sensitive court-booking reminders. Notification content may include a player name and the date, time, venue, or status of the relevant game.

Delivery is handled by Expo Push Service and the operating-system service for your device: Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM). Those providers receive the token and notification data required for delivery. You can decline permission, change notification access in your device settings, or use the Notifications control in your profile. The legal basis is Art. 6(1)(b) GDPR for the game updates you request and Art. 6(1)(a) where operating-system permission is based on consent.

We use Sentry to detect application errors, security issues, and performance problems. Sentry may receive error messages, stack traces, app and device information, request paths, response status, and timings. The mobile and backend SDKs are configured not to send default personal information. Application reporting does not add authorization headers, API request bodies, or query strings, and user-entered search and scheduling fields are redacted from backend log copies sent to Sentry.

The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in operating a stable and secure service). See Sentry’s privacy policy.

Apple, Google, and Expo may process device, account, download, crash, and update-request information when they distribute, install, or update the app. Their processing is governed by the privacy settings and policies for the relevant store, operating system, or Expo service.

We rely on the following GDPR legal bases:

• Art. 6(1)(b) — to provide requested account, friend, availability, search, and game-planning features.
• Art. 6(1)(f) — to secure, monitor, debug, and improve the service and prevent misuse.
• Art. 6(1)(a) — where the operating system asks for your consent to an optional device permission.
• Art. 6(1)(c) — where processing is required to comply with a legal obligation.

We disclose data only where necessary to operate the service, to the providers described above, to professional advisers or authorities where legally required, or during a lawful business transaction. Providers acting for us are bound by appropriate contractual and data-protection obligations.

Where a recipient processes data outside the European Economic Area, we rely on an applicable adequacy decision, Standard Contractual Clauses, or another lawful transfer mechanism.

Subject to the applicable conditions, you have the right to:

• request access to your data (Art. 15);
• correct inaccurate data (Art. 16);
• request erasure (Art. 17);
• restrict processing (Art. 18);
• receive portable data (Art. 20);
• object to processing based on legitimate interests (Art. 21); and
• withdraw consent at any time for future processing where consent is the legal basis.

To exercise a right, contact info@rocket-solutions.de.

You may lodge a complaint with a data-protection supervisory authority. As the controller is established in Spain, the competent authority is:

We may update this policy when the service or legal requirements change. The current version is always available on this page, and the date above will show the latest revision.