Privacy policy

The controller responsible for Padelmia Social is:

This policy applies to the Padelmia Social website, mobile application, and backend service. Padelmia Social helps players find courts and coordinate games with friends. Court search can be used without an account; account, friend, availability, and game-planning features require authentication.

We process personal data only as needed to provide, secure, and improve the service. We do not sell personal data and do not use it for third-party advertising.

Depending on how you use Padelmia Social, we process:

• Account and profile data — your authentication-provider user ID, email address, display name, initials, invite code, and an optional profile-image URL.
• Friend data — friend connections, favorites, private friend tags, and games played together.
• Location and availability preferences — your selected city, search radius, optional city coordinates, and recurring preferred or available time windows.
• Favourite clubs — the clubs you star, with the club name and town the app showed. When you are signed in they are stored with your account, so they follow you to a new device.
• Game-planning data — games you organize or join, invitations and declines, date and time, venue, booking options, booking status, and cancellation information.
• Game ratings — after a game you played, how it felt, whether it was not your day, which player you thought was strongest and who came closest, or that the game was even.
• Club requests — the club name, an optional town, and the email address you give us when you ask for a club that Padelmia does not list yet.
• Technical data — IP address and request metadata needed to deliver and protect the service, plus limited device, application, error, and performance information. If you enable push notifications, this includes an app-installation identifier, Expo push token, device platform, app variant, app version, and delivery status.
• Usage statistics — which screens you open and which features you use: anonymously while you are signed out and have not been asked yet, and linked to your account only if you agree, as described in section 16.

We use Clerk to provide sign-in and session management. Clerk handles credentials and, when selected, sign-in through Apple, Google, or Facebook. Padelmia Social receives a Clerk user ID, the profile details made available to us, and a verified session token. We do not receive your Apple, Google, Facebook, or email-account password.

If you add a profile photo, the selected image is uploaded directly to Clerk, which stores and serves the image. Padelmia Social stores the resulting profile-image URL so the photo can appear to friends and other players in your games. You can replace or remove the photo from your profile.

Authentication data is processed to create and operate your account under Art. 6(1)(b) GDPR. Clerk may process data outside the European Economic Area using applicable transfer safeguards. See Clerk’s privacy policy.

Padelmia Social uses Padelmia.com, another service operated by Rocket Solutions S.L., as its provider for club information and live court availability. When you search, our backend sends the relevant search text or parameters, such as city, radius, date, time, and duration, to Padelmia.com. It receives club details, available slots, prices, photos, and links to the club or booking provider.

Before you have chosen a town, the app suggests towns near you. To do this, our backend sends your IP address to Padelmia.com, which estimates an approximate area from it and returns nearby towns with clubs. Padelmia Social does not store that estimate, and it does not request your device’s precise location for these suggestions.

We do not send your name, email address, friend graph, availability preferences, or authentication token to Padelmia.com for these lookups. The provider request is made server-to-server. Padelmia.com’s separate website policy is available at padelmia.com/en/privacy.

The service and its PostgreSQL database are hosted on infrastructure provided by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). Connection and server logs may include an IP address, access time, request method and path, response status, and similar security and diagnostic information.

This processing is necessary to deliver account features under Art. 6(1)(b) GDPR and reflects our legitimate interest in a reliable and secure service under Art. 6(1)(f) GDPR. See Hetzner’s privacy policy.

The app stores the authentication session in Clerk’s secure token cache. It also stores settings such as account tier, home selection, favourite clubs, search filters, and selected friends on your device or, for the web version, in browser local storage. These settings are used to restore your choices and are not advertising trackers. If you agree to usage statistics, the app also stores a random analytics identifier on your device (see section 16); it does not do so before you agree. Favourite clubs you star while signed out stay on the device until you sign in; they are then added to your account.

The public website currently uses no advertising or analytics cookies. It loads fonts from Google Fonts and interface scripts from jsDelivr. Those providers receive the technical information required to deliver the requested files, such as your IP address, browser details, and referrer. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in delivering a usable website).

Your selected city, search radius, and any coordinates associated with that city are used to find nearby courts and calculate distance. Registered users’ choices are stored with their account; anonymous choices remain on the device unless you later save them to an account. Padelmia Social does not currently request continuous or background location access.

Availability windows are used to calculate suitable game times. Friends may see the time windows relevant to planning a game with you. Your stored home coordinates are not shown to other users. This processing is necessary to provide the features you request under Art. 6(1)(b) GDPR.

Other users can see the profile information needed to recognize you, such as your display name and profile image, when they are connected to you or participate in a relevant game. Organizers, invited players, and participants can see the game schedule, venue, lineup, invitations, and participation status as required by the selected game visibility. Your one-sided favorites and friend tags remain private to your account.

Invite codes are intended to be shared. Anyone who receives a valid code may use it to add the corresponding player to their friend list, so only share your code with people you want to connect with.

After a game played in full on a booked court, the app asks each of the four players how it went: how the game felt, whether it was not their day, which player was strongest and which of the other two came closest, or that the game was even. Answering is optional, and you can skip any question.

Your answers are private. They are never shown to the other players, to your friends, on a profile, or in public, and nobody is told how you rated a game or whether another player named them. Only we use them: together with other players’ answers, to learn which players are evenly matched and enjoy playing together, so that we can suggest better games, including with players outside your friends. This does not involve automated decisions with legal or similarly significant effects for you.

The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in helping players find balanced and enjoyable games). You can object at any time by contacting us; we then delete your ratings and stop using ratings that name you. Ratings are kept while your account is active. When you delete your account, your ratings and any ratings that name you are deleted with it.

If you cannot find your club, you can ask us to add it by giving the club’s name, optionally its town, and an email address. We use your email address only to tell you once, when that club joins Padelmia. Nothing is sent when you submit the request, and we do not use the address for newsletters or marketing.

Your email address is not shared with Padelmia.com or with any club. We may use the club name and town, without your email address, to contact the club or to add it to Padelmia.com. This processing takes place at your request under Art. 6(1)(b) GDPR.

A club request is deleted 30 days after we have told you the club joined, and otherwise after 12 months. To withdraw a request earlier, email info@rocket-solutions.de from the address you used.

Court photos may be loaded from Padelmia or an external image host. When your device loads an external image, that host may receive your IP address and request metadata. If you open directions or a booking link, you leave Padelmia Social and interact with a map service, padel club, or booking platform such as Playtomic, Matchpoint, or the club’s own system. Those services process data under their own privacy policies.

Padelmia Social does not complete the court booking and does not receive your payment details or the credentials you use on an external booking platform.

If you choose “Add to calendar,” the app asks for the operating-system calendar permission and writes the selected game to a calendar on your device. Padelmia Social does not read unrelated calendar entries. Your device or calendar provider may sync the event according to the settings and privacy policy of that provider.

If you enable notifications, Padelmia Social uses an installation-specific Expo push token to send game invitations, lineup and booking updates, cancellation notices, and time-sensitive court-booking reminders. Notification content may include a player name and the date, time, venue, or status of the relevant game.

Delivery is handled by Expo Push Service and the operating-system service for your device: Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM). Those providers receive the token and notification data required for delivery. You can decline permission, change notification access in your device settings, or use the Notifications control in your profile. The legal basis is Art. 6(1)(b) GDPR for the game updates you request and Art. 6(1)(a) where operating-system permission is based on consent.

We use Sentry to detect application errors, security issues, and performance problems. Sentry may receive error messages, stack traces, app and device information, request paths, response status, and timings. The mobile and backend SDKs are configured not to send default personal information. Application reporting does not add authorization headers, API request bodies, or query strings, and user-entered search and scheduling fields are redacted from backend log copies sent to Sentry.

The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in operating a stable and secure service). See Sentry’s privacy policy.

While you use the app signed out, before it has asked you about usage statistics, we count anonymously which screens you open and which first steps you take, such as searching for a club, starring clubs, starting a court booking, or starting to sign in, including the region and town you look at. These events carry a random ID that exists only in the app’s memory and is replaced every time the app starts. Nothing is stored on your device for this, no person profile is created, and the events are never linked to an account, not even if you later sign in or agree to usage statistics. Counting stops as soon as you answer the question below, and does not resume if you decline. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in understanding how new players find their way into the app); you can object at any time by declining when asked or by contacting us.

The app asks once whether you want to share usage statistics. Only if you tap Happy to help do we use PostHog to learn which screens you open and which features you use, such as creating or joining a game, sharing an invite, or adding a friend, and whether you were asked to rate a game and answered (never your answers), together with the app version, device model, and operating system. For games you plan and courts you book we note only the weekday, the hour, how many days ahead, the length, and the booking provider — not the date, the club, or the town. These events are linked to the random internal ID of your Padelmia Social account, never to your name or email address. We do not record the content of your games, the people in them, your location, or your screen, and PostHog discards your IP address.

PostHog Inc. processes this data for us on servers in the European Union (Frankfurt). If you decline, the app does not load analytics and stores no analytics identifier. You can change your choice at any time under Profile → Usage statistics; withdrawing stops collection and removes the identifier from your device. When you delete your account, we also ask PostHog to delete the analytics data linked to it.

The legal basis is your consent under Art. 6(1)(a) GDPR and, for storing the identifier on your device, Art. 22(2) of the Spanish LSSI. See PostHog’s privacy policy.

Apple, Google, and Expo may process device, account, download, crash, and update-request information when they distribute, install, or update the app. Their processing is governed by the privacy settings and policies for the relevant store, operating system, or Expo service.

We rely on the following GDPR legal bases:

• Art. 6(1)(b) — to provide requested account, friend, availability, search, and game-planning features, and to answer club requests.
• Art. 6(1)(f) — to secure, monitor, debug, and improve the service and prevent misuse, and to use game ratings to suggest well-matched games.
• Art. 6(1)(a) — where the operating system asks for your consent to an optional device permission, and for usage statistics if you agree to them.
• Art. 6(1)(c) — where processing is required to comply with a legal obligation.

We disclose data only where necessary to operate the service, to the providers described above, to professional advisers or authorities where legally required, or during a lawful business transaction. Providers acting for us are bound by appropriate contractual and data-protection obligations.

Where a recipient processes data outside the European Economic Area, we rely on an applicable adequacy decision, Standard Contractual Clauses, or another lawful transfer mechanism.

Subject to the applicable conditions, you have the right to:

• request access to your data (Art. 15);
• correct inaccurate data (Art. 16);
• request erasure (Art. 17);
• restrict processing (Art. 18);
• receive portable data (Art. 20);
• object to processing based on legitimate interests (Art. 21); and
• withdraw consent at any time for future processing where consent is the legal basis.

To exercise a right, contact info@rocket-solutions.de.

You may lodge a complaint with a data-protection supervisory authority. As the controller is established in Spain, the competent authority is:

We may update this policy when the service or legal requirements change. The current version is always available on this page, and the date above will show the latest revision.