Upcourt privacy policy

Account and sign-in. Your name, email address, and password. If you sign in with Google or Apple instead, we receive your name, email address, and profile picture from them and store no password. We also keep a record of which provider you used.

Player profile. A username, an optional profile photo, an optional self-reported skill level, and the venue you last used. If you turn on the online indicator, we store the time you were last active so friends can see it.

Play activity. Your reservations, cancellations, check-ins, queue position, and the games you played, each tied to a venue and session. Court rental bookings, their amounts, and a reference for how they were paid.

Messages. Direct messages between friends and session group chats, including any images you send. Reports you file about content, and reports filed about yours.

Social connections. Friend requests, friendships, blocks, session partner pairings, saved venues, and venues you follow.

Venue staff and employment records. For staff whose employer uses Upcourt: job title, employee code, venue and role assignment, employment periods, schedules, shift and attendance records, timesheets, and pay rates. This information belongs to the employing venue, which decides what to record and who may see it.

Devices and technical data. If you use the mobile app, a push notification token for your device. To limit repeated form submissions we store a one-way hash derived from your network address — never the raw address, and never your browser user agent alongside it. Our error monitoring strips passwords, tokens, cookies, email addresses, phone numbers, and pay figures before a report leaves our systems.

Beta requests. Your name, work email, and venue or company name; optionally a phone number, venue name, city, venue and court counts, the activities you run, and what you want Upcourt to improve. Limited campaign and referring-page information when present.

We do not ask for or store government identification numbers, card numbers, or bank details. We do not track you across other websites, and Upcourt contains no advertising or analytics trackers.

When you choose “Continue with Google”, Upcourt requests only the basic sign-in scopes: openid, email, and profile. We ask for no other Google scopes. Upcourt cannot read your Gmail, Drive, Calendar, Contacts, or any other Google service, and never requests permission to.

What we do with it. Your Google name, email address, and profile picture are used to create and identify your Upcourt account and to display you to other players as described in this policy. We store them in our own database for as long as your account exists. We do not use Google data for advertising, we do not sell it, we do not transfer it to anyone except the service providers listed below, and we do not use it to build profiles beyond running Upcourt itself.

Upcourt’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Apple sign-in works the same way and returns the same basic details. You can revoke Upcourt’s access at any time from your Google or Apple account settings; doing so stops future sign-ins but does not by itself delete your Upcourt account. To delete the account, see Your rights.

To run your account and sign you in; to take and manage bookings; to run check-in, queueing, and matchmaking at a venue; to deliver messages and notifications you have asked for; to let venues operate their courts, sessions, and staff; to keep the service secure and prevent abuse; and to meet legal, tax, and accounting obligations.

We do not use your information for advertising, we do not sell it, and we do not share it with data brokers.

Other players. Your username, profile photo, and skill level are visible to players you share a session with. Your full name is shown only to friends; to everyone else it is shortened. Your online status is visible only to friends, and only while you leave it enabled. Your email address is never shown to another player.

Venue staff. Staff at a venue you book or attend can see your name, your bookings and attendance at theirvenue, and — for a session you joined — that session’s group chat. Staff at one venue cannot see your activity at another. Your direct messages with other players are never visible to venue staff.

Upcourt. A small number of authorised personnel can access production data where necessary to operate the service, investigate a fault, or review a content report.

You control whether you are discoverable in player search, whether your online status is shown, and whether you accept friend requests, from Privacy in your profile settings. These are enforced on our servers, not merely hidden in the app.

We use a small number of providers, each only for the purpose named:

• Google and Apple — sign-in, if you choose it.
• Cloudflare — the Turnstile security check that protects our registration and beta forms from automated abuse.
• Zoho Mail — sending transactional email such as verification and account notices.
• Expo — delivering push notifications to your device, if you use the mobile app and enable them.
• Contabo — the servers and database that host Upcourt.
• Sentry — error monitoring, with the redaction described above.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

Upcourt’s servers and database are hosted in Singapore. If you are in the Philippines, this means your information is transferred outside the country and processed there under contractual and technical safeguards. Some providers listed above may process limited data in other countries.

• Account and profile — until you delete your account.
• Session group chats — deleted 90 days after the session ends, images included.
• Direct messages — deleted after 365 days with no new message in the conversation. A conversation you still use is kept while you use it.
• Content under an open report — held past the windows above until the report is resolved, so a complaint cannot be erased by waiting.
• Bookings, payments, and attendance— kept as the venue’s business record, and for as long as Philippine tax and accounting law requires. These survive account deletion in anonymised form.
• Employment and pay records — kept by the employing venue for the period Philippine labour law requires.
• Beta requests — deleted after 12 months without relationship activity, unless the request becomes an active beta or customer record, is linked to a live invitation or offer, or has an open follow-up task.

Under the Philippine Data Privacy Act of 2012 you may ask what information we hold about you, have it corrected, object to how it is used, ask for a copy, or have it removed. Email privacy@upcourt.online from the address on your account, or use the controls in the app.

Deleting your account. Email privacy@upcourt.online from the address on your account and we will delete it. Deletion is immediate once actioned and cannot be undone. It destroys your name, email address, password, profile photo, username, skill level, friendships, blocks, saved venues, notifications, and device tokens; releases any upcoming reservation back to the venue; and deletes your direct message conversations, including for the person you were talking to. Your messages in session group chats are removed while the rest of the conversation stays for its other participants.

What we cannotdelete is the venue’s record that a booking and an attendance happened — a venue’s own business and tax records are not ours to erase. Those rows stay, detached from your identity, and can no longer be linked back to you through Upcourt. Your email address and username are released, so you may register again with either.

If you believe we have mishandled your information you may complain to the National Privacy Commission, and we would appreciate the chance to put it right first.

Passwords are stored only as salted, computationally hardened hashes and are never recoverable. Traffic is encrypted in transit. Access to production data is limited to authorised personnel and audited. Message images are served only to people entitled to the conversation, never from a public URL. No system is perfectly secure; if a breach affects your information we will notify you and the National Privacy Commission as the law requires.

Upcourt is not directed at children under 13, and we do not knowingly create accounts for them. Where a venue registers a junior player, the venue is responsible for obtaining a parent or guardian’s consent. If you believe a child has an account with us, write to privacy@upcourt.online and we will remove it.

We will update the date at the top when this policy changes, and tell you in the app before a material change to how we use your information takes effect.

Reasoned Information Technology Solutions, operator of Upcourt. Privacy questions and requests: privacy@upcourt.online. For anything else, support@upcourt.online.