Privacy Policy

This Privacy Policy explains how Courtinate, LLC, a Delaware limited liability company (“Courtinate,” “we,” “us,” or “our”), handles personal information when you visit or use courtinate.io and related Courtinate services (the “Service”). Courtinate helps college club tennis communities discover, organize, host, and participate in tournaments.

This policy applies to information handled by Courtinate. A school, tournament host, or other organization may separately control information it collects from you and may have its own privacy practices.

Depending on how you use the Service, we may collect:

• Account information, such as your name, email address, authentication details, account role, school affiliation, and preferences.
• Google sign-in information, if you sign in with Google. Google user data below describes what Google shares with Courtinate and how we handle it.
• School and tournament information, such as school names, locations, domains, team descriptions, logos, tournament schedules, venue details, contact information, registration deadlines, formats, fees, and host-provided notes.
• Registration and roster information, such as team names, player names and emails, captain names, phone numbers and emails, registration status, match assignments, and results.
• Content and communications, including forum posts and replies, uploaded school logos, support messages, invitations, notifications, and other information you choose to submit.
• Location and search information. If you choose to use a nearby-search feature, your browser may provide precise location for that request. We also process locations and addresses you type into search or tournament forms.
• Payment information. When you pay an entry fee or a hosting fee, payment is handled by Stripe, a third-party payment processor. Card and bank details go directly to Stripe and are not stored by Courtinate. We keep transaction records such as amounts, payment status, Stripe transaction identifiers, refund history, and dispute records (amount, reason, status, and evidence deadline).
• Stripe account information. A host school accepts entry fees through its own Stripe account, which a school administrator opens on the school’s behalf as the account holder. To open and verify that account, Stripe collects the account holder’s legal name, email address, phone number, date of birth, home address, and the last four digits of their Social Security number, and requires the full nine-digit Social Security number once the account reaches Stripe’s payment-volume threshold. The account holder provides this information directly to Stripe through Stripe-hosted onboarding, and may later update it in the Stripe Express Dashboard. Courtinate prefills the school’s name, the address of its public school page, the account holder’s Courtinate account email, a merchant category code, and a statement descriptor. Courtinate does not receive or store the date of birth, home address, Social Security number, or bank account details. We keep the Stripe account identifier, the account’s capability and requirements status, and which user opened the account. Stripe uses this information for identity verification, fraud prevention, compliance with anti-money-laundering and know-your-customer laws, and tax reporting, including any Form 1099-K that Stripe issues to the account holder where required by law.
• Technical information, such as IP address, device and browser information, request timestamps, URLs, error and security logs, and similar information generated when the Service is delivered.

This section applies if you sign in with Google. It describes what Google user data Courtinate accesses and how we use, share, protect, retain, and delete it.

• Data we access. Courtinate requests only Google’s basic sign-in scopes, “openid,” “email,” and “profile.” With them, Google shares your name, your email address and whether Google has verified it, the address of your Google profile photo, and your Google account identifier. Courtinate does not receive your Google password and does not request access to your Gmail, contacts, calendar, files, or any other data in your Google Account.
• How we use it. We use Google user data only to provide the Service to you: to create your Courtinate account, sign you in, suggest your name on the sign-up form, where you can change it, and send you the account, school, and tournament messages described in this policy at your email address. Courtinate does not display your Google profile photo.
• How we share it. We do not sell Google user data or share it with advertisers, data brokers, or information resellers. We disclose it only as follows: within the Service, where other users can see your name, and school administrators and tournament hosts can see your name and email address to manage participation; to service providers that process it on our behalf, namely Supabase, which stores it, Vercel, which hosts the Service, and Amazon Simple Email Service, which delivers email to your address; to Stripe, which receives your account email address if you open a Stripe account for your school; and for the legal, safety, and business reasons described in How information is disclosed.
• How we protect it. Google user data travels over encrypted HTTPS connections and is stored in Supabase, which encrypts stored data. Database access rules limit each user to the records they are allowed to see, and only the Courtinate team members who operate and support the Service have administrative access.
• Retention and deletion. We keep Google user data for as long as your account exists. When you delete your account from account settings, we delete your sign-in record, including the information Google shared, and your profile. Copies can remain in backups for a limited time, and records described in Retention and deletion, such as registrations, results, and payment records, can keep your name or email address. To ask us to delete your Google user data, email support@courtinate.io. You can also remove Courtinate’s access from the Third-party apps & services page of your Google Account. That ends Google sign-in but does not delete the data Courtinate already holds.
• Limited Use. Courtinate’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, sell it, use it to determine creditworthiness or for lending, or use it to develop, improve, or train artificial intelligence or machine learning models.
• Changes. If we change how we use Google user data, we will update this section and notify you before the change takes effect.

We use information to:

• Provide, operate, secure, troubleshoot, and improve the Service.
• Create accounts, verify access, and manage school and platform roles.
• Publish tournament and school information and coordinate registrations, brackets, schedules, standings, results, and communications.
• Send transactional messages, including verification, password recovery, invitations, registration updates, and service notices.
• Respond to support, privacy, safety, moderation, and legal requests.
• Detect misuse, enforce our Terms, protect users, and comply with law.

Courtinate uses Vercel Web Analytics and Vercel Speed Insights to count visits and measure page performance in aggregate. For each page view, Vercel receives the page address, the referring site, an approximate location, and the device, operating system, and browser type. Before a page address is sent, we remove its query parameters, other than campaign tags, and anything after the “#”. Vercel Web Analytics tells visits apart by a hash of the request that Vercel discards after 24 hours, not by a cookie.

Vercel Web Analytics also counts four actions: finishing sign-up, applying to add a school, creating a tournament, and registering teams. For each one, Vercel receives the address of the page where it happened, an approximate location, the device and browser type, and details of the action, such as the number of teams or the state where a tournament is held. These counts never include your name, email address, or account.

Courtinate does not use third-party advertising tools, sell personal information, or use personal information for cross-context behavioral advertising.

We may disclose information in the following circumstances:

• Within the Service. Published school and tournament details, team and player names, schedules, brackets, standings, results, and forum content may be visible to other users or the public. Every approved school has a public school page; its contact email is shown only to signed-in users. School administrators and tournament hosts may see contact and registration details needed to manage participation, including the payment, refund, and dispute status of each registration. When you pay an entry fee, the payment is made to the host school’s Stripe account. The host school can view that payment in its Stripe Express Dashboard, including the customer information and payment method details Stripe shows to a merchant, such as the payer’s name and email address and the payment method’s type and last four digits, and can issue refunds and respond to disputes there. Platform administrators can see payment records, refund history, and dispute records across the Service.
• Service providers. We use Supabase for database, authentication, realtime, and file-storage services; Vercel for application hosting, delivery, and the visit and performance measurement described above; Amazon Simple Email Service for transactional email; Stripe for payment processing; and Mapbox and TomTom for mapping, geocoding, address search, and route features. These providers process information to provide services to us and operate under their own contractual and privacy obligations.
• Stripe. We use Stripe for payments and related business services. Stripe processes entry fees on behalf of the host school, which is the merchant of record for its own entry fees; processes hosting fees on behalf of Courtinate; and pays Courtinate its platform fee out of each entry payment. Stripe may collect personal data, including through cookies and similar technologies on its hosted checkout and onboarding pages, such as transactional data and identifying information about the devices that connect to its services. Stripe uses this information to operate and improve the services it provides to us and to host schools, including fraud detection, loss prevention, authentication, and identity verification. For the account information described above, Stripe acts as an independent data controller for its own purposes, including identity verification, fraud prevention, and legal compliance. Stripe makes a host school’s payment data available to that school through the school’s own Stripe account. You can learn more about Stripe and read its privacy policy at stripe.com/privacy.
• Legal and safety reasons. We may disclose information if reasonably necessary to comply with law, protect rights and safety, investigate fraud or misuse, or establish and defend legal claims.
• Business changes. Information may be transferred as part of a merger, financing, reorganization, acquisition, bankruptcy, or sale of assets, subject to applicable law.
• At your direction. We may disclose information when you ask us to or give consent.

Location access is optional. Your browser asks for permission before sharing precise location with Courtinate. You can deny or revoke that permission in your browser or device settings and enter a location manually instead.

The Service uses cookies and similar browser storage that are necessary for sign-in, security, account flows, and interface preferences such as theme and sidebar state. We may also use short-lived session storage to preserve navigation context. Courtinate does not currently use advertising cookies. Blocking essential storage may prevent parts of the Service from working.

We retain information for as long as reasonably necessary to provide the Service, maintain tournament and organizational records, comply with legal obligations, resolve disputes, enforce agreements, and protect the Service. Retention periods vary based on the type of information and why it is needed.

Account deletion is available from account settings. Some records may need to be reassigned or retained so that school administration, tournament history, registrations, schedules, and results remain accurate. Deletion may be delayed when an account is the sole administrator or still owns records that cannot safely be reassigned. Limited information may remain in backups, security logs, or records we must keep by law.

Payment, refund, and dispute records are financial records. We retain them for as long as tax, payment-network, and other legal requirements demand, including after the related account is deleted.

We use administrative, technical, and organizational safeguards designed to protect information, including access controls, encrypted network connections, and provider security features. No system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur. Protect your account credentials and notify us if you suspect unauthorized access.

You may update certain profile information and preferences through the Service, manage browser permissions, or delete your account where available. Depending on where you live, you may also have rights to request access, correction, deletion, or a copy of personal information, or to object to or restrict certain processing.

To submit a privacy request, email support@courtinate.io. We may need to verify your identity and authority before completing a request. We will not discriminate against you for exercising applicable privacy rights.

The Service is intended only for people who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided personal information, contact us so we can review and address it.

Courtinate is operated in the United States. If you use the Service from another country, your information may be processed in the United States and other locations where our service providers operate, which may have different data-protection laws than your jurisdiction.

We may update this Privacy Policy as the Service or applicable requirements change. We will post the updated policy and revise the date above. If a change is material, we may provide additional notice as appropriate.

Questions or requests may be sent to support@courtinate.io.