Privacy Policy
Version 2026-10-10
What Court Market collects when you use it, why, and who sees it. Court Market is operated by HS Tech.
Placeholder: requires review by a qualified attorney before launch.
What we collect and why
We collect only what the service uses. If a field isn’t listed here, we don’t ask for it.
| Data | What it includes | Why |
|---|---|---|
| Account | Email address, password (stored hashed by our sign-in provider), first and last name, a phone number (needed to book), an optional home ZIP, your confirmation that you are 18 or older, an optional choice of whether you mostly play, train or coach, and which version of the Terms and Privacy Policy you agreed to and when. | To sign you in, confirm your email, let a gym reach you about your booking, default your searches to your area, count players by role in our own totals (never shown to gyms or other players), and keep a record of what you agreed to. |
| Bookings | The gym, court, time, price, booking code and status, cancellations, refunds, problem reports (and what you write in them) and no-show disputes; which versions of the Terms and Privacy Policy you agreed to when you booked. | To provide the booking, send confirmations and reminders, handle refunds and resolve problems. |
| Payments | Amounts, payment and refund status, and Stripe's reference ids. Your card details go to Stripe; we never receive the full card number. | To take payment, refund and pay the gym. |
| Location | The place you search for (typed, or your device location only when you tap "Use my location", rounded to about 110 m). Our usage counts keep only the ZIP, city and state of a search. Your browser remembers your last search place until you clear it. | To show courts near you and to understand where courts are needed. |
| Reviews and messages | Reviews you post (shown publicly with your first name); messages and data requests sent through the contact form, with your name and email. | To help other players choose, and to answer you. |
| Usage counts | Events such as searches, gym page views and bookings, linked to your account if you are signed in, or otherwise to a daily label made on our server (no cookie). Not recorded if your browser sends Global Privacy Control. | To measure and improve the service. It isn't used to identify you or for advertising. |
| Devices | If you allow notifications in the mobile app, a push token for that device, linked to your sign-in session. | To send booking notifications to your phone. |
| Gym partners | For gyms: the facility's details, the owner's name, title, phone, email and role, the last four digits of a tax id, entity type, a listing link, verification documents (kept private) and the time and IP address of the attestation. | To verify the facility is real before it takes bookings. |
Children
Court Market is for adults. You must be 18 or older to create an account, and we ask you to confirm it when you sign up. The service isn’t directed to children under 13, and we don’t knowingly collect personal information from children under 13. Players under 18 can play when a parent, guardian or coach books for them; they do not have accounts, and we collect nothing about them beyond what the adult chooses to put in a booking. No form on Court Market asks for a child’s details. If you think a child has given us personal information, contact us and we will delete it.
For counsel to draft
- Whether the 18-or-older rule and the under-13 statement are enough, and any state-specific rules for teens
Who sees it
The gym you book sees your name, phone number and the booking, so they can run it and reach you. Other players see reviews you post, with your first name. We do not sell your personal information and we do not share it for advertising.
For counsel to draft
- Disclosures required by law (e.g. to authorities) and in a business transfer
- Whether any use counts as a "sale" or "sharing" under state privacy laws
Service providers and what they receive
These companies process data for us to run Court Market. Each receives only what its job needs:
| Provider | For | What it receives | Where |
|---|---|---|---|
| Stripe | Card payments, refunds and payouts to gyms. | Your card details and billing details, entered into Stripe's own fields (we never receive the full card number); amounts and references; device and browser signals on the checkout page for fraud prevention. Gyms also give Stripe their identity and bank details to be paid. | Checkout page; gym payout setup (hosted by Stripe) |
| Supabase | Our database, sign-in and photo storage. | Everything in the table above that we store, your email and a hashed password, and the IP address and browser of each sign-in session (kept by Supabase Auth). | Every page that signs you in or loads your data |
| Vercel | Hosts the website and API. | Standard request logs: IP address, browser, the page requested and the time. | Every request |
| Mapbox | Maps, and turning a typed address or ZIP into a location. | For maps (only after you choose Show map): your IP address, the map area you view, and map-load events with an anonymous browser id that Mapbox GL JS stores in this browser. For address lookups, which our server makes for you: the text you typed, not your identity. | Search map, gym location picker, address and ZIP lookups |
| Cloudflare Turnstile | Checks that sign-up and the contact form are used by a person, not a script. | Your IP address, browser and device signals, and how you interact with the check, sent to Cloudflare to produce a pass or fail. It sets no cookie and stores nothing on our site (checked). Our server sends the one-time result back to Cloudflare to confirm it. | Sign-up and the contact form (the contact check is skipped when you are signed in) |
| Sentry | Error monitoring. | When something breaks: the error message, where in the code it happened, the page address without its query string, your browser and operating system, and your IP address as it reaches Sentry. We configure it to attach no account, email, cookies, request bodies or local variables, and we scrub emails, phone numbers and card-like numbers before sending. It records errors only: no performance tracing, screen recording or session replay. | Website, API and the mobile app, when an error occurs |
| Resend | Sends email. | Your email address and the message we send. Open and click tracking is turned off. | Booking, account and optional emails |
| Expo | Delivers push notifications to the mobile app. | The push token for your device and the notification text. | Mobile app, only if you allow notifications |
| Inngest | Runs our scheduled jobs (reminders, payouts, clean-up). | Job runs and the identifiers they work on; no card data. | Background only |
| Upstash | Rate limiting (stops abuse of sign-in, search and the contact form). | A one-way hash of your IP address or email with a counter, which expires within the hour. | Sign-in, sign-up, search, contact form |
We use no third-party advertising or analytics services.
For counsel to draft
- Confirm the provider list and data processing agreements before launch
- Where data is stored and international transfers
Cookies and browser storage
The website sets sign-in cookies, remembers a few choices in your browser, and (on the checkout page only) lets Stripe set fraud-prevention cookies. It has no advertising or analytics cookies. Maps load from Mapbox only after you choose to show one. The full list, with what each is for and how long it lasts, is in the Cookie Policy.
How long we keep it
| Data | How long |
|---|---|
| Account details (name, phone, home ZIP) | While your account is open. Removed when you delete it. |
| Email and sign-in record | While your account is open. On deletion the address is replaced and the login is permanently disabled. |
| Bookings, payments and refunds | Kept after you delete your account, without your name, phone or email, for accounting and disputes.How long is for counsel and our accountant to set. |
| Reviews you wrote | Removed when you delete your account. |
| Saved gyms | Removed when you delete your account. |
| Your record of agreeing to the Terms and Privacy Policy | Kept with your booking records, as evidence of what you agreed to. |
| Email, push and in-app notification log | 13 months |
| Push tokens | Stopped when you sign out; deleted 30 days after. |
| Contact form messages and data requests | 24 monthsThe hashed IP used for the spam limit is removed after 7 days. |
| Product usage events (searches, page views, bookings) | 25 monthsThe daily visitor label on an event is removed after 7 days. Totals are kept as daily counts. |
| Gym verification records and documents | Kept; nothing deletes them automatically.How long is for counsel to set. |
| Audit log of administrator actions | Kept; it can't be edited or deleted.How long is for counsel to set. |
| Rate-limit counters | Expire within an hour. |
| Address-lookup caches | 90 days. |
| Error reports (Sentry) and server logs (Vercel) | Up to 90 days, as set in those services. |
Deleting your account removes your name, phone, email and home ZIP, your saved gyms and your reviews, and permanently disables your login. Booking and payment records stay, without your personal details, because accounting and disputes require them. Backups are overwritten on their normal cycle.
For counsel to draft
- Retention periods for each kind of data, especially bookings, payments, verification records and the audit log
- Backups and how long deleted data persists in them
Your choices and rights
- Get a copy of your data: Account settings → Download my data (website and app).
- Correct it: edit your profile any time, or ask us.
- Delete it: Account settings → Delete account (website and app).
- Ask us: to get, correct or delete data in a way those buttons don’t cover, use the Contact page. We log each request and aim to answer within 30 days. We may need to confirm it’s you first.
- Emails: optional emails (review requests, and for gyms new reviews and the payout summary) have an unsubscribe link and can be switched off in notification settings. Messages about your bookings, payments and account are always sent. Court Market doesn’t send marketing messages.
- Tracking: we honour the Global Privacy Control signal, and maps stay off until you turn them on (Cookie Policy).
For counsel to draft
- Rights under applicable privacy laws (access, correction, deletion, portability, opt-outs, appeal) and the deadlines and identity checks that apply to requests
- The 30-day answer target
- Security measures statement
- How changes to this policy are communicated
Questions
Contact us through Contact & Support or at support@thecourtmarket.com.