What we keep, and why.

Matchcard is an app for USTA tennis teams. The captain sets up the team, players answer whether they can play, and everyone sees the lineup. This policy says in plain English what information Matchcard collects, why, who can see it, where it is kept, and what you can do about it.

1. Who we are

Matchcard is operated by Folly Agency LLC, a South Carolina limited liability company in the United States ("Matchcard", "we", "us"). We are the controller of the personal information described in this policy.

Postal address: 952 Godber St, Charleston, SC 29412
Email: support@matchcard.app

Matchcard is not affiliated with, endorsed by or sponsored by the United States Tennis Association (USTA) or TennisLink.

2. What this policy covers

This policy applies to the Matchcard app for iPhone and Android, to this website at matchcard.app, and to email you exchange with us at support@matchcard.app. It does not cover the Apple App Store, Google Play, Google, Apple or USTA TennisLink, each of which has its own privacy policy.

3. Information we collect

We collect what the app needs to run a team, plus anonymous usage statistics that help us improve it. There is no advertising and no tracking across other companies' apps or websites.

Account information

You create an account with an email address and a password, or by signing in with Google or Apple. Authentication is handled by Supabase Auth. For every account we store your email address and a display name. If you sign up with a password, Supabase stores it only as a salted hash; we never see the password itself.

Sign in with Google and Sign in with Apple

When you choose Google or Apple, the provider confirms who you are and sends us a signed token. From that token we receive and keep three things: your name, your email address, and a unique identifier for your account with that provider. If you use Apple's "Hide My Email" option, the email address we receive is a private relay address that Apple forwards to you, and we store that relay address instead of your real one.

We request no other permissions. We do not ask for, receive or store your Google or Apple contacts, calendar, photos, files or any other data, and we cannot act on your Google or Apple account. We never receive your Google or Apple password.

Team data

Once you are on a team, the app stores the following about you and your team:

• Membership and role. Which team you belong to, whether you are the captain or a player, and the join code of the team.
• Your roster name. The name on the USTA roster that you chose to play as.
• Availability answers. Your In, Maybe or Out answer for each match, any note you attach, and when you answered.
• Lineups. The cards the captain publishes: who plays which line in each match, who was marked unavailable, and when the card was set.
• The season document. The team's USTA team number and name, the roster with player names and NTRP ratings, the schedule, results and standings, and from the team's own match reports: home or away, start times, where each match is played and line-by-line results with the players on each line. The captain imports this from their own USTA TennisLink team page and their team's match reports, and it also holds the other teams' rosters in your flight with their NTRP ratings and home courts (see Data from USTA TennisLink).
• Opposing captain contact details. When the captain asks for them (or types them in), we store an opposing team's captain and co-captain names, phone numbers and emails in a separate record that only the captains of your team can read or change. It is never part of the season document the rest of the team reads.

Subscription information

If a captain subscribes, we store the team's plan status, which product it is, when it expires and a transaction reference. Payment is handled entirely by Apple or Google; we never see or store card numbers or billing addresses.

Bug reports and support email

If you send a bug report from this website or email us, we receive what you wrote, the email address you gave, and the device and app version you described. We keep that correspondence for as long as needed to answer you and fix the problem.

This website

The website is a static marketing site. It sets no cookies and runs no analytics. Our hosting provider keeps standard, short-lived server logs (IP address, requested page, browser type) for security and to keep the site running.

Notifications

If you turn on match alerts, your phone gives the app a push token, which we store with your account so we can send you team notifications: a lineup being published, a reminder to answer for an upcoming match, a captain being told a player changed their answer, and new results arriving. Your on/off choice for each kind is stored too. Push delivery goes through Google Firebase Cloud Messaging (and Apple's push service on iPhone), which receives the token and the notification text. You can turn alerts off in the app or in your phone's settings at any time; signing out removes the token.

Usage statistics

The app uses Google Analytics for Firebase to count how Matchcard is used: which screens are opened, and actions such as creating or joining a team, answering for a match, publishing a lineup or starting a subscription. These events carry an app-instance identifier, your device model and operating system, app version and approximate country, but never your name, email, team name, player names or notes. We do not link them to your account, do not use them for advertising, and do not collect advertising identifiers. You can switch usage statistics off in the app under Profile.

What we do not collect

• No location data.
• No contacts, calendar, photos or files from your phone, Google account or Apple account.
• No advertising identifiers, ad networks or cross-app tracking. Usage statistics are described under Usage statistics above.
• No location, contacts or other phone data is read to send notifications.

4. How we use information

We use the information above for these purposes and no others:

• To create your account, sign you in and keep your session secure.
• To show your team its roster, schedule, results, standings, availability and lineups.
• To let the captain publish lineups and let players answer availability.
• To confirm a captain's subscription so the team's paid features stay on.
• To answer support requests and fix bugs you report.
• To meet legal obligations and to protect the service from abuse.

We do not sell personal information. We do not use it for advertising, we do not build profiles, and we do not share it with anyone except the service providers listed below, who process it on our behalf.

5. Who can see your information

Matchcard is a team app, so your teammates see what a team needs to see. Specifically:

• Everyone on your team can see the roster, the schedule, results and standings, the published lineups, and each other's availability answers and notes.
• Only your team's captains can see an opposing captain's and co-captain's name, phone number and email, for arranging matches. Players do not see them at all.
• Nobody outside your team can see your team. Access is controlled by row-level security in the database: members can read their own team, the captain can write the season and lineups, and each player can change only their own availability.

Team data leaves the team only when a user chooses to share it. The "Share the card" button renders the lineup as a picture on your phone and opens the phone's share sheet; the picture goes wherever you send it. We do not keep a copy and we cannot recall it once it is sent.

6. Service providers

We use a small number of companies to run Matchcard. Each one processes data only to provide its service to us and is bound by its own terms and privacy policy.

We may also disclose information if the law requires it, to protect the rights or safety of our users, or as part of a sale or transfer of the business, in which case this policy will continue to apply to the data.

7. Data from USTA TennisLink

Matchcard reads three kinds of USTA TennisLink page, all on a captain's phone: the team's own Stats and Standings page (roster, NTRP ratings, schedule, results and standings); the team's own match reports (home or away, start times, venues and line-by-line results); and the team pages of the other teams in the team's flight (their rosters with NTRP ratings, their home courts and address, and their captain's and co-captain's names, phone numbers and emails). It reads them nightly, when a captain opens the app after a match, and when a captain taps Refresh.

All of it happens on a captain's phone, in the captain's own TennisLink session: the captain signs in to USTA themselves inside Matchcard the first time (and whenever TennisLink signs them out). The app then opens each page one at a time, a second or two apart: the team page, each other team's page from the standings on it, and the match report for each of the team's own matches, at most 30 pages per refresh. It never opens another team's scorecards. The automatic refresh runs only on the phones of the team's captains and co-captains, never on a player's phone, and what it reads is saved to the team so every member sees it, except as below. Changes to your own roster wait for the captain to check them before they are saved. If TennisLink has signed the captain out, the automatic refresh stops and the app asks the captain to sign in again.

Opposing captains' contacts (names, phone numbers and emails) are saved only where your team's captains can see them; players never see them, and they are never part of the team data every member reads. A contact a captain types in is kept over the one from TennisLink. Other teams' rosters and NTRP ratings are visible to everyone on your team, as they are to any signed-in TennisLink user.

That is all Matchcard reads from TennisLink. Our servers never fetch anything from TennisLink; everything is read on a captain's phone and only the result is saved to your team.

Matchcard never sees or stores your USTA username or password; you type them into USTA's own sign-in page. The sign-in is kept by that in-app browser on your phone so later refreshes (including the automatic ones) can skip it, and "Sign in again" clears it. Matchcard never changes anything in TennisLink. Other teams appear in the app as they do on TennisLink: their name and record from the standings, their roster with NTRP ratings and home courts from their team page, and, in your team's match results, the names of the players they put on each line against you, as printed on your own match reports. If you believe your information appears in a team you are not part of, contact us and we will look into it.

Venues. To show where a match is played, Matchcard uses the venue on TennisLink first. When TennisLink gives only a club name or code, the app looks the venue up by that name with the phone's own map search (Apple Maps on iPhone, the phone's geocoder on Android), centred on your team's home courts. Only the venue name is searched; your location is never read or sent. Matchcard also keeps a shared venue directory of public club names and addresses (and their map coordinates), which every team in the app reads and adds to, so the next team in the area sees the address at once. It holds facility names and addresses only, never anything about a player, a team or who looked a venue up.

8. Where data is stored and how it is protected

Account and team data is stored in a Supabase Postgres database on servers in the United States. If you use Matchcard from outside the United States, your data will be transferred to and processed there.

Data is encrypted in transit (TLS) and at rest. Access from the app is enforced by row-level security policies so that each account can only read and write what its role allows. Service keys that can bypass those policies are held only on our servers, never in the app. No system is perfectly secure, but we work to keep yours safe and will tell you if a breach affects your data.

9. Retention and deletion

We keep your information for as long as you have an account, and no longer than we need it after that.

Deleting your account

You can delete your account from inside the app: open Profile and choose Delete account. You can also email support@matchcard.app from the address on your account and ask us to delete it; we will delete the account within 30 days and confirm by reply.

Deleting your account removes your profile, your team memberships, your availability answers and your sign-in. If you are the only captain of a team, deleting your account also removes that team. Deleting the app from your phone does not delete your account.

Deleting a team

When a captain deletes a team, the team's season document, lineups, availability answers and memberships are removed. Players' accounts remain so they can join another team.

Backups and residual data

Deleted data may remain in encrypted database backups for up to 30 days before those backups are purged. Support email is kept for as long as needed to resolve the request. We may keep subscription transaction records for as long as tax and accounting law requires.

10. Your rights

Wherever you live, you can ask us to:

• Access the personal information we hold about you.
• Correct information that is wrong. You can change your display name and roster name in the app yourself; for anything else, email us.
• Delete your account and the information tied to it, as described in section 9.
• Export your information. We will send you a copy of your account, membership and availability data in a machine-readable format.

To use any of these rights, email support@matchcard.app from the address on your account. We will answer within 30 days. We will never charge for a request and never treat you differently for making one. If you are not satisfied with our answer, you may complain to the data protection authority where you live.

11. California and GDPR notice

California residents. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of. The categories of personal information we collect are identifiers (name, email address, account identifier), subscription and transaction information, and the team activity described in section 3. You have the rights to know, delete, correct and port that information, described in section 10, and the right not to be discriminated against for using them.

United Kingdom and European Economic Area residents. Our lawful basis for processing your information is the performance of our contract with you, meaning running the team service you signed up for, and, for Sign in with Google and Sign in with Apple, your consent, which you give when you choose that sign-in method and can withdraw by deleting your account. Your data is processed in the United States under standard contractual clauses or an equivalent safeguard offered by our providers. You have the rights of access, rectification, erasure, restriction, portability and objection described in section 10.

12. Children

Matchcard is built for USTA adult leagues and is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has created an account, email support@matchcard.app and we will delete it.

13. Changes to this policy

If we change this policy in a way that matters, we will tell you in the app or by email before the change takes effect, and we will update the effective date at the top of this page. Continuing to use Matchcard after that date means the new policy applies.

14. Contact

Questions, requests and complaints about privacy go to support@matchcard.app. You can also write to Folly Agency LLC, 952 Godber St, Charleston, SC 29412. For general help, see the Support page.