1. Introduction
The Tennis Broker (“the Service”) is run by Francisco Gozalo, an individual in Glasgow, Scotland (“we”, “us”). This Privacy Policy explains how the Service handles personal data when you take part in sessions organised with it, use the app on iPhone or Apple Watch, sign up or ask to join through a join link, view a group’s Board through a shared link, write to us, or create an account.
In this policy, an “Organiser” is a person who uses the Service to run a playing group. A “Player” is anyone whose details an Organiser records, or who signs up to a session. A “Viewer” is anyone who opens a group’s Board through a link an Organiser or a Player shares.
2. Who is responsible for your data
Group data. Each Organiser decides whose details are recorded and how their group’s sessions are run. For that information, the Organiser is the controller, and we act as a processor on the Organiser’s behalf: we store, sync and show it only to provide the Service to them, and we don’t use it for anything of our own.
Account data and messages. If you create an account, we (Francisco Gozalo) are the controller for your account details and the choices you make in it. We’re also the controller for messages you send us.
How to get in touch about your data is set out in section 11.
3. Information we collect
We collect only what’s needed to run sessions. The Service never asks for your phone number, card details or location, and it asks for an email address only if you write to us. We hold no special category data, such as health information.
| Category | What it includes | Where it comes from |
|---|---|---|
| Identity | First and last name, or a display name, and your pronouns if they’re added | The Organiser (pronouns only as you’ve told them), or you when you sign up or claim your name |
| Participation | Session attendance, check-ins, sign-up status (confirmed or on the waiting list), court assignments, sit-outs | The Organiser and the Service |
| Results | Match scores and partners | The Organiser |
| Court costs | What each session cost, each Player’s share of it, how much has been paid towards it (or whether it was paid for the courts or set to no charge), any amount carried to a later session or given back, and when each share was last marked, with the first name of the Organiser who marked it | The Organiser |
| Derived data | Playing rating, rating history, statistics and head-to-head records | Worked out by the Service from results |
| Account data | Account identifier, the public part of your passkey, your name, your pronouns if you add them, the group records you’ve claimed, your privacy and display choices, whether you allowed court calls to share players’ names with ElevenLabs (and when), any group you’ve been asked to take on, and any name you’ve been asked to accept in another group, with your answer | You, if you create an account |
| Organiser data | For a secured group: which accounts organise it (owner or co-organiser), its shared link, who it has been offered to, and when it closes if it’s closing | The Organiser |
| Technical data | A push notification address if you turn notifications on, with the groups it’s for, what you chose to be told and, when you’re signed in, your account; and a random identifier the app sends when it checks for updates | Your device |
| Messages to us | Your email address, what your message is about, the message, and the app’s version if you wrote from the app. From the app, the form also shows what last went wrong in it, if anything did in the past 30 days (the problem’s message, when it happened, the app’s version and update, which part of the app it was in, and whether the app closed), and sends it with your message only if you leave it ticked | You, if you write to us |
Organisers may set where the group’s courts are, so the app can show the weather there. This is the courts’ location, never yours. When it changes, where the courts were before is kept with the group too, so each session keeps the weather it had. The app finds the place and its weather from Apple, on the Organiser’s iPhone (section 5).
Buying the app. The app is bought on the App Store. Apple handles the purchase under its own terms and privacy policy, and we receive no details of who bought it.
Screenshots used to import players’ names are read on the Organiser’s device. They’re never uploaded to us or stored.
Claiming your name. An Organiser can send you a claim link for their group’s record of you. When you open it and sign in with your passkey, that record is linked to your account, so you can see your ratings and matches and choose how you appear on shared links. You can unlink a name you’ve claimed at any time, and an Organiser can unlink it from their group’s record, for example if someone else claimed it. The record stays in the group, your account no longer has it, and the choices you made for it are deleted. Each Organiser sees only their own group’s records of you, and Organisers of different groups can’t see each other’s.
A name in another group. An Organiser who runs two groups can bring a Player from one into the other, by name. If you’ve claimed your name in the first, you’re asked, in the app and in Your Account, whether the new name is yours too. Nothing from your account reaches the other group unless you accept. If you decline, or don’t answer within 30 days, the Organiser is told and the name stays in that group without your account.
Court costs. If an Organiser turns on Court Costs, the app records what each session cost, each Player’s share and whether it’s been paid. No money passes through the Service or through us: Players pay the Organiser directly, in cash, by bank transfer or through the Organiser’s own payment link, and the Organiser marks it. Court costs are kept on our servers only for groups saved to an account, where only their Organisers can read them. They’re never shown on shared links, the Board online, pictures, reels, the PDF report or Apple Watch.
Live Courts. If an Organiser turns on Live Courts for a session, Players can see their court and send its score from their own phone, in the app or with the session’s score link. While the session runs, our servers hold only what that needs: the group’s name, each round’s courts and who’s sitting out, each Player’s first name (with a letter of the surname where two share a first name, or initials for anyone who chose them), a random code for each Player that’s new for every session, the round’s clock, the scores sent (each with when it was sent and a random code for the phone or browser that sent it), and the Organiser’s first name. Ratings, records and full names are never included. In the app, your court is found from the name you’ve claimed. Anyone with the score link can see the round’s courts and send a score, so the Organiser shares it with the session’s Players, and New Link stops an old one at once.
Kept on your device. The app keeps your group’s data on your device.
- A group kept in an Organiser’s account, or one that still syncs with a group code from before 29 October 2026, is also kept on our servers, so that it syncs between its Organisers’ devices.
- Court calls read in an iPhone voice are spoken by the iPhone itself, and nothing is sent anywhere.
- Court calls, and round alarms made in your own ElevenLabs voice, are kept on your device so they play at once.
- The alarms in The Tennis Broker voice and the reels’ music are part of the app and contain no personal data.
- If you connect your own ElevenLabs account, its API key is kept only on your device and is sent only to ElevenLabs.
- The round clock on the Lock Screen and in the Dynamic Island, and the app on Apple Watch, work between your devices and send nothing to us.
- A group’s logo chosen from Photos for its reels is cut out on the iPhone and kept there. It’s never uploaded to us.
- An Organiser’s payment link and note for players (which may include their own bank details), used in the messages they send about court costs, are kept only on their device and go only into the messages they send.
- When an Organiser who runs a group on their own deletes their account, the group stays on their iPhone, with a key that can bring it back. Our servers keep only a scrambled copy of the key that can’t be turned back into it.
Backups. The app backs up each group on your device by itself as it changes: on iPhone, also in your own iCloud while iCloud Backup (in the app’s Settings) and iCloud Drive are on, and on Android, with your phone’s own backup to your Google account. Those copies are kept by Apple or Google in your account, under their terms, and we can’t see them.
4. How we use information, and the lawful basis
UK data protection law, and for people in the European Union the EU General Data Protection Regulation, requires a lawful basis for each use of personal data. For group data, the Organiser relies on the bases below, and we process the data for them. For account data and messages to us, the bases are ours.
| Purpose | Lawful basis |
|---|---|
| Running sessions: sign-ups, waiting lists, check-ins, court assignments and timing | Legitimate interests, in organising the group’s play |
| Working out ratings and statistics, to make balanced and fair matches | Legitimate interests |
| Showing the group’s Board through shared links, subject to your own choices | Legitimate interests |
| Keeping track of what each Player has paid towards the group’s court costs, and the reminders an Organiser sends | Legitimate interests, in sharing the cost of the group’s courts fairly |
| Providing your account and its features | Performance of a contract (our Terms of Service) |
| Passing a group on, or closing and deleting it, when its owner deletes their account or closes it, or when it hasn’t been used for 180 days | Legitimate interests, in keeping groups running for their Players and not keeping data nobody uses |
| Sending notifications you’ve turned on, such as a request to join your group, a sign-up, a place for you from the waiting list, a group offered to you, a name to accept in another group, time’s up on your court, or every score being in | Consent, which you can withdraw at any time in your device’s settings or the app’s Settings > Notifications |
| Showing Players their court and taking the scores they send, with Live Courts | Legitimate interests, in running the group’s session |
| Showing a group’s Organisers what has happened in it (who asked to join, signed up or gave a place back, or accepted or declined a name), in the app’s notifications | Legitimate interests, in running the group’s sessions |
| Reading court calls, the winners and a reel’s voice-over aloud in the Organiser’s own ElevenLabs voice | Legitimate interests, in running the group’s session. Names are sent only after the Organiser allows it with Share Names with ElevenLabs: a tick box when they create their account, and a switch in Settings > Sounds, where they can turn it off at any time |
| Showing your pronouns beside your name in your groups | Consent: you add them yourself, and can change or remove them at any time. An Organiser adds them for a Player who hasn’t claimed their name only as that Player has told them |
| Answering messages you send us | Legitimate interests, in answering you |
| Keeping the Service secure and fixing problems | Legitimate interests |
| Meeting legal obligations | Legal obligation |
Ratings are worked out automatically from match results. They’re used only to balance matches and rank players on the group’s Board. No decision with legal or similarly significant effects is made about you by automated means.
We don’t use your data for advertising, and we don’t sell it.
5. Who we share information with
- Organisers of the groups you play in, who can see and manage that group’s data. Organisers of the same group can see each other’s names. Only Organisers see the group’s court costs, and reminders are sent by the Organiser from their own messages, one Player at a time.
- Viewers. A shared link opens the group’s Board, which shows names and places. Once you’ve claimed your name, you can show as initials or hide your rating on shared links in Your Account; otherwise, ask the Organiser. Pronouns are never shown on shared links. With Live Courts, anyone with a session’s score link sees that round’s courts, by first name, while the session runs. Players with an account see their groups through it, and anything you’ve chosen to hide is removed on our servers before it’s sent.
- Service providers that run parts of the Service for us, under contracts requiring them to protect your data:
- Netlify, Inc. hosts the website and the database, and takes messages sent with the contact form and emails them to us (keeping a copy until we delete it).
- Expo (650 Industries, Inc.) delivers updates to the app (receiving a random identifier for your installation and the app’s version), and passes the notifications you’ve turned on, which can name the players who signed up or asked to join, or a name you’re asked to accept, to Apple’s push service on iPhone, or Google’s on Android, which delivers them.
- Google keeps our email (Gmail), including messages you send us.
- Like any service on the internet, each of these providers sees the IP address your device connects from.
- Apple, for the weather and the venue search: the app asks Apple Weather for the weather at the courts’ location, and Apple Maps for the place an Organiser types to find the courts, straight from the iPhone. Neither request carries personal data, and Apple handles them under its own privacy policy. Before 2 November 2026, the weather and the place search came from Open-Meteo, which received only the courts’ location and the place name typed.
- ElevenLabs, only when an Organiser has connected their own ElevenLabs account. With their permission to share names with ElevenLabs, their device sends the words to read out (players’ names, the group’s name, courts, scores and the session’s weather) to ElevenLabs for court calls, announcing the winners and a reel’s voice-over, under the Organiser’s own agreement with ElevenLabs, to turn them into speech. Round alarms made in that voice send only the alarms’ fixed words. Nothing else is sent, and nothing passes through our servers. Court calls read through our servers before 31 October 2026 are kept only to replay the same call, and are deleted by 30 November 2026.
- Authorities, where the law requires us to disclose information.
We don’t share your data with anyone for their own marketing.
6. International transfers
Some of our service providers process data outside the United Kingdom and the European Economic Area, including in the United States.
Where they do, we rely on safeguards recognised by UK law, such as UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified) or the UK International Data Transfer Agreement.
For people in the European Union, we rely on safeguards recognised by EU law, such as the European Commission’s adequacy decisions (including the EU-US Data Privacy Framework, where the provider is certified) or its Standard Contractual Clauses.
You can ask us for details of the safeguard that applies.
7. How long we keep information
We keep personal data only for as long as it’s needed for the purposes in section 4.
| Information | How long it’s kept |
|---|---|
| Players’ records, results and ratings | Until the Organiser removes them, or the group is deleted |
| Court costs | With the group’s records, until the Organiser removes them or the group is deleted. Once a session is more than 12 months old, with nothing due or carried from it, it’s cut down to its totals when a later session ends |
| A group on our servers | While its Organisers use it. A group whose owner closes it, or leaves without anyone taking it on, is deleted 30 days later. A group none of its Organisers has opened for 180 days closes the same way, its owner told first. Until it’s deleted, it can be reopened |
| A group’s earlier copies (the last 10, so an Organiser can restore one) | Until newer ones replace them, or the group is deleted |
| Sign-up entries | Deleted 90 days after the session date |
| Live Courts: a session’s courts, names as shown and the scores sent | Deleted within three days after the session |
| Account data | Deleted when you delete your account |
| A group offered to you | Until you answer, or for 30 days; answers are deleted after 90 days |
| A name you’re asked to accept in another group | Until you answer, or for 30 days; answers are deleted 30 days later |
| The scrambled copy of a key to bring a group back | Until the group is deleted, or 30 days after it’s taken on or brought back |
| Pronouns | Until you remove them or delete your account. Pronouns an Organiser added stay with the group’s records until they’re removed |
| Push notification addresses, and what you chose to be told | Until you turn notifications off, or the address expires |
| A group’s notifications for its Organisers (who asked to join, signed up or gave a place back) | Deleted after 90 days |
| Messages you send us, and your email address | Deleted 12 months after our last reply |
| Court calls and alarm sounds on your device | The latest 40 calls, and the alarms made in your own voice, until you delete the app |
| Your ElevenLabs API key, if you connect one | On your device, until you disconnect it or delete the app |
| Each group’s backup, made by the app | On your device until you delete the app. In your iCloud, or your Google account’s backup, until you delete it there. Turning iCloud Backup off stops new backups and keeps those already made |
Our database provider keeps short-lived recovery copies of the database, which are overwritten as it runs.
If we close the online services (Terms of Service, section 13), we’ll say so in the app and on the website at least 30 days before, and then delete what our servers hold (accounts, synced groups, sign-ups and notification addresses) within 90 days of closing. What’s on your device stays there.
If you ask to be erased, or delete your account, your name is removed from each group’s records, including past results and the earlier copies our servers keep, where it’s replaced with “Former player” and a number. Your court costs are removed too, though each session keeps what you were charged and paid, without your name, so its totals stay right. When you delete your account, each Organiser’s app makes the change the next time it syncs. Match scores remain, without your name, so other players’ records stay accurate. Backup files an Organiser saved, and backups in their own iCloud or Google account, are theirs, and we can’t change them.
8. Security
All data is encrypted in transit. Each group made since 29 October 2026 is known to our servers by a long random identifier that the app never shows, and accounts are protected with passkeys rather than passwords. A group that still syncs with a group code from before then, and that no Organiser has secured by signing in, can be opened and changed by anyone who has its code. We collect as little as possible, and read screenshots on the device rather than on our servers.
No system is completely secure. A group kept in an Organiser’s account is secured: only its Organisers, signed in with their passkeys, can open or change it. Organisers can replace its shared link at any time. On the website, your sign-in is kept in your browser’s own storage until you sign out.
9. Your rights
Under UK data protection law, and the EU General Data Protection Regulation if you live in the European Union or the European Economic Area, you have the right to:
- Access the personal data held about you, and receive a copy
- Correct data that’s inaccurate or incomplete
- Erase your data, including from past results
- Restrict how your data is used, in some circumstances
- Object to uses based on legitimate interests
- Data portability, receiving data you provided in a structured, machine-readable format
- Withdraw consent at any time, where we rely on it
For a group’s data, ask its Organiser, who’s responsible for it and will act on it or pass it to us. For your account, you can change your choices on shared links, download your data and delete your account in the app (Settings > Your Account) or on your account page. If you run a group on your own, deleting your account first asks who should take it on, or closes it.
We respond within one month. We may need to confirm your identity first.
If you’re unhappy with how your data has been handled, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. If you live in the European Union or the European Economic Area, you can also complain to the data protection authority where you live. We’d appreciate the chance to put it right first.
10. Children
Accounts are only for people aged 13 or over, or the age of digital consent where you live if it’s higher (in the European Union, between 13 and 16, depending on the country). Organisers who record players under 18 are responsible for having the permission of a parent or guardian where needed, and should consider showing those players as initials on shared links.
11. Changes and contact
We may update this policy as the Service changes. When we make significant changes, we’ll tell you in the app and on the website before they take effect. The date at the top shows when it was last updated.
Questions or requests about your data can be made through the Organiser of your group, who’ll pass them on to us where needed, or sent to us with the contact form or by email at franciscogozalo@gmail.com.