Privacy Policy

TourneyHub is a padel tournament app run by Peak IT, based in South Australia, Australia. In this policy “TourneyHub”, “we” and “us” mean Peak IT. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Questions or requests about your information go to hello@tourneyhub.xyz.

• You sign in with your email and a six-digit code. There are no passwords.
• We collect what TourneyHub needs to run tournaments: your name, your email, the tournaments, leagues and ladders you join, and your results.
• No advertising, no third-party analytics or tracking tools, and we never sell your information. We measure how TourneyHub is used ourselves, to make it work better at the courts (see How you use TourneyHub).
• Your profile and rating are public unless you hide them on You. Your email is never shown to other players.
• Card payments are handled by Stripe. Card details never reach TourneyHub.
• You can delete your account yourself on You. Your results stay as “Deleted player”, and payment records are kept without your name for 7 years.

Your account

• Your email address, to send you sign-in codes, news about your own tournaments (receipts, schedules, results, organisers' messages) and to recognise you on any device you sign in on. You can change it on You.
• Your name, as you type it, so other players know who they're playing. You can change it on You.
• An avatar colour, picked from your name, and a random profile address (like /p/3f9c…) for your public profile.
• A photo and a location, if you add them on You. Your phone or computer crops and shrinks the photo before it is sent; TourneyHub then makes two small copies of it on its own servers and keeps nothing else from the file: no place it was taken, no camera or phone details. The photo shows beside your name wherever your name shows (tournament pages, standings, rankings, your profile), even when your profile is hidden. The location is whatever you type (a suburb or city); TourneyHub doesn't check it, and it shows on your profile while it is visible. Remove either on You at any time; both are deleted with your account. To stop people adding too many pictures, we note when each one was added and delete that note after 1 day.
• Other ratings, if you add them: a Playtomic level you type in, and links to your Playtomic and Padel Australia profiles. TourneyHub doesn't check them, never fetches anything from those sites and never uses them for your TourneyHub rating. Clear the fields on You to remove them.
• Category details, if you give them: which categories you play in (men's or women's, a sport category, not a question about who you are) and your year of birth (never a full date of birth). A tournament with categories such as Men's B, Mixed or 45+ uses them to show which ones are open to you and to check its rules when you enter. Both are optional; TourneyHub doesn't check them, and organisers may ask at the desk. They are remembered on You if you tick “Remember for next time”, or kept for that one tournament if you don't. Each tournament you enter keeps its own copy of what it checked, with the rating and Playtomic level you entered with.
• Sign-in codes, stored scrambled (hashed). Each works once, for 10 minutes.

Signed-in devices

Each device you sign in on gets a session. For each one we keep when it started and was last used, its IP address and its browser's user agent (which says, for example, “iPhone, Safari”). We use this to keep you signed in, to show you your devices on You so you can sign them out, and to protect your account.

Passkeys

If you add a passkey (Face ID, a fingerprint or a security key), we store its public key, an identifier for it, a name for it and the kind of device it's on. Your fingerprint or face never leaves your device and we never see it.

Notifications

If you turn on notifications on a device, we store the address your browser gives us for delivering them, the keys that encrypt them for your browser, and its user agent. They belong to that signed-in device: signing it out removes them. We also keep a record of what we notified or emailed you about and what it said, so you never get the same news twice and can find it again under Updates, and of the tournaments and ladders you muted.

On You you choose which kinds of email you get and your quiet hours; we store those choices and your time zone with your account. Every email you can turn off has a link that turns it off, without signing in. Emails about your sign-in, entries, payments, refunds, cancellations and invitations with a deadline always come. When an organiser sends a message, we keep it with the tournament, with their name.

Playing and organising

The tournaments, leagues and ladders you create or join, your registrations, teams and roles, the scores you enter or confirm (and any reason given for a disputed score or a walkover), your TourneyHub rating and how each rated match changed it, and the matches you agree to play on a ladder. This is what TourneyHub is for: making schedules, keeping standings and showing you when and where to play.

Names that organisers add

Organisers can add players by name, one at a time or from a pasted list or spreadsheet. We keep only the names: any other columns in a list, such as emails or phone numbers, are ignored, and TourneyHub never contacts people added this way. If an organiser allows it, a player can also join with just their name. A player added or joined by name can later claim their place with a claim link and their email, which links those results to their account.

Clubs

When you create or edit a club, we store the details you give for its public page: its name, address, courts, and its contact email, phone and website if you add them. We also record who its owners and staff are and every change made to it. To verify a club, TourneyHub admins see its owners' names and sign-in emails so they can contact them. If you report a club, we keep your report and who made it; only TourneyHub admins see it.

“Clubs near me”

Only when you tap “Clubs near me”, your browser asks whether to share your location. If you agree, your device rounds it to about a kilometre and sends that to our server in the page address, only to sort clubs by distance. We don't save it to your account or our database, and we don't send it to our maps provider. Like any page address, it can appear in your browser history and briefly in our web server's logs.

Entry fees and payments

• When you pay an entry fee or a league's season fee online, you enter your card details on Stripe's secure page. They go straight to Stripe and never reach TourneyHub. We give Stripe your email for the receipt.
• We keep payment records, for tournament entries and league seasons alike: the amount, currency and how it was paid (cash, bank transfer, card or credit), who recorded it, Stripe's reference numbers, and any refund with its reason. A league's page shows only the total its fees collected, never who paid. These records are never changed afterwards (only a credit note can be removed), so the money always adds up.
• Organisers and clubs who take payments online connect their own Stripe account and give their details to Stripe directly. We store only the Stripe account's reference and whether it's ready to take payments.
• Credit that an organiser gives you is kept as a history of what was given, spent, given back or taken back, with the organiser's note.

Pictures and reports

Organisers can add a cover photo and a logo to their tournament, and a club's owners to their club. They are made smaller and stripped of everything else in the file in the same way as a profile photo, kept on TourneyHub's own servers, shown to anyone who can open the page, and deleted when they are replaced, removed or the tournament or club is deleted. Anyone signed in can report a picture they think shouldn't be shown. We keep the report, any note with it and who sent it so a TourneyHub admin can look at it; the picture's owner never sees who reported it. If an admin takes a picture down, its owner sees the reason.

A tournament's partners

An organiser can show the partners who sponsor their tournament on its page, always labelled as sponsored (TourneyHub never adds sponsors of its own). So the organiser can tell their sponsors how many people saw them, we count, per sponsor and day, when the tournament page's “Tournament partners” was on screen, when a sponsor's sheet was opened, when an offer code was shown and when a link to the sponsor was followed. Each count keeps the time, whether the viewer had entered the tournament, and an anonymous code made from the tournament, the day and your account if you're signed in (otherwise your device's address and its browser's name), scrambled with a secret key so it can't be traced back and only lets us count each viewer once a day. We never store your account, address or name with them, sponsors and organisers only ever see totals, and nothing about it goes on your profile or rating. The tournament's own organisers and robots aren't counted. A partner's logo is a file the organiser uploads, kept on TourneyHub's own servers until it's replaced or the partner is removed, so seeing it tells the sponsor nothing about you.

Activity history

Each tournament, league, ladder and club keeps a log of what changed and who changed it (for example “Priya marked Sam paid”), so organisers can see what happened and sort out disagreements. We also keep a log of changes to your account, such as claiming a place, hiding your profile or changing your email (with the old and new addresses, so we can help if a change wasn't you). Both are kept for 2 years (see below).

How you use TourneyHub

So we can see where TourneyHub gets in the way (a page that loads slowly on a court's mobile signal, a button nobody finds, a score that couldn't be saved), TourneyHub records how it is used, in its own database. No outside company receives it. We record:

• which pages are shown, as the kind of page (“a tournament's schedule”) and the tournament it's about, never the full web address or anything you type
• how fast pages load and respond, and when your connection drops and comes back
• a few steps that matter: starting a match, opening and sending a score, confirming one, and when something you tried was refused (the kind of refusal, such as “not allowed”, never the message, which can name other people) or a page broke (the error's first words, with anything like an email address, a link or a code taken out)
• your kind of device (iPhone, Android or a computer), whether you opened TourneyHub from your Home Screen, and whether notifications are allowed
• when you signed in and how (code or passkey), when a notification was shown and tapped, and when you opened a link in one of our emails (the link says which email, nothing about you)

When you're signed in, these are linked to your account, so we can see, for example, that a co-organiser had to sign in again at the courts. When you aren't, they carry only an anonymous code that changes every day. When we send you a sign-in code, we note that one was sent with a scrambled code made from your email address and the day, so the sign-in that uses it can say how many minutes it took; once you sign in, that note becomes part of your account's and the scrambled code is removed; for a code that isn't used, the scrambled code is removed after 2 days. TourneyHub's team uses all this to fix problems and improve the app; organisers don't see it, and nobody outside TourneyHub ever does. You can turn it off with “Help improve TourneyHub” on You (under Sharing & visibility), which also deletes what was already recorded. Nothing is recorded from a browser that sends Do Not Track: our server checks every request for it, including those from our notification helper (the service worker). It is kept for 90 days, then only daily totals that say nothing about anyone are kept, and what is linked to you, or to sign-in codes sent to your address, is deleted with your account.

Our website (tourneyhub.xyz) counts its own page views and taps the same way, always anonymously: the page, the kind of site you came from (such as “google”, never the address), where a tap went (as the kind of page), your kind of device and the same anonymous code that changes every day. No cookie is set, and nothing is recorded from a browser that sends Do Not Track.

After a tournament, its results page and results email ask how the day was, which opens a short questionnaire. Answering is optional; see Cookies and storage on your device for how your answers are kept.

Our web server also keeps a log of requests (the page's shape, how long it took, your browser's name and your network's address with its last part removed) for 14 days, to find slow or failing pages.

So that every TourneyHub server hears about a change at once, each change (which tournament, what kind of change, and the record numbers of what changed, which can include yours) is written to our database and deleted after 1 day.

Protecting TourneyHub from abuse

To stop floods of sign-in attempts, we count requests to the sign-in service by IP address and store those counts in our database for 1 day. Our own limits (codes per email address and per account; asking for and trying sign-in codes, opening and using invitation links, joining with just a name and answering a questionnaire, per IP address; and usage per account or IP address) are counted in our database by a scrambled code, never the address or account itself, and each count is deleted once its limit's window has passed (at most 1 day; see How long we keep it). The marketing website's contact form counts messages per IP address briefly in its server's memory and doesn't store them.

Messages you send us

If you use the contact form on our website, we receive your name, your email, what it's about, the club you mention and your message, by email, so we can reply. TourneyHub doesn't save them in its database; they stay in our mailbox while we help you.

• Public tournaments, leagues and ladders are listed on Discover. Anyone can see their details, the players' names, the schedule, scores and standings.
• Private ones are never listed. Anyone who has their link, an invitation or the QR code can see them, so share the link only with the people you mean to.
• Your profile shows your name, avatar colour, photo and location if you added them, TourneyHub rating, any other ratings you added, record and the public tournaments you played. A private tournament only ever adds to a count there, never its name. You can hide your profile on You: then nobody else can open it, you leave every leaderboard, and tournament pages show your name without a rating.
• Club pages are public, with the details the club gave, and list only the club's public tournaments, leagues and ladders.
• Your email is never shown to other players or to organisers in TourneyHub. The exceptions: TourneyHub admins see club owners' emails to verify clubs and can look up your account to fix it (correct your name, link a spot an organiser added for you, or join two accounts you made), and when you pay online, the organiser or club receives your payment (including the email given for the receipt) in their own Stripe account.
• Payments. Organisers see who has paid in their own tournaments. Players see only their own payment status.
• Category details are never shown to other players and never on your profile. The organisers of a tournament you enter see whether you meet each category's rules and which categories you play in (so a Mixed pair can be checked as one of each), never your year of birth. They don't appear on the venue screen, printouts, downloads or TourneyHub's admin pages.
• At the venue. Organisers can show the schedule and scores on a screen, print court sheets and standings, and download results as a spreadsheet. These show players' names and results, never emails or payments.
• A match on hold. When an organiser holds a match they can give a short reason (such as “Ana unwell”). The tournament's players see it while the match is on hold, and it is cleared once the match is released or the tournament is over.

We use a few service providers to run TourneyHub. They handle your information only to provide their service to us. We never sell your information, and we don't share it with advertisers.

• BinaryLane (Australia) hosts TourneyHub's servers and database.
• Resend (a US company, sending from its Tokyo, Japan region) delivers our emails: your sign-in codes, a notice when your email is changed, notices to club owners about their club, and messages sent with the website's contact form. It receives your email address and the message.
• Stripe processes online payments and the organisers' and clubs' payment accounts. Stripe may process information in Australia, the United States and other countries.
• Geoapify (Germany) places club addresses on a map and draws the club page's map. It receives a club's address and its map position, and nothing about you or other visitors. “Directions” on a club page opens your own maps app, only when you tap it.
• Your browser's push service (run by Google, Apple, Mozilla or Microsoft, depending on your browser) delivers notifications if you turn them on. Notifications are encrypted so that only your browser can read them.
• Better Stack checks that TourneyHub is up by visiting a public page. It sees no personal information.

This means some of your information is sent overseas, including to the United States, Japan and Germany, and wherever Stripe and the push services operate. We choose providers that protect information to a standard similar to Australian law.

Beyond that, we share information only as this policy describes (for example, with the organisers of tournaments, leagues and ladders you join), when you ask us to, or when the law requires it.

TourneyHub uses only what it needs to work:

• A sign-in cookie that keeps this device signed in. It lasts until you sign out, or six months after you last used TourneyHub.
• A short-lived cookie while you use a passkey, to check the sign-in really came from your device.
• A “joined by name” cookie, only if you join a tournament with just your name, so this device can claim that place later. It lasts 30 days.
• Your light or dark theme, and whether you said “Not now” to notifications, are kept in your browser's storage and never sent to us.
• Your answers to a questionnaire after a tournament, if you fill one in (a few questions about how the day went, and anything you choose to write). Only the TourneyHub team reads them, to make the app better. If you played in or organised the tournament and you're signed in, they are linked to your account; otherwise your browser keeps a random code so answering again changes your answers instead of adding new ones, and that code is all we keep about you. So one connection can't flood a questionnaire, how many answers it sent is counted in our database by a scrambled code (never the address) for a day, then deleted. They are deleted with your account, or 2 years after you last changed them.
• A mark that this tab's visit has started, so a visit is counted once (see How you use TourneyHub). It is gone when you close the tab.

TourneyHub has no analytics, advertising or tracking cookies, and loads no third-party tracking scripts. What it records about how it's used goes only to its own server.

TourneyHub clears out what it no longer needs once a day, automatically. These are the periods:

• Your account and what's linked to it are kept until you delete your account (see below).
• Sign-in codes work for 10 minutes and only once, and are deleted once they expire.
• A signed-in device is kept until you sign it out, or until it hasn't been used for six months, when it is deleted.
• Sign-in request counts by IP address are not linked to your account, and are deleted 1 day after the last request they count.
• Our own limits' counts, which stop floods: how many codes each email address has been sent (to sign in or to change an email); how many codes each account has asked for (to delete it or change its email); how many sign-in codes each IP address has asked for and tried in the last minute; how often each IP address has opened or used a claim, co-organiser, club staff or partner invitation link; how many people have joined with just a name from each IP address; how many questionnaire answers without an account each IP address has sent for a tournament; and how much usage each account (or, when you're not signed in, each IP address) has sent. Each is kept only as a scrambled code, never the email address, IP address or account itself, and is deleted once its limit's window has passed, at most 1 day later. Counts for your account and your email address also go at once when you delete your account; counts per IP address can't be tied to you and simply expire.
• Notification subscriptions are kept until you turn notifications off or sign that device out, until your browser's push service tells us the subscription has ended, or once every delivery to it has failed for 30 days.
• The record of what we notified you about is kept for 180 days, and cleared after that once the tournament or ladder challenge it was about is over. Buttons you used on a notification are remembered for 7 days, so each works only once.
• Activity logs (of tournaments once they're over, and of leagues, ladders and clubs) and the log of changes to your account are kept for 2 years.
• Tournaments, results and ratings are kept so standings, ratings and history stay correct for everyone who played. An organiser can delete a tournament, league or ladder only while nothing in it has been played, rated or paid, and that deletes everything in it. After that it can only be archived: hidden from lists, but kept.
• Payment and credit records are kept for 7 years, as Australian law asks of financial records, and then deleted. Credit that hasn't been used up stays until it is, because it never expires; after 7 years its notes are removed.
• Category details you remember on You are kept until you clear them there or delete your account. A tournament's copy (and the rating and Playtomic level your entries were checked with) is cleared 90 days after the tournament ends: its last day has passed and no category is still open, ready or being played.
• Partner invitations at a tournament (who asked whom to play a category) and places offered from a waitlist are deleted 90 days after they were answered, ran out of time or were called off. If you delete your account, invitations sent to you stop and no longer say who they were for.
• How you use TourneyHub (pages, speed, a few taps, sign-ins, notification taps) is kept for 90 days, then folded into daily totals that say nothing about anyone. The web server's request log is kept for 14 days.
• Counts for a tournament's sponsors: the anonymous code is removed when the tournament ends, once each day's totals are written, and the counts themselves are deleted 30 days after the tournament ends. The daily totals stay with the tournament; they say nothing about anyone.
• Answers to a questionnaire after a tournament: deleted 2 years after they were last changed, or with your account.
• Backups of the database are made every night and kept for up to 90 days, only so we can recover from a failure. Anything deleted, including a deleted account, stays in the backups made before it was deleted until those backups are deleted in turn. If we ever restore a backup, every account deleted since it was made is deleted again before TourneyHub is back in use. The exceptions: if we lost a server outright, or had to bring back a whole server from our hosting provider's copy of it, deletions from its last day could be lost with it; we would make them again as soon as we learnt of them.
• A list of deleted accounts, kept apart from the database so a restored backup can't bring one back: only each account's internal number and the day it was deleted, never a name or email. Each entry is deleted 97 days after the account was, once no backup could still hold it; copies of the list inside our backups go when those backups do, within a further 90 days.

You can do these yourself on You:

• change your name
• change your sign-in email: we send a code to the new address to check it's yours, and a short notice to the old one
• hide or share your profile and rating
• see, change or clear your category details
• see your signed-in devices and sign them out, and remove passkeys
• turn notifications on or off for a device, and mute a tournament or ladder
• delete your account

You can also withdraw from a tournament, and club staff can leave a club. To see or correct any other personal information we hold about you, email hello@tourneyhub.xyz from the address you sign in with. We'll reply within 30 days.

To stop the app recording how you use it, turn off “Help improve TourneyHub” on You (it also deletes what was recorded), or turn on Do Not Track in your browser.

Deleting your account

“Delete your account” is at the end of You. You confirm it with a six-digit code we email you. If you still run a tournament, league or ladder that isn't over, are the only owner of a club, or still have a place in something that isn't over, the page lists each one and how to sort it out first (for example, hand it to a co-organiser or cancel it).

When you delete your account:

• your email, sign-in, passkeys, signed-in devices, notification subscriptions and settings, and your profile (with any photo, location, other ratings and category details you added) are deleted, every tournament's copy of your category details is cleared, and every device is signed out
• your places as a co-organiser and on a club's staff are removed, and your name is taken out of activity logs
• what was recorded about how you used TourneyHub is deleted
• results in tournaments you played stay, shown as “Deleted player”, so other players' standings and ratings stay correct; they are no longer linked to anything that identifies you
• records of entry fees, refunds and credit are kept without your name or email for 7 years, then deleted
• tournaments, leagues and ladders you ran that are already over stay, shown as run by “Deleted player”
• a copy of what was deleted stays in our database backups for up to 90 days, used only to recover from a failure, then those backups are deleted; if we ever restore one of them, your account is deleted again before TourneyHub is back in use

Names an organiser typed in for someone who never claimed the place aren't part of your account, so they stay as typed; ask the organiser, or us, to change them. We send a short email to confirm the deletion. Signing in with the same email later starts a new, empty account. If you connected a Stripe account to take payments, it stays yours at Stripe.

TourneyHub accounts are for people aged 16 and over. Younger players can still play: an organiser can add them by name, without an account or email.

Organisers who add players under 18 should have a parent's or guardian's agreement, use only as much of the name as they need (a first name and initial is often enough), and keep junior tournaments private. If we learn that someone under 16 has an account, we'll delete it. Parents and guardians can ask us to remove a child's name at hello@tourneyhub.xyz.

TourneyHub is served only over encrypted connections. There are no passwords to leak: sign-in codes are stored hashed and expire quickly, and you can sign out any device at once. Card details are handled by Stripe, never by TourneyHub. No system is perfectly secure, but if a data breach is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner, as the law requires.

If you have a question or a complaint about how we handle your information, email hello@tourneyhub.xyz. We'll reply within 30 days.

If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

If TourneyHub starts collecting or sharing something new, we'll update this policy and the date at the top. If a change matters to how your information is used, we'll let you know before it takes effect, for example by email. Our Terms of Use explain the rules for using TourneyHub.