Privacy Policy

1. Data we collect

• Account data: username, email address (required when creating a new account; some accounts created before email verification existed may not have one on file), display name, hashed password (never stored or logged in plain text)
• League and match data: league memberships, submitted match results, scores, ratings, and rating history
• Event and RSVP data: Social Events created within a league (name, description, date/time, and location) and your RSVP responses to them
• Operational logs: login timestamps, and administrative audit records (who changed what, and when) for accountability and troubleshooting
• Password-reset metadata: a one-way hash of reset tokens and a keyed hash of the requesting IP address (never the raw IP or token)

We do not collect payment information, government ID numbers, or precise location data. We do not run advertising or analytics trackers.

2. Cookies

PaddleRank uses exactly one cookie: a signed session cookie that keeps you logged in. It is strictly necessary for the service to function and is not used for advertising, analytics, or tracking across other sites. Because it is strictly necessary, we do not show a cookie-consent banner.

3. Why we collect it

Account and league data exist to run the service: authenticating you, computing ratings, and showing leaderboards, history, and Social Events to the leagues you belong to. Audit logs exist so administrative actions (suspending an account, approving a league, etc.) are traceable and accountable. Your account email may also be used for League-initiated communications, such as an announcement a League Manager sends about a Social Event in a league you belong to -- never for marketing, advertising, or any purpose outside leagues you're actually a member of.

4. Who can see your data

Match results and ratings are visible to members of the same league. League managers and platform administrators can see membership and match data for leagues they manage or administer, including Social Event attendance (who has RSVP'd, and how) for events in that league. An ordinary league member can see their own RSVP response to an event, not other members' responses. Your password is never visible to anyone, including administrators.

5. Retention

Match and rating history is kept for as long as your account or league exists, since it is the historical record the service is built around. Password-reset tokens are deleted after a short retention window once used, revoked, or expired. If your account is archived, this history is preserved (not deleted) and is restorable by an administrator.

6. Requesting deletion or a copy of your data

To request deletion of your account or a copy of the data associated with it, contact support@paddlerank.app. Because match history is shared with other league members (it records the outcome of games you played against them), deletion may take the form of archiving your account and anonymizing personally identifying fields rather than removing shared match records outright. We will explain what is and isn't possible when you ask.

7. Changes to this policy

This policy may be updated as the service evolves. Material changes will update the effective date above.

8. Contact

Privacy questions can be sent to support@paddlerank.app.