Legal

Privacy Policy

Last updated 2 November 2026Version 2026-11-02

This policy explains what personal data PickleBoard, a trading name of iCTO U.K. Ltd (“we”, “us”), the operator of this PickleBoard tournament service, collects about you, why we collect it, how we protect it, and the rights you have over it. We are the data controller for that information.

Who we are

  • Controller: PickleBoard, a trading name of iCTO U.K. Ltd
  • Contact for privacy questions: privacy@pickleboard.app
  • Governing jurisdiction: England & Wales

What we collect

  • Account details you give us when you register: your first and last name, email address (which is your login), and a password (stored only as a salted hash — we never store it in readable form).
  • Month and year of birth, and country: we ask everyone for these when they create an account (and once, for accounts made before we asked). We only keep the month and year, never a full date. We use them to check you are old enough for an account and for PickleBoard Community where you live, and to give younger players safer settings. They are never shown to anyone else.
  • Optional details you choose to add: your DUPR ID, a display name, a profile photo and a short biography.
  • Match data generated when you play in a tournament run on this service: the teams, scores, results, timings and standings. This is competition data and is shown publicly as part of running and broadcasting the event.
  • Support requests: if you use Get help, we keep what you wrote, the topic you chose and our replies, so our support team can help you. Our support records about problems on the service hold only account and organisation identifiers, error codes and states — never your name, email address or anything you typed. Our support agent (below) never sees what you wrote about a problem. If you ask a "How do I…?" question, the agent reads the question (with email addresses, phone and card numbers, links and postcodes removed first) so it can answer it from our help articles.
  • Technical data needed to operate the service securely: your sign-in cookie (see our Cookie Policy), and limited server logs (including your IP address and the actions you take) kept for security, dispute resolution and audit.

Why we use it, and our lawful basis

  • To create and secure your account and sign you in — performance of a contract with you.
  • To personalise your view (showing your own matches, standings and history) — your consent, and our legitimate interest in a useful player experience.
  • To run, display and broadcast the tournament, including public scoreboards, brackets, leaderboards and commentary — legitimate interest in operating the event you are taking part in.
  • To send you account emails (confirm your address, reset your password) — performance of a contract and consent.
  • To check your age against our minimum ages and the rules where you live — legal obligation and our legitimate interest in keeping young people safe.
  • To keep the service secure and resolve scoring disputes — legitimate interest and, where applicable, legal obligation.

Public information vs. private information

We deliberately separate the two:

  • Public — your display name, biography and your match results and statistics. These may be shown on player pages, overlays and broadcasts. Don’t put anything in your display name or bio that you don’t want shown publicly.
  • Your profile photo is shown to you, to people in the organisations and clubs you belong to, and to platform administrators. If your profile is public and you are 18 or over, it is also shown to anyone signed in to PickleBoard and on broadcast overlays. An under-18 member’s photo is never shown beyond their organisations.
  • Private — your email address, your DUPR ID and your legal first/last name. These are visible only to you and to tournament organisers whose role grants access, and every time an organiser views your protected details it is recorded in our audit log.

Health data on your devices

If you score casual (ad-hoc) matches on a smartwatch, you can save them as workouts:

  • On an Apple Watch, the match runs as a Pickleball workout and is saved to Apple Health.
  • On Android, if you turn on Profile ▸ Health Connect, each confirmed match is saved to Health Connect as a workout. When you score on the PickleBoard Wear OS app, the workout includes your heart rate and calories from your watch, which asks for permission to use its sensors.
  • This health data stays on your devices. It is passed between your watch and your phone and written to Apple Health or Health Connect. It is never sent to PickleBoard’s servers, shared, or used for advertising.
  • PickleBoard only writes these workouts. It does not read your health data.
  • You can switch this off at any time, and review or delete what was saved in Apple Health or Health Connect.

Who we share it with

  • We do not sell your personal data.
  • Public match data is, by design, visible to anyone viewing the tournament.
  • We use service providers only to operate the service: our hosting provider (Render), an email provider to send account and club emails (SendGrid), Stripe to process subscription and club payments, and Apple and Google to deliver push notifications you turn on. They process data on our instructions.
  • Files uploaded to PickleBoard (organisation logos and covers, sponsor and theme logos, pictures in published articles, profile photos and sting audio) are stored on Cloudflare R2 under its EU jurisdiction once we move them there; until then they stay on our own server. Public files such as logos are served from media.pickleboard.app. Profile photos and audio stay private: they are shown only through links that expire after a few minutes, to people allowed to see them, and an under-18 member's photo is never public. Cloudflare processes them on our instructions.
  • Our status page is also published as a copy on GitHub Pages (status.pickleboard.app), so it still opens when PickleBoard doesn't. It holds no personal data: only how each part of the service is doing and the updates our team posts. As with any website, GitHub receives your browser's address when you open it. If you turn on "Service status updates", we send those updates to your devices like our other notifications; you can turn it off at any time.
  • When our support agent is switched on, Anthropic (the company behind the Claude AI model) receives an outline of a support case so it can suggest the fix: error codes, states, counts, times and the relevant help text, with every identifier replaced by a stand-in such as "account-1". It never receives your name, contact details, real identifiers, our staff's notes or replies, or anything you wrote about a problem. For a "How do I…?" question only, it also receives the question with email addresses, phone and card numbers, links and postcodes removed, so it can answer it; please don't put other personal details in a question. Those answers are sent to you straight away, marked as coming from the PickleBoard assistant, and you can ask for a person instead. A person on our support team approves anything beyond a routine, documented fix, and reads any other reply before it is sent to you. Anthropic processes this on our instructions.
  • When our service desk link is switched on, support requests that need a person are also copied to Freshservice, our service desk (run by Freshworks, in its EU data centre), so our team can answer them there. The copy holds the case's codes and a link back to it, what you wrote and later added with email addresses, phone and card numbers, links, postcodes and identifiers removed, and our team's replies and notes with the same details removed. It never holds your name, contact details or account. A reply our team writes there reaches you in the PickleBoard app, never by email from Freshservice. If you delete your account, we clear what we copied there and delete the ticket. Freshworks processes this on our instructions.
  • If you choose to load an embedded YouTube stream or Google Map, Google receives information from your browser under its own privacy policy. We only load these with your permission (see our Cookie Policy).
  • Organisations (tournament organisers and clubs) decide how they use the data they manage on PickleBoard. For that data they are the controller and we act as their processor, under the Data Processing Terms.
  • If you add your DUPR ID, results may be submitted to DUPR for rating purposes where the tournament does so.

How long we keep it

  • Your account and profile: until you delete your account (see below) or the operator closes the service.
  • Match results: retained as part of the permanent competition record. If you delete your account, your results remain under the name recorded at the time, but are no longer linked to an identifiable account.
  • Security and audit logs: 6 months.
  • Support requests and support records: 6 months after the request or problem is closed (a request with no activity for 90 days is closed). If you delete your account, what you wrote and our replies are deleted straight away; only the outline (the topic, identifiers and the outcome) stays until then.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our use of your personal data, and to data portability. In particular:

  • Access & correction — view and edit your details any time on your My Profile page.
  • Erasure — delete your account from My Profile or in the app, or ask an organiser or us to do it for you. This removes your login and personal details; your match results stay in the competition record but are de-identified. How to delete your account explains exactly what is removed and what is kept.
  • Withdraw consent — you can turn off personalisation or delete your account at any time.
  • Complain — you may contact us at privacy@pickleboard.app, and you may lodge a complaint with your data-protection authority (the UK ICO).

Cookies

We use one cookie to keep you signed in, and browser storage to remember settings you choose. We don't use advertising or analytics cookies. Embedded YouTube streams and Google Maps load only if you allow them. Our Cookie Policy lists everything we store and lets you change your choices.

Security

Passwords are stored only as salted hashes. Access to private personal data is restricted by role and is audit-logged. We use transport encryption (HTTPS) in transit. No system is perfectly secure, but we take reasonable measures to protect your information.

Children

You must be 13 or over to create a PickleBoard account, and 18 or over to set up an organisation. We ask for your month and year of birth when you sign up, and an account that belongs to someone under 13 can't be used — it can only be deleted.

Children under 13 can still take part in clubs and tournaments: a parent, coach or club can add them as a player without them having an account. Their name and results appear in the draw and on scoreboards like any other player's, and an appropriate adult manages their participation and consent.

PickleBoard Community (the feed, messages, groups and Find & Play) has a minimum age set by where you live: 13 in most countries, and 16 in Australia. Below that age, Community is switched off for your account; tournaments, clubs and coaching still work as normal. Players under 18 have a followers-only profile by default.

Community is part of PickleBoard: you use it with your PickleBoard account, and your Community profile is your PickleBoard profile (your name, photo and bio are shown from it, so a change shows everywhere at once). What you post in Community (posts, comments, messages, groups, games, venue reviews) is kept in PickleBoard’s own database in Frankfurt, with the rest of your account. Photos you share in Community are shown only to people signed in to PickleBoard who may use Community. Community notifications appear in your Notification Centre. If you use Find & Play, we keep only an approximate location (about a kilometre), never your exact position. Deleting your account removes your Community profile, follows and memberships; your posts stay as “Deleted member” unless you ask us to remove them.

If you think we hold an account for a child under 13, or a date of birth is wrong, email privacy@pickleboard.app and we'll correct or delete it.

Changes to this policy

We may update this policy from time to time. The “last updated” date at the top shows the current version, and your continued use after a change means the updated policy applies.

Contact

Questions about this policy or your data? Contact privacy@pickleboard.app.