Privacy Policy
1. Who is responsible
The controller of your personal data is [Operator full name], NIF [NIF], [Address], Portugal. Contact for any privacy question: [email protected].
2. What we collect and why
- Account: your email address, a unique account ID, the login method you used (email link or Google), and login records (date, IP address and browser, kept by our login provider for security). Why: to give you access to your account (contract) and keep it secure (legitimate interest).
- Plan and payments: your plan, its end date and your Stripe customer and subscription IDs. Card details are handled by Stripe, not by us. Why: to provide Pro (contract) and keep invoices and tax records (legal obligation).
- Pro launch list (optional): if you ask to be told when Pro launches, we store that email address and the date. Why: your consent. We send you one email when Pro launches and then delete the list; you can ask us to remove you at any time.
- Emails: we send login links and essential messages about your account or payments. We will only send marketing if you opt in.
- On your device: your login session and simple preferences (such as the last stat you chose) are stored in your browser's local storage. These are strictly necessary for the site to work. We use no advertising cookies and nothing that follows you to other sites.
- Returning-visitor cookie: to see whether visitors come back, we set one first-party cookie,
cs_vid, holding a random identifier, for 12 months. It is attached to the usage statistics described below and is not linked to your account or email. If you browse from Europe we set it only after you accept the notice shown on your first visit; elsewhere it is on by default. It is never set when your browser sends a "Do Not Track" or Global Privacy Control signal. You can change your choice at any time with the "Cookies" link at the bottom of the site; choosing "No thanks" deletes the cookie. Your choice is remembered in your browser's local storage. Why: your consent where the law requires it, otherwise our legitimate interest in improving the site. - Server logs: our hosting provider processes technical data (such as IP address) to deliver the site and protect it from abuse.
- Visit statistics: we use Cloudflare Web Analytics to count page views, countries and devices. It uses no cookies, does not track you across sites and does not identify you.
- Usage statistics: to understand which parts of the site are useful, we record anonymous events: the site that linked you here or the short link you used (for example our profile on a social network), what you open on the page (a game, a player, a stat, the sign-up window), how long the page stayed visible, whether you are on a phone or a computer, your browser's time zone (as a rough region) and whether you were logged in. Each visit gets a random identifier that exists only while the page is open; it is not linked to your account, email or IP address. Unless the returning-visitor cookie described above is active, nothing is stored on your device for this and a later visit cannot be connected to an earlier one. If your browser sends a "Do Not Track" or Global Privacy Control signal, nothing is recorded. Why: our legitimate interest in improving the site. These records are stored with Supabase.
3. Signing in with Google
You can choose to sign in with your Google account instead of an email link. This section explains exactly what happens with Google user data.
- What we receive: only the basic information Google shares under the "openid", "email" and "profile" permissions — your name, email address, profile picture link and a Google account identifier. We do not request access to Gmail, Google Drive, Contacts, Calendar or any other Google service.
- How we use it: only to create your Courtside account, log you in, show which account you are logged in with, and link your account to your Pro plan. We do not use it for advertising, profiling or to train any AI or machine-learning model.
- Where it is stored: in our account database at Supabase (EU). Your Google password is never seen or stored by us.
- Sharing: we do not sell, rent or share Google user data with anyone. It is processed only by the service providers listed in section 4, and only to run the service, or where the law requires it.
- Keeping and deleting it: we keep it while your account exists. You can delete your account and this data at any time by writing to [email protected]; we delete it within 30 days. You can also remove Courtside's access at myaccount.google.com/permissions.
Courtside's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. Who processes data for us
- Supabase — accounts, login (including Google sign-in) and database (servers in Ireland, EU).
- Stripe — payments and invoices.
- Resend — sending login emails (EU region).
- Cloudflare — hosting, domain and security for the website.
- Google — only if you choose to sign in with Google.
Some of these companies are based in the United States. Where data leaves the EU, transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
5. How long we keep it
Account data is kept while your account exists. If you ask us to delete your account we do so within 30 days, except billing records, which Portuguese tax law requires us to keep (up to 10 years). Security logs are kept for a short period.
6. Your rights
You can ask to access, correct, delete or receive a copy of your data, and to restrict or object to its use, by writing to [email protected]. You can also complain to the Portuguese data protection authority, CNPD, or the authority in your country.
7. US residents
We do not sell or share personal information for cross-context advertising. You may request access to or deletion of your information at [email protected].
8. Age
Courtside is only for people aged 18 or older. We do not knowingly collect data from minors.
9. Changes
We will post any changes on this page and update the date above.