Paddles Up LLC ("Paddles Up") runs the software pickleball clubs use to organize play. This explains what we collect, why, who sees it, and what you can tell us to do about it.
Two things to know before the detail:
Your results are meant to be seen. Standings, scores, ratings and the name you play under are shown to other players. That is the product working, not a leak. Your date of birth, contact details and home address are not shown.
Clubs are separate. When you register for a Club's event, that Club gets the information it needs to run it and uses it under its own policy.
What we collect
You give us
| What | Why |
|---|---|
| Name, preferred name, display name | Identifying you to other players |
| Email, and a separate contact email if you add one | Sign-in, event communications |
| Phone number | Event-day contact, if you provide it |
| Date of birth | Age-bracket eligibility, and the minimum age |
| Gender and competition gender | Division eligibility |
| Handedness | Match-up and draft information |
| City, state, postal code, country | Finding play near you, and payout records |
| Profile picture | Your avatar |
| Instagram handle | Optional, and shown to other players |
| Signed waivers | Proof you signed, and which version |
The service generates
Registrations, entries, scores, results, standings, ladder position, drafts, attendance, and the record of what you have paid.
Collected automatically
Sign-in and session data, device and browser type, IP address, pages viewed inside the app, errors, and product analytics. See Cookies and Tracking for the specifics, including session replay.
From others
- Your Club, when it invites you or enters a result for you.
- DUPR, if your account is linked: rating, age, gender, profile image and match history flow both ways so your rating reflects the matches you play here. Linking is yours to do, and we will undo it on request.
- Apple, Google or your passkey provider, if you sign in that way: the identifier they return, and your email — including an Apple private relay address, which we treat as your email and do not try to resolve.
- Stripe, the fact and status of a payment. Not your card number.
What we never have
Your full card number, security code or bank credentials. Those go from your browser to Stripe. We hold a Stripe customer identifier; Stripe holds the card.
Sensitive information
Some of what we collect is sensitive data under state privacy laws, and we treat it that way:
- Gender identity. The profile allows more than one value, so it can record that you are transgender or nonbinary. Oregon names that as sensitive data, and other states reach it through their sex-life and sexual-orientation categories. It is collected to decide division eligibility, it is used for nothing else, it is not sold, it is not shared for advertising, and it is not part of any analytics event.
- Date of birth, used for age brackets and the minimum age, and never displayed.
- Precise location, only if you turn it on to find play near you.
Where a state requires opt-in consent for sensitive data, we ask before collecting it. Declining does not cost you your account — only eligibility for divisions that depend on it.
Why we use it
- Running your account and signing you in.
- Letting Clubs run events you have entered: rosters, brackets, results.
- Taking payment, through Stripe, on behalf of the Club.
- Keeping ratings and results accurate, including the DUPR link if you have one.
- Safety and integrity: preventing cheating, harassment, fraud and abuse.
- Support, and reproducing problems you report.
- Telling you about events, entries, results and changes — service messages you cannot turn off while you hold an account, and marketing you can.
- Making the product better, through the analytics described below.
- Legal obligations, and defending claims.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
Who sees it
| Who | What | Why |
|---|---|---|
| Other players | Display name, avatar, results, standings, rating, Instagram handle if set | The product |
| Your Club | What it needs to run its events, and your signed waivers | It runs the event |
| DUPR | Match results, and the profile fields needed to match you | Only if you link |
| Stripe | Payment details, and identity data if you are paid out | Payments |
| Our providers | See Subprocessors | Running the service |
| Law enforcement and regulators | When legally required, and no more than required | Law |
| An acquirer | On a merger or sale, under this policy until changed with notice | Corporate |
We do not run third-party advertising tags.
Analytics, and being straight about it
We use PostHog for product analytics and session replay, and we route it through our own domain rather than calling PostHog directly. We do that because content blockers drop requests by hostname and we lose most of our data — but you should know what it means: the browser-level blocker you may rely on will not stop it.
We mask text in session replays and strip identifying values out of recorded URLs. Replays are for reproducing bugs and understanding where the product confuses people. We do not create a person profile for signed-out visitors.
There is no switch for it in the app yet, and we would rather say so than imply otherwise. Analytics runs for everyone signed in, there is no consent banner, and we do not yet honor Global Privacy Control — the browser signal some states require to be treated as an opt-out. Those are gaps we intend to close, not choices we are defending.
Until they are closed, the opt-out is a person rather than a setting: write to privacy@paddlesup.io and we will exclude you from analytics and delete the session replays we already hold. You do not have to give a reason, and it will not affect your account.
Your choices and rights
Wherever you live, you can:
- See what we hold, and get a copy in a portable format.
- Correct what is wrong.
- Delete your account and the personal data attached to it.
- Opt out of marketing, of sensitive-data uses, and of analytics.
- Unlink DUPR, or any sign-in provider.
- Appeal if we refuse, which several state laws require us to offer.
Write to privacy@paddlesup.io. There is no self-serve control in the app yet, so every one of these is done by a person reading your message — including deleting your account and unlinking DUPR. We answer within 45 days and will tell you if we need another 45. We will not charge you or degrade the service for asking, and you may use an authorized agent.
If the GDPR or UK GDPR applies to you, you also have the right to restrict or object to processing, to withdraw consent at any time, and to complain to your supervisory authority. Our lawful bases are contract (running your account and your entries), legitimate interests (safety, security, improving the product), consent (marketing, sensitive data, non-essential analytics), and legal obligation.
What deletion does not remove
Competition results are a record of a game other people played in. When you delete your account we remove your profile, contact details, date of birth, address and payment identifiers, and we disassociate your results rather than erasing them — the score stays, the person stops being you. We also keep what we must: transaction records for tax and accounting, signed waivers for as long as a claim could be brought on them, and records of safety reports.
How long we keep things
| Data | Kept |
|---|---|
| Account and profile | While the account is open, then 30 days |
| Results and standings | Indefinitely, disassociated after deletion |
| Signed waivers and their versions | 7 years, or until a participant who signed as a minor turns 21, whichever is later |
| Payment records | 7 years |
| Analytics events | 12 months |
| Session replays | 30 days |
| Security and access logs | 12 months |
| Support conversations | 3 years |
Children
The Service is not for children under 13, and we do not knowingly collect their information. Players under 18 need a parent or guardian, who must agree to the Terms and sign any waiver on their behalf. If you believe a child has given us information, write to privacy@paddlesup.io and we will delete it.
Security
Encryption in transit and at rest, least-privilege database access, scoped session cookies, and access logging. Some staff can sign in as a user to reproduce a reported problem; that access is restricted to the people who need it and every use is logged. No system is perfectly secure, and we do not pretend otherwise. Report a vulnerability to security@paddlesup.io. There is more detail at Security.
Where your data goes
We are in the United States, and your data is processed there.
Paddles Up is in beta, run with clubs in the United States, and we do not market it in the EEA or the UK. We have not appointed a representative there, and this site has no consent banner. If you are in one of those places and using Paddles Up anyway, write to privacy@paddlesup.io and we will handle your request under the GDPR regardless of whether it formally reaches us.
Changes
We will post a new version with a new effective date, and for material changes we will tell you at least 30 days ahead and ask you to acknowledge it.
Contact
privacy@paddlesup.io — Paddles Up LLC