Privacy Policy

This policy explains what personal information Athlync App Inc. (“Athlync”, “we”, “us”) collects through the Athlync mobile app and the Athlync website, why we collect it, who else handles it, and what you can ask us to do about it.

Athlync is a British Columbia company. We are governed by Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia’s Personal Information Protection Act (PIPA).

Who is responsible for your information

Athlync App Inc. is the organization responsible for the personal information described here. We have designated a Privacy Officer, whose contact details are at the end of this policy. You can write to them about anything in this document, including a complaint.

Information you give us

• Account details. Your first and last name, email address, username, date of birth, and a password. If you sign in with Google we receive your name, email address and profile picture from that provider instead of a password, and no date of birth — you supply that during onboarding.
• Profile content. A profile photo, a short description, your city, the sports you play and your self-declared skill level in each, and — only if you choose to add them — your Instagram and TikTok usernames. Everything in this list is optional except the sports you play.
• Things you post. Games you host, clubs you create or join, tournaments you create or enter, messages you send in game chats, club chats and direct messages, the rating and comment you leave for a host after a game, and any rating you leave for a court.
• Friends. Who you have sent a friend request to, who has sent one to you, and who you ended up friends with. Your profile carries a QR code holding your username so someone standing next to you can add you by scanning it. Scanning theirs uses your camera; the frames are read on your device and the image is never sent to us or stored.
• Reports and blocks. If you report someone or something, we keep what you reported, the reason you picked, and anything you write in the description box. If you block someone, we keep a record of that too. If someone reports your content, we keep a copy of the text that was reported, as it was when the report was made. That copy stays with the report, so it can still be reviewed after the original is edited or deleted. For pictures we keep a link to the image rather than the image itself, so a picture that is later deleted is no longer viewable. Where the content is already gone when a report is made, we still record the report, without a copy.

Information we collect as you use the app

• Location. With your permission, the app reads your device’s location while you have it open and sends the coordinates to our servers to find games and courts near you. We do not read your location in the background, we do not write those coordinates to our logs, and we do not build a history of where you have been. If you decline the permission the app falls back to a default city and everything else keeps working.
• Camera and photo library. With your permission, so you can set a profile photo and scan a friend’s QR code. We receive the single photo you pick; the rest of your library is never read, and we do not scan photos for faces, places or anything else.
• Push notification token. An identifier issued by Apple or Google that lets us send notifications to your device, along with your device platform.
• Your notification inbox. A record of each notification we have sent you — what happened, when, whether you have read it, and who caused it.
• Notification settings. Which categories of notification you have switched off.
• Conversation activity. For each conversation you are in: when you joined, when you left if you did, whether you muted it, and how far through it you have read. The last of these is what produces your unread counts.
• Crash and performance diagnostics. When the app crashes we receive a report describing what it was doing, linked to an opaque account identifier so we can tell whether a problem is hitting one account or everybody. Your name and email address are not attached to it, and neither is anything you have written.
• Server error reports. When a request from the app fails on our servers with an unexpected error, we send a report of it to our error-tracking provider so we can fix it. The report describes the request — the address it went to, without anything after a question mark, and the kind of request — along with the error, where in our code it happened, a short record of what the server was doing just before, the language of the request, and technical details about the server. It is not attached to your account: it carries no name, email address, username, IP address, request headers or request body. Before it is sent, email addresses, passwords and sign-in tokens, locations and the text of database errors are removed from it. The address or the error can still contain an internal identifier, such as that of a conversation or a player, because that is what lets us find the problem.
• Account activity. Your last sign-in time, your language preference, and whether your email address has been verified.

The website and the waitlist

If you joined the waitlist on this website we collected your name, email address, and optionally your primary sport interest. If you arrived through a campaign link we also stored the campaign parameters in that link (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and the referring web address your browser reported, so we could tell which channels brought people to Athlync. Waitlist signups are held in Google Cloud Firestore and the site is served by Firebase Hosting.

The per-sport interest forms linked from the Sports section are hosted by Google Forms. Anything you submit there is collected by Google on our behalf under Google’s own privacy terms.

What we do not do

We do not track you across other companies’ apps and websites. We do not use advertising identifiers, we do not sell or share your personal information, and Athlync carries no advertising. We do not run product analytics in the app. We do not collect payment information, your contacts, your health or fitness data, or your browsing history.

How we use your information

• To run your account, and to show your name, photo and sports to other players in games and clubs you join.
• To show you games and courts near you.
• To deliver your messages, and to tell you about your games, your clubs, friend requests and new messages.
• To show host ratings, so players can see who reliably turns up to the games they host.
• To let you block other players, and to review what people report so we can enforce our terms.
• To fix crashes and keep the app working.
• To send you service email — verification codes, password resets, and account deletion confirmations. These are not marketing, and they cannot be switched off while your account is open. We will not send you marketing email without asking first.

What other players can see

Your name, username, profile photo, description, city, sports, skill levels, social handles and rating summary are visible to other Athlync users. Clubs you join are visible to their other members, and so are private games; a tournament you enter is visible to the other entrants. If a game is public, the list of players who have joined it — including you — is visible to anyone signed in to Athlync, not only to the people playing. Treat anything on your profile as public within Athlync — if you would rather not share your Instagram or TikTok, leave those fields empty.

Anyone in a game or club you have joined can see what you write in its chat, including people who join afterwards and read back through it.

Messages

Athlync carries three kinds of conversation: the chat attached to a game, the chat attached to a club, and direct messages between two people. All of them are stored in our own database, alongside the rest of your account. We do not use a third-party chat provider.

Anyone signed in to Athlync can start a direct message with you, unless you have blocked them or they have blocked you. You do not have to be friends first.

When you delete a message we erase its text. An empty record stays in the conversation so that everyone else’s app can be told the message is gone, but the words are not recoverable from it. Editing a message replaces the text, and we keep no history of what it said before.

Notifications

When something happens that involves you — a game is cancelled, somebody asks to join your club, a friend request arrives — we save a notification to your inbox inside the app. Chat messages are the exception: a new message sends you a push notification but is never written to your inbox, so the text of your conversations is never copied out of the conversation it belongs to.

Push notifications pass through Apple and Google. To reach your device at all, a notification has to be handed to Apple’s or Google’s push service, and it carries its own text with it. For a new message, that text is the message you were sent and the name of the person who sent it. If you would rather Apple and Google did not handle that, you can turn off notifications for Athlync in your device settings; everything else in the app keeps working.

Reporting and blocking

You can block another player, and you can report a person, a message, a game, a club or a tournament. A report records what you reported, the reason you picked, anything you typed, your account, and the account responsible for the content. Someone reviewing it also records what they decided and why.

We keep reports even after the reported thing has been deleted, and even if one of the accounts involved has since been closed. A report is often the only remaining record that something happened, and losing it with the content would leave us unable to act on repeated behaviour or to show what we did. This is a deliberate exception to the deletion rules below.

Who processes your information for us

We use a small number of service providers. They process your information on our instructions and may not use it for their own purposes.

• Railway — hosts our servers and database, in the United States. Your messages are stored there with the rest of your account.
• Cloudflare — stores and serves profile and court photos.
• Sentry — receives the server error reports described above, so we find out when something breaks, and stores them in the United States. It receives nothing from the app on your phone.
• Google Firebase — crash reporting, push notification delivery, and remote configuration. Every notification we send you passes through Firebase Cloud Messaging, carrying its own text — which for a new message is the message itself. Firebase Hosting and Cloud Firestore also serve this website and hold waitlist signups.
• Apple — delivers push notifications to iPhones, carrying the same text.
• CrocWeb — hosts the athlync.io mail server, in Ontario, Canada. Our verification, password reset and account deletion email is sent through it.
• Apple Maps and Google Maps — draw the map you see when you look for games and courts. Apple on iPhones, Google on Android phones. The provider receives the part of the map your phone is drawing and your device’s network address, which it handles under its own privacy terms.
• Google — only if you choose to sign in with Google, which returns your name, profile picture and email address.

We also disclose information where the law requires it, or where it is necessary to investigate a safety issue or enforce our terms.

Your information is stored in the United States

Although Athlync is a Canadian company, our servers, database and file storage are located in the United States, and the providers listed above may process your information there or in other countries.

While your information is outside Canada it is subject to the laws of the country it is in, which means it may be accessed by the courts, law enforcement agencies and national security authorities of that country. We remain accountable for it, and we require our providers by contract to protect it to a comparable standard.

How long we keep it

• Your account information — for as long as your account is open.
• Messages — for as long as the conversation exists. Deleting a message erases its text straight away.
• Notifications in your inbox — until you delete your account. We do not clear them on a schedule.
• Reports — indefinitely, including any copy kept with them, for the reasons given above.
• Email verification, password reset and account deletion codes — a code stops working 15 minutes after we send it, and asking for a new one replaces the old.
• App crash reports — 90 days. This is set by Firebase Crashlytics and we cannot extend it.
• Server error reports — 30 days, held by Sentry. This is the retention on our Sentry plan.
• Server logs — up to 30 days, held by our hosting provider. These record that a request happened, not your location.
• The record of a deleted account — indefinitely, in stripped form. See below for exactly what that means.

Deleting your account

Open Athlync, go to Profile → Settings, and choose Delete account. We email you a six-digit code; entering it deletes the account. You can also email privacy@athlync.io and we will do it for you.

When you delete your account we remove:

• your name, email address, username, date of birth, description, city, and Instagram and TikTok usernames;
• the photos you uploaded, from our file storage as well as our database;
• your push notification tokens, so we can no longer reach your devices;
• your sign-in credentials and any link to your Google account.

If your profile picture came from Google rather than being uploaded, we only ever held a link to it. We delete the link; the image was never ours.

Deleting your account also cancels any upcoming games you host, and their players are notified; hands each club you own to another member, or dissolves it if no member is left to take it over; withdraws your pending club and game requests along with any club invitations waiting for you; and removes you from tournaments that haven’t finished, including entries that had already been accepted, which frees the place for someone else.

Some things deliberately stay, and you should know what they are before you delete:

• an empty placeholder record, so that other players’ game history does not break. It carries no personal information and no way back to you;
• messages you sent, in the conversations of the people you sent them to, shown as coming from a deleted user;
• past games you hosted, in other players’ history, with no profile attached;
• ratings and comments you left for hosts and courts, and any finished or cancelled tournament you entered, shown against the closed account rather than against you;
• notifications other people received because of something you did, in their inboxes;
• blocks, in both directions. If someone blocked you, closing your account does not lift it;
• reports you made and reports made about you, including anything written in them and the copy kept with them — see Reports and blocks above — for the reasons set out above;
• the record of which notification categories you had switched off.

The first four carry nothing that points back to you. The last four are tied to the account that has been closed, which is why we list them separately rather than describing the deletion as total.

Your rights

You can ask us to give you a copy of the personal information we hold about you, to correct it if it is wrong, or to delete it. Email privacy@athlync.io. We respond within 30 days. You do not have to explain why, and it costs you nothing.

You can withdraw your consent to location access or notifications at any time in your device settings, without affecting the rest of the app.

If you are not satisfied with how we have handled your information, please raise it with our Privacy Officer first so we have a chance to put it right. You also have the right to complain to the Office of the Privacy Commissioner of Canada, or, in British Columbia, to the Office of the Information and Privacy Commissioner for British Columbia.

Children

You must be at least 13 years old to hold an Athlync account, and we reject registrations that give a younger date of birth. Athlync is not directed at children, and we do not knowingly collect their personal information. If you believe someone under 13 has created an account, email privacy@athlync.io and we will delete it.

Security

Information travels over HTTPS. Passwords are hashed and never stored in a readable form, and sign-in tokens are held in the iOS keychain rather than in ordinary app storage. Access to production data is limited to Athlync personnel who need it. No system is perfectly secure and we cannot promise absolute security.

Changes to this policy

If we make a material change we will update the date at the top of this page. Where a change significantly affects how we use your information, we will also email the address on your account before it takes effect.

Contact

Privacy Officer
Athlync App Inc.
Unit 1 – 1680 Lloyd Ave
North Vancouver, BC V7P 2N6
Canada
privacy@athlync.io

For anything that is not about privacy, write to support@athlync.io.