PadelDrawPrivacy Policy
What personal data PadelDraw processes, why, who it is shared with, how long it is kept, and how users in Türkiye and the EU can exercise their rights.
Effective date: 18 October 2026
This policy explains how your personal data is processed when you use the PadelDraw website (padeldraw.app), live tournament pages, TV screen and iOS/Android apps (the "Service"). The information notice for users in Türkiye under the Personal Data Protection Law No. 6698 ("KVKK") is in our KVKK Information Notice. Information for users in the European Union and European Economic Area ("EU") under the General Data Protection Regulation ("GDPR") is included below.
In short
- You sign in with Apple, Google or a 6-digit code sent to your email; you do not need to create a password.
- Players can join a tournament without an account, just by entering a name.
- Names and results in a tournament appear on its live page, which anyone with the link can open.
- We do not collect your location, sell your data, show ads or use advertising or analytics tools.
- You can delete your account yourself in the app or on the web.
- The Service is currently free; we do not collect payment details.
Data controller
| Data controller | Noesis Social - Burak OHRİLİ (sole proprietorship) |
| Address | Gazi Osmanpaşa Mah. 5499/1 Sok. No:9 Bornova / İzmir, Türkiye |
| Tax office / Tax ID | Ege Tax Office / 6360302767 |
| Phone | +90 532 744 94 34 |
| padeldrawapp@gmail.com | |
| Privacy requests | Contact form, topic: Privacy |
You can send privacy questions and requests through the contact form, by email to padeldrawapp@gmail.com or in writing to the address above. The ways to apply under the KVKK are described in detail in the KVKK Information Notice.
Organisers and clubs: when a person running a tournament or club enters player names into the Service, they use that information for their own event and are responsible for informing their players. PadelDraw is the data controller for operating the Service (accounts, live pages, notifications, records).
What we process
Account holders
- Account and sign-in: email address, account ID and, if you sign in with Apple or Google, the user identifier and name that provider shares. With Sign in with Apple you may share a relay address created by Apple instead of your real one. Sign-in codes are single-use and expire quickly.
- Profile: display name; optionally level (0–10), gender (only for mixed-pair draws), city and profile photo; language preference.
- Tournaments, clubs and leagues: tournaments, clubs, events and leagues you create or join; pairings, scores, standings, podium records (trophy cabinet) and league ratings. If you run a club: club name, city, logo, brand colour and court details, and the email addresses of staff you invite.
- Notifications: if you allow push notifications, your device's Expo push token, platform (iOS/Android) and language.
Guest players
When you join via QR code, link or join code without an account, you enter a name; depending on the format you may be asked for an optional level and, in mixed formats, gender. A random guest key created on your device lets us recognise you as the same player when you return on that device. An organiser may also add you to a tournament by name.
Referees and TV screen
Referees enter scores without an account using a 6-digit PIN from the organiser; the PIN is stored on our servers only in hashed form. A TV screen is linked with a 6-digit pairing code that contains no personal data and expires quickly.
Everyone
- Content reports: when you report a name or content: the item reported, the reason, your optional note (up to 500 characters), and your account ID or an irreversible hash (SHA-256) of your guest key.
- Contact form: your name, email address, topic, message, language and, to limit abuse, a hash of your IP address combined with a value that changes daily. The IP address itself is not stored in this record.
- Audit records: score changes (who, when, previous and new value) and critical actions such as content reports and account deletion.
- Technical logs: for requests reaching our servers, IP address, date/time and browser or app information are kept briefly in our hosting providers' server logs.
What we do not collect: location, contacts, microphone/audio, calendar, health or payment data; we do not read advertising IDs (IDFA/AAID). The website and apps contain no analytics, advertising or error-tracking tools. We do not intend to process special categories of data; please do not enter health, religion, political opinions or similar information in tournament, player or note fields.
App permissions
| Permission | Used for | Note |
|---|---|---|
| Camera | Scanning a tournament QR code | Images are not saved or sent to our servers |
| Photos | Choosing a profile photo; saving your podium card to your gallery | Only the photo you pick is uploaded |
| Notifications | Round-started and results-published alerts | Can be turned off at any time |
Location and microphone permissions are blocked in the app. Declining a permission only disables the related feature.
Why we use it and legal bases
| Purpose | KVKK | GDPR |
|---|---|---|
| Account creation, sign-in, keeping you signed in, profile | Art. 5/2-c establishment/performance of a contract | Art. 6(1)(b) contract |
| Tournaments, draws, scores, standings, live page, TV screen, club and league features | Art. 5/2-c | Art. 6(1)(b) |
| Guest participation and recognition on the same device | Art. 5/2-c; Art. 5/2-f legitimate interest | Art. 6(1)(b); Art. 6(1)(f) legitimate interests |
| Sign-in code emails | Art. 5/2-c | Art. 6(1)(b) |
| Push notifications (with your device permission) | Art. 5/2-c | Art. 6(1)(b) |
| Score history, audit records, content reports, abuse prevention, security | Art. 5/2-f; Art. 5/2-e establishment, exercise or protection of a right | Art. 6(1)(f) |
| Keeping past results intact and anonymous for other players after account deletion | Art. 5/2-f | Art. 6(1)(f) |
| Answering contact requests and applications | Art. 5/2-c, 5/2-ç legal obligation, 5/2-f | Art. 6(1)(b), 6(1)(c), 6(1)(f) |
| Legal obligations and requests from competent authorities | Art. 5/2-ç | Art. 6(1)(c) |
Our legitimate interests are keeping results accurate and intact, resolving score disputes, enabling participation without an account and protecting the Service against abuse. We do not carry out any processing based on consent. We do not send marketing emails or notifications; if we want to in future, we will ask for your separate consent.
You need to provide an email address (or an Apple/Google account) to create an account, and a name to join a tournament; without them we cannot provide that service. Other profile details are optional. We make no decisions about you based solely on automated processing that have legal effects; draws and standings are calculated under the rules you or the organiser choose.
Who can see it
- Live tournament page: your name, pairings, scores and standing in a tournament appear on its live page and TV screen, which anyone who knows the link or join code can open. If the link is shared publicly, the page may also appear in search engines. Results remain visible after the tournament ends.
- Public profile details: your display name, profile photo and level are visible to other users on podium, league and club pages. Profile photos are served via a public link. Your city, gender and email address are not shown publicly on your profile.
- Podium cards: you can create a share card for a podium in your trophy cabinet; it shows your name, place, points and the tournament name. No card is shown for podiums you hide.
- Organisers and club admins: see player details of their own tournaments and content reports about them.
- Our service providers: the providers below process data only on our behalf and on our instructions.
- Authorities: where required by law and only to the extent necessary.
We do not sell or rent your data or share it for advertising.
Service providers and data location
| Provider | Purpose | Data location |
|---|---|---|
| Supabase Inc. | Database, authentication, realtime data, file storage (profile photos), server functions | EU: Frankfurt, Germany (AWS eu-central-1). US-based company |
| Vercel Inc. | Hosting the website and live pages, generating share images | US-based company; requests are processed on Vercel's global network (including the US) |
| Resend (Plus Five Five, Inc.) | Sending sign-in code emails; forwarding contact-form messages to the operator (domain mail.padeldraw.app) | EU: Ireland (eu-west-1). US-based company |
| Expo (650 Industries, Inc.) | Delivering push notifications; distributing app updates | US |
| Apple Inc. and Google LLC | Sign in with Apple and Google Sign-In; delivering notifications to devices (APNs, FCM); app stores | Provider's global infrastructure (including the US) |
When you sign in with Apple or Google, those companies handle authentication under their own privacy policies. When you download the app from the App Store or Google Play, the stores' own terms apply; if you allowed it on your device, Apple and Google may provide us with crash reports and aggregated usage statistics through their consoles.
Transfers abroad
Our providers' servers are outside Türkiye, so your data is transferred abroad. We keep data mainly in the EU (Germany and Ireland); the services of Vercel, Expo, Apple and Google involve processing in the US.
- Transfers from Türkiye (KVKK Art. 9): we rely on the standard contracts published by the Turkish Personal Data Protection Board; signed standard contracts are notified to the Personal Data Protection Authority within five business days of signature, as the law requires. Because these transfers are regular, we do not rely on your explicit consent.
- Users in the EU (GDPR): for transfers to providers outside the EU we rely on the European Commission's Standard Contractual Clauses incorporated in the providers' data processing agreements and, where the provider participates, the EU–US Data Privacy Framework. The data controller is in Türkiye; the data needed to run the Service is accessed from Türkiye.
How long we keep it
| Data | Period |
|---|---|
| Account and profile details, profile photo, podium records, league ratings, club memberships | While your account is open; deleted immediately when you delete it |
| Tournament records (name, pairings, scores, standings) | 5 years from the tournament date to show results; player names are then anonymised. If you delete your account, your name becomes "Deleted player" immediately |
| Notification registrations of signed-in devices | Until the account is deleted, notifications are turned off or the token becomes invalid |
| Notification registrations of guest devices | Up to 12 months after last use |
| Club staff invitations (invited email) | Invitations are valid for 7 days; the record is deleted 1 year after creation |
| Contact-form messages | 2 years from receipt |
| Content reports | 2 years from creation |
| Audit records (including score changes and the account-deletion record) | 2 years |
| Providers' server and email delivery logs | For the provider's technical log period, at most 30 days |
| Backups | Deleted data is permanently removed from backup rotation within 30 days |
| Data stored on your device | Until you clear it, sign out or uninstall the app |
If there is a dispute, an official request or a legal obligation, we may keep the relevant records until it is resolved and the applicable limitation period has expired. Data whose period has ended is deleted, destroyed or anonymised.
Deleting your account and data
You can delete your account yourself in the app under Profile → Delete my account, or on the web under Account → Delete account. If you cannot access your account, use the contact form with the Privacy topic or email padeldrawapp@gmail.com; we complete requests within 30 days. The steps, and ways to delete some data without deleting your account, are on the account deletion page.
When your account is deleted:
- your account and sign-in details, your profile (name, level, gender, city and profile photo files), podium records, league ratings, club memberships, notification registrations for your devices, pending club invitations sent to your email address and contact-form messages you sent from that email address are deleted;
- in tournaments you played, matches and scores stay for other players' results; your entry's name is replaced with "Deleted player" in your language, the level and gender on the entry are cleared, your name in fixed-pair team names is replaced, and the link to your account is removed;
- content reports you made are kept for moderation for the period above, with no link to your account (including the note you wrote);
- security audit records keep only your former account ID (a pseudonymous identifier), without your name or email, for 2 years;
- tournaments, clubs, leagues and events you created remain without an organiser; if you are the only owner of a club, you are asked to hand it over to another admin first;
- deleted data is also removed from backups within 30 days.
If you joined tournaments as a guest, you can ask the organiser or us to change or remove your name.
Data stored on your device and cookies
On the website we only use cookies that are strictly necessary for your sign-in session; there are no analytics or advertising cookies. Information such as the guest key, TV pairing code and referee PIN is stored in your browser or on your device. See our Cookie Policy for details.
Age
The Service is not directed to children under 13, and children under 13 may not create an account. If you are under 18, you must use the Service with the consent of a parent or guardian; if you are in the EU and below the age your country sets for consenting to online services, that consent is required. An organiser running a tournament with children is responsible for obtaining parents' consent before entering children's names. If you believe a child's data has been processed in breach of these rules, contact us and we will delete it.
Your rights
Users in Türkiye
Under KVKK Art. 11 you have the right to learn whether your data is processed, request information about it, learn the purpose and whether it is used accordingly, know the third parties it is transferred to, request correction, deletion or destruction, request that recipients be notified of these, object to a result against you arising exclusively from automated analysis, and claim compensation for damage caused by unlawful processing. How to apply is described in the KVKK Information Notice. We respond free of charge within 30 days at the latest; if you are not satisfied, you can complain to the Personal Data Protection Board.
Users in the EU
Under GDPR Art. 15–22 you have the right to access, rectify and erase your data, to restrict processing, to receive your data in a structured, machine-readable format (portability) and to object to processing based on legitimate interests. We do not make decisions based solely on automated processing that significantly affect you. You can also lodge a complaint with the data protection supervisory authority where you live or work or where the infringement took place.
For requests, use the contact form with the Privacy topic, email padeldrawapp@gmail.com or write to the address above. To verify your identity, we may ask you to write from the email address on your account or to provide further information. We respond within 30 days at the latest.
Security
Connections are encrypted (HTTPS); row-level access rules in the database ensure everyone can access only the data they are authorised to see. Referee PINs are stored hashed, guest keys cannot be read through the app's interface and critical actions are logged. No system can guarantee complete security; if a data breach occurs, we will make the notifications required by law to the Turkish Board, to EU supervisory authorities where applicable, and to you.
Payments
The Service is currently free and we do not process payment details. When paid plans start, we will add information about payment providers to this policy and announce it in advance.
Changes
We update this policy when our processing changes. We announce significant changes in the Service before they take effect. The current version and its effective date are always on this page.
Last updated: