Privacy Policy

This Privacy Policy explains how ShuttlSync ("we", "us") collects, uses, stores, and shares personal data when you use ShuttlSync (the "Service") — including our website at www.shuttlsync.com and any native mobile apps that load the Service.

We are the data controller for personal data processed through the Service. If you have questions, contact us at contact@shuttlsync.com.

This policy is written for users in the United Kingdom and the European Economic Area (EEA). It describes your rights under UK GDPR and EU GDPR where they apply to you.

ShuttlSync helps recreational badminton clubs run sessions, track matches, skill ratings, and related statistics. Features may include club membership, live scoring, session history, optional linking of health or fitness workouts after sessions, optional AI-generated session summaries, and an optional paid subscription (Player Plus).

Some features are only available to signed-in members of a club. Club administrators and moderators can access additional operational data about their club as described below.

Account and profile: email address; password (stored by our authentication provider as a secure hash); display name; optional bio; language preference; profile photo (uploaded by you or from Google sign-in); account creation and sign-in timestamps.

Club membership and play data: clubs you join; your role (member, moderator, session manager, admin); player profile linked to your account; match results, skill rating changes, games played and sat out; session dates, notes, and optional community recap text; session sign-up responses; club announcements you read or that moderators publish.

Data visible to other club members: within a club, other members typically see your display name, avatar, bio, and statistics derived from matches (for example wins, losses, skill rating). Moderators and admins see additional roster and operational information needed to run the club.

Club administration: club name and description; invite codes; venue names and coordinates entered by admins (not continuous GPS tracking of your device).

Player Plus (only if you subscribe): which brand's Plus you hold, the plan, where you bought it (App Store or web), when it renews or ends, and whether it will renew. We also keep a count of the AI session stories generated for your account, to apply the monthly free allowance.

Cookies and similar technologies: authentication session cookies; a cookie remembering your selected club; a language cookie for guests; a short-lived cookie used during Google sign-in. See the Cookies section below.

Analytics (production website only): aggregated page views and web performance metrics via Vercel Analytics and Speed Insights. Our custom analytics events are designed not to include your name, email, user id, or club identifiers.

In-app activity log (signed-in members): when you use the app while signed in, we record which pages you open and which buttons or links you tap (the button's visible label, for example "Start session"), with the time, your account, and whether you used the website or the iOS app. We never record what you type into fields. This log is kept for 30 days and is visible only to the Service operator.

Optional health and fitness data: if you use a supported mobile app and choose to link a workout, we may store workout identifiers, times, heart rate samples (downsampled), calories, distance, and derived per-match metrics. This data is visible only to you in the Service unless you choose to share information elsewhere outside the app.

Optional AI summaries: if enabled for a session, we may send match statistics and player display names to OpenAI to generate a short explanatory text, which we cache. You can still see factual stats without using this feature.

We do not operate an in-app contact form, marketing email list, or browser localStorage-based tracking. We do not collect your device's GPS location for tracking; venue coordinates are entered manually by club admins.

We process personal data for the following purposes and legal bases under UK GDPR / EU GDPR:

Providing the Service (contract / steps at your request): creating and managing your account; authenticating you; operating club features you use; storing match and session data; displaying your profile and stats to your club; syncing optional workout data you link.

Player Plus (contract / legal obligation): selling and renewing your subscription through RevenueCat and the store you buy from, unlocking the Plus features on your account, and keeping the records tax and accounting law requires.

Security and abuse prevention (legitimate interests): protecting accounts, investigating misuse, and maintaining service integrity, balanced against your rights.

Analytics and product improvement (legitimate interests): understanding how the Service is used in aggregate in production, without identifying you in custom event properties.

In-app activity log (legitimate interests): helping you when you contact support, finding where members get stuck, and fixing broken flows. It is never used for advertising, never sold, and never shown to other members or club admins. You can object at any time by contacting us.

Health and fitness linking (consent): reading and storing workout-related data only when you initiate linking and grant permission on your device. You can withdraw consent by not using the feature and requesting deletion of stored workout data.

Optional AI explanations (legitimate interests or consent depending on configuration): generating non-binding narrative summaries from match facts. These do not replace human decisions about membership or play.

Legal compliance: where we must retain or disclose data to comply with law or respond to valid requests from authorities.

Badminton clubs on the Service are shared spaces. Information you add to your player profile or that is generated from matches in a club is generally visible to other members of that club according to the product design.

Club moderators and admins can manage rosters, sessions, venues, announcements, and membership. They should only use member data for legitimate club administration.

If you leave a club or delete your account, visibility and retention are handled as described in the Data retention section.

Strictly necessary cookies: Supabase authentication cookies keep you signed in. The active club cookie remembers which club you are viewing. The auth-intent cookie briefly supports Google sign-in registration vs login.

Preference cookies: the NEXT_LOCALE cookie stores the language chosen in the language menu by guests.

Analytics: on our production deployment only, Vercel Analytics and Speed Insights may set or rely on cookies or similar technologies to collect usage and performance data. See Vercel's privacy documentation for details.

You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent you from signing in or using core features.

Workout and heart-rate data are special category data under UK/EU law. We only process this data when you explicitly choose to link a workout from Apple Health (HealthKit) after a club session, and only for showing you summaries and statistics inside the Service.

Linked workout data is stored in our database with access restricted so that only your account can read your own workout records.

You can stop future collection by not using the link feature and revoking HealthKit permissions on your device. To delete data already stored, contact us at the email below.

App store listings may require additional disclosures; this policy is the canonical description of how we handle health-related data in the Service.

Player Plus is an optional subscription for your own account, sold separately for each app (for example ShuttlSync Plus). Everything needed to take part in club sessions stays free.

Purchases are managed by RevenueCat. In the iOS app you pay Apple through your App Store account; on the website you pay by card through Stripe. Card details are collected and stored by the payment provider, never on our servers.

RevenueCat identifies your purchase by your account's internal id (not your name or email), so a subscription bought on the web also works in the app and the other way round. On the web, Stripe asks for your email address for the receipt.

You can change or cancel an App Store subscription in your Apple ID's subscription settings, and a web subscription from Manage subscription in the app. Their privacy policies apply to the payment itself: https://www.revenuecat.com/privacy, https://www.apple.com/legal/privacy, https://stripe.com/privacy

We use trusted processors who handle data on our instructions:

Supabase (authentication, database, file storage, realtime) — hosts and processes account and club data.

Vercel — website hosting, analytics, and speed insights in production.

Google — OAuth sign-in when you choose "Sign in with Google".

OpenAI — optional generation of session rating explanations when the feature is enabled.

RevenueCat, Apple (App Store) and Stripe — Player Plus subscriptions, depending on where you buy.

Apple and Google — health platforms on your device; we receive data you authorize through their APIs.

Some providers may process data in the United States or other countries outside the UK/EEA. Where required, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or adequacy decisions. You may request more information about transfers by contacting us.

We keep personal data for as long as needed to provide the Service and for legitimate business purposes thereafter.

Account data: retained while your account is active. If you delete your account or ask us to erase data, we will delete or anonymize personal data within a reasonable period, except where we must retain it for legal, security, or dispute reasons.

Club and match history: may remain visible to the club until removed by club admins or until account/club deletion processes apply.

Workout and AI summary data: retained until you delete it, delete your account, or we no longer need it for the purpose collected.

Player Plus records: kept while the subscription is active and afterwards for as long as tax and accounting law requires.

Server logs and analytics: kept for limited periods according to our hosting and analytics providers' defaults.

In-app activity log: deleted automatically after 30 days, and at once when your account is deleted.

We use industry-standard measures including encryption in transit (HTTPS), access controls, and row-level security in our database so users can only access data permitted by their club role.

Payment card data is handled by Apple or Stripe. We never store card numbers.

No method of transmission or storage is completely secure. If you believe your account has been compromised, contact us promptly.

Depending on where you live, you may have the following rights regarding your personal data: access; rectification; erasure; restriction of processing; data portability; object to processing based on legitimate interests; withdraw consent where processing is based on consent (without affecting prior lawful processing).

To exercise your rights, email contact@shuttlsync.com. We may need to verify your identity before responding. We aim to respond within one month, or longer where permitted by law for complex requests.

You may also use in-product account settings to update your display name, bio, language, and avatar where available.

If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk.

If you are in the EEA, you have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or where an alleged infringement occurred.

The Service calculates skill ratings and statistics from match results using defined rules. These outputs affect in-app statistics only and do not have legal or similarly significant effects on you outside the Service.

Optional AI-generated session explanations are descriptive text based on match facts. They are not used as the sole basis for decisions about your legal rights or club membership.

The Service is not directed at children under 16. We do not knowingly collect personal data from children under 16 without appropriate parental authority.

If you believe a child has provided us personal data without consent, contact us and we will take steps to delete it.

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "Last updated" date.

For material changes, we may provide additional notice (for example in the app or by email where appropriate). Continued use of the Service after changes take effect means you accept the updated policy, subject to your rights under applicable law.

Data controller: ShuttlSync.

Privacy enquiries and data subject requests: contact@shuttlsync.com.

Postal address: available on request — email us if you need it for a formal request.