CourtDuo Privacy Policy

CourtDuo helps young tennis players find a doubles partner at Tennis Europe or ITF Junior tournaments. This page explains what data we collect, why, how long we keep it, and what you can do to delete it.

We have written it in plain language, because children and their parents read it too.

Who is responsible for your data

The data in this service is the responsibility of CourtDuo.app, available at https://courtduo.app.

For all matters concerning personal data: contact@courtduo.app

The most important things, in short

We never ask for a phone number and never store one.
CourtDuo has no chat. Players cannot send each other free-form messages — only a doubles invitation and a reply to it.
We show no advertising and we do not sell your data to anyone.
We do not store a full date of birth — only the year, so that we can work out a player's age category (for example U14).
The account belongs to the player. A parent gives consent, but does not have their own account, does not log in, and does not send invitations.
Every account needs a parent's confirmation. The Tennis Europe Junior Tour has no category above U16, so every player using CourtDuo is a child. We ask for a parent's or guardian's confirmation in every case.
You can delete your account yourself, at any time, without asking anyone.

What data we collect

Data you give us yourself

Email address: Logging in (we send a six-digit code instead of a password) and notifications
Your name: To find you on a published ranking list, or — if you are not on one — to let other players find you by name
Your year of birth: Only if you are not on a ranking list. To work out your age category and whether a parent's consent is needed. The year alone, never a full date.
Your country: Only if you are not on a ranking list. To show it beside your name so another player can tell you apart from someone with a similar name.
Parent's or guardian's email address: Only to obtain consent — see below

If you are not on any ranking list, you can still register by typing your own name, year of birth and country. We store what you type so that other players can find you. This information does not come from a federation and is not public.

Data from Tennis Europe and ITF Junior's published ranking lists

first name and surname,
the country a player is listed under,
age category,
gender (which follows from the list a player appears on),
year of birth — the year alone, never a full date,
ranking position.

These data are publicly available from Tennis Europe and ITF Junior independently of CourtDuo. We store them so that you can type a partner's name, and so we can check whether you are both eligible to play in a given age category.

These data do not disappear together with a CourtDuo account, because they are not ours — they come from these federations' public lists.

Records we create from your registration

A player registered with one federation may enter tournaments run by the others. To make that possible, when you register we also create a record for you in each of the other federations we cover.

Where a federation already lists you, we link your account to that published record. Where it does not, we create a new record containing your name and year of birth.

A record of this kind does not come from any public list. It is created by CourtDuo, and it exists only so that another player can find you and invite you to play.

Data created when you use the app

Invitations — who invited whom, to which tournament, and what the answer was. We record the names as they were at the moment the invitation was sent, so the entry still reads correctly if the other person later deletes their account.
Login session — we store only an irreversible hash of the token, never the token itself.
Push notification consent — if you turn them on, we store the technical address your browser receives notifications at. We do not record the device name or phone model.

What we do not collect

Phone numbers — never, for any purpose.
IP addresses. We limit login attempts, but the counter lives only in the server's memory and disappears on every restart. We never write it down.
Location data.
Photographs.
Full dates of birth.

Parent's or guardian's consent

Every CourtDuo account on the Tennis Europe Junior Tour requires a parent's or guardian's confirmation before it becomes active. The Tour has no category above U16, so every player is a child, and we do not treat any of them as old enough to consent on their own.

How it works:

The player gives a parent's or guardian's email address.
We send a message with a link to that address.
The parent or guardian clicks the confirmation button.
The account becomes active.

Until then the player can log in and see a waiting screen, but cannot search for tournaments or send invitations.

We use the parent's email address for this consent only — to send the confirmation request and, if it is ever necessary, to make contact about the child's account. We send nothing else to it.

Consent can be withdrawn at any time by writing to contact@courtduo.app. Withdrawing consent means the child's account is deleted.

Notifications

We send notifications only about things concerning your invitations — for example that someone has invited you, or that someone has answered your invitation. We send no advertising and no newsletter.

Notifications reach you in two ways:

Push notifications, if you turn them on. Because of how browsers work, such a message passes through a service run by the maker of your browser or operating system (Apple, Google or Mozilla) before it reaches your phone.
Email, if push notifications are not enabled or could not be delivered.

You can turn push notifications off at any time in your phone's or browser's settings.

Who we entrust data to

We do not sell data and we do not share it for advertising purposes. We use a small number of technical providers, without which the service could not run:

Hetzner: What for: Application server; Where: Helsinki, Finland (EU)
Neon: What for: Database; Where: Frankfurt, Germany (EU)
Brevo: What for: Sending email; Where: European Union
Cloudflare: What for: Handling the internet address (DNS); Where: —
Apple, Google, Mozilla: What for: Delivering push notifications; Where: depends on the browser

We keep data on servers in the European Union. The exception is push notifications, which by their nature pass through the browser maker's infrastructure.

How long we keep data

Account and email address: Until the player deletes the account
Login code: 15 minutes, single use
Parent's consent link: 7 days, single use
Login session: 400 days from last use
Invitations: Until the tournament they concern has finished
Parent's email address: Together with the child's account
Push notifications: Together with the account
Data copied from published ranking lists: Indefinitely.
Records CourtDuo created, and data you typed when registering: Indefinitely.

Backups. Every night we make a backup of the database and keep it for 30 days. This means that after an account is deleted, its data may still exist in backups for that period before disappearing for good. Backups are used for nothing except restoring the service after a failure.

Deleting your account

You delete the account yourself, on the "My account" page, in two steps. You do not need to ask anyone or give a reason.

After the account is deleted:

Gone: your account, your email address, your parent's email address, your login sessions and your push notification consent.
Pending invitations are cancelled, and the people they concerned are told.
A confirmed pair is not dissolved automatically. Your partner is told that you deleted your account, and decides for themselves whether you are still playing together.
Data copied from published ranking lists does not disappear — it stays on the federations' own sites regardless of CourtDuo. Records CourtDuo created from your registration, and the data you typed when registering, also remain. They are no longer linked to any account and nobody can log in as them.

Your rights

Under the GDPR you have the right to:

access your data,
correct data that is wrong,
have your data deleted,
restrict processing,
object to processing,
have your data transferred.

To exercise any of these rights, write to contact@courtduo.app.

You also have the right to complain to a supervisory authority. You may complain to the data protection authority in the country where you live, where you work, or where you believe a breach took place.

Security

All communication with the service is encrypted (HTTPS).
We do not use passwords — logging in happens through a single-use code sent by email, so there is no password that could leak.
We do not store login or session tokens in readable form, only as an irreversible hash.

Changes to this policy

If we change this policy, we will update the date at the bottom of the page.

Last updated: 14 September 2026