Privacy Policy

Tennis For Life ("TFL") is a service of HonestTech Services LLC, a Delaware limited liability company with a registered address at 8 The Green, Suite B, Dover, DE 19901, United States ("HonestTech", "we", "us").

This Privacy Policy describes how we collect, use, share, and protect information about you when you use our website, mobile app, and related services (the "Service"). TFL is operated from and intended for users in the United States.

1. Information we collect

1.1 Information you give us

• Account info — name, username, email address, mobile phone number, home ZIP code and state, and password (stored only as a salted hash, never in plain text). Your email and phone are each verified with a one-time PIN before your account is active.
• Player profiles — for each player you manage: name, date of birth, gender (optional), home court, profile photo if you upload one, and the tennis zones the player joins. TFL computes its own per-zone rating and class level for each player from reported match results; we do not collect external ratings from players.
• Contact book — additional email addresses and phone numbers you add for notification routing. Each is PIN-verified before we will send anything to it.
• Pro details — for Pros: business name, credentials and certification details you choose to list (e.g., a coaching certification or NTRP-related credential), lesson listings, and demo video links.
• Payment method — card details are entered directly with Stripe, our payment processor; the full card number never touches our servers. We store a Stripe payment-method reference plus card brand, last four digits, expiration, and a Stripe card fingerprint (a token we use to detect duplicate cards and free-trial abuse).
• Communications & content — messages you send through the platform, support tickets, community posts and replies, reviews, reported match scores, and incident reports.
• Consents — your email/SMS/push preferences per category (critical, activity, marketing), with a change history.
• Shipping address — only if you claim a physical reward (e.g., a trophy or t-shirt program), to fulfill the shipment.
• Referral invites — if you use refer-a-friend, the email address or phone number of the person you invite. We use it only to send the invitation; you must have their permission to share it.

1.2 Information from visitors without an account

• Contact form — if you use our public contact form, we collect your name, email address, optional phone number, and your message, stored as a support ticket so we can reply.
• Guest lesson inquiries — if you send an inquiry to a coach from a public lesson listing without an account, we collect your name, email, optional phone, and message, and forward them to that coach so they can respond to you.
• Referral invitations — if a member invites you, we hold your email address or phone number to deliver the invitation.

1.3 Location information

Location on TFL is on-demand only. If you choose to share your device location (or enter a ZIP code) to find nearby courts, coaches, or tournaments, we use it once, rounded to roughly city-block precision, as a search parameter — we do not store your coordinates on our servers and we do not track your location in the background. Your last choice is remembered only on your own device (see our Cookie Policy). On public discovery pages we may use the approximate region suggested by our hosting provider from your IP address, again only transiently, to show nearby results.

1.4 Information we collect automatically

• Security & log data — IP address and basic request data for sign-ins, failed sign-in attempts, and consent changes (which record IP address and browser user-agent for the audit trail). We keep a login history for your account.
• Cookies & device storage — a small set of first-party cookies and browser-storage keys; see our Cookie Policy for the complete list. We do not run usage-analytics or advertising trackers.
• Push subscriptions— if you enable web push, the subscription endpoint and keys provided by your browser's push gateway (FCM / Apple / Mozilla).
• Error reports — front-end exceptions and stack traces, with the requested URL and your user identifier, sent to our internal error log.
• Notification log — a record of the notifications we sent you, with read state, powering your in-app inbox.

1.5 Information from third parties

• Payments — Stripe shares the payment-method metadata described in Section 1.1 and the status of charges, refunds, and payouts.
• Email/SMS delivery — SendGrid and Twilio share delivery and bounce events tied to your account so we can troubleshoot notifications.

We do not use federated sign-in (e.g., "Sign in with Google"), and no third-party login provider shares data with us.

2. How we use your information

• Match you with opponents, coaches, partners, and tournaments in your zones
• Send transactional notifications (match scheduled, score reported, lesson booking confirmed) via email, SMS, or push per your consent settings
• Compute TFL ratings, rankings, class levels, and statistics from match results
• Bill subscriptions, process entry fees and lesson payments, and resolve payment disputes and refund requests
• Detect abuse, fraud, free-trial misuse, brute-force sign-in attempts, and policy violations
• Respond to support requests, reports, and incident reports
• Comply with legal obligations and respond to lawful requests
• Produce aggregate, de-identified statistics about the Service

3. How we share information

• With other TFL members — your player profile fields shown in the product (name, photo, age group, zone presence, rating/class), published match results, posts, and reviews you write.
• With service providers — Stripe (payments), SendGrid (email), Twilio (SMS), browser push gateways (FCM/Apple/Mozilla), and our cloud hosting and database infrastructure. Each processes data only to provide its service to us.
• With Pros you contact or book — when you book a lesson, enroll in a class, join a club, or send a lesson inquiry (with or without an account), your name, contact info, and the details of your request are shared with that Pro so they can deliver the service.
• In aggregate / de-identified form— anonymous statistics that can't reasonably be tied to you.
• In response to legal process — court orders, subpoenas, or to protect rights, safety, or property.
• In a corporate transaction — merger, acquisition, or sale of assets, subject to standard confidentiality protections.

We do not sell your personal information. We do not share personal information with third-party advertisers for cross-context behavioral advertising.

4. Your rights & controls

4.1 All users

• Access & correction — edit your account and player details from your account and player pages.
• Export— download a machine-readable copy of your data (profile, players, zones, billing, posts, login history, match history) from Account → Security → "Export my data".
• Deletion— request account deletion from Account → Security. Deletion runs on a 30-day grace period during which you can change your mind; after that, your personal information is permanently removed or irreversibly de-identified. Match results remain in anonymized form to preserve the integrity of other players' ratings and rankings (see Section 5).
• Communication preferences — control activity and marketing email/SMS per category from your notification settings; for device-level choices see our Cookie Policy.

4.2 California (CCPA/CPRA)

California residents have the right to:

• Know what personal information we collect, use, share, and sell (we do not sell)
• Delete personal information we hold about you
• Correct inaccurate personal information
• Limit the use of sensitive personal information
• Opt out of sharing for cross-context behavioral advertising (we do not engage in this)
• Not be discriminated against for exercising these rights

To exercise these rights, email [email protected]or use the controls in Account → Security. You may designate an authorized agent to make a request on your behalf. We will verify your identity before acting on a request.

Shine the Light (CA Civ. Code § 1798.83). California residents may request a list of categories of personal information we shared with third parties for direct-marketing purposes in the prior calendar year. We do not share for third-party direct marketing.

4.3 Other US state privacy laws

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other states with comprehensive privacy laws have rights similar to those listed above, including access, deletion, correction, and opt-out of targeted advertising and sale. To exercise these rights, email [email protected].

5. Data retention

We retain account data for as long as your account is active and for a period afterward for legal, tax, and dispute-resolution purposes. Specifically:

• Account & profile: permanently removed or irreversibly de-identified 30 days after a deletion request (the grace period during which you can cancel the request).
• Billing records: retained 7 years for tax and accounting compliance.
• Match results & rankings: retained indefinitely; after account deletion they persist only in anonymized form, to preserve ranking integrity for other players.
• Community posts: deleted on request; quoted excerpts in replies may persist.
• Support tickets, security logs & error logs: retained as long as reasonably needed for support, security, and abuse prevention, then deleted or de-identified.

6. Security

We use industry-standard safeguards, including TLS encryption in transit, salted and iterated password hashing (PBKDF2), one-time-PIN verification of email addresses and phone numbers, automatic temporary IP blocking after repeated failed sign-in or PIN attempts, rate limiting on sensitive endpoints, and internal access controls. Card payments are handled by Stripe; full card numbers never reach our systems. No system is perfectly secure; please choose a strong, unique password.

7. Children (COPPA)

TFL accounts are for adults (18+). Players under 18 ("Juniors") may only be registered as player profiles by a parent or legal guardian, who manages the Junior's information and consents to our processing of it. Juniors have no accounts, logins, or private messaging on TFL — all communication goes through the managing adult's account. We follow the US Children's Online Privacy Protection Act (COPPA) for Juniors under 13. Parents may review, delete, or refuse further collection of their child's information from their own account or by contacting [email protected].

8. Do Not Track

Our Service does not respond to Do Not Track ("DNT") browser signals, because there is no industry-standard interpretation of the signal. We also do not run cross-site tracking of any kind — see our Cookie Policy for exactly what we set on your device.

9. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or an in-app notice at least 14 days before they take effect, and the "Last updated" date above will change.

10. Contact

Privacy questions or requests: [email protected].