Privacy Policy
Effective date: 11 November 2026
This Privacy Policy explains how Calum O’Donoghue, trading as Net Rank Builder (“we”, “us”, “our”) collects, uses, shares, and protects personal information when you use the Net Rank Builder application and related services (the “Service”). It applies to club administrators and to individual players/members who use the Service.
1. Information We Collect
We collect the following categories of information, directly from your use of the Service:
a. Account and authentication data
- Email address and password when you register with email/password. Passwords are not stored by us; they are handled by our authentication provider (Google Firebase Authentication).
- Google account identifiers (name, email address, and profile image reference) if you sign in with Google.
- Email verification status and password-reset requests.
b. Profile data you provide
- First name and last name.
- Optional phone number.
- Club selection or, if you create a club, the club name and location.
- Optional TennisID (an identifier you obtain from World Tennis Number), which we use to look up your rating.
c. Tennis and activity data
- Match records (players involved, scores, winners, match dates, ladder/league affiliation).
- Ladder and position/points data, singles and doubles points, matches played and won.
- World Tennis Number (WTN) rating and the timestamp of the last lookup.
- Court bookings (date, time, duration, court, the booking member’s identity, and the names of members included on the booking).
- Social tennis session data and audit history (runner name, participant names, matches played).
d. Club and administration data
- For club administrators: club settings such as court count, booking time slots, and booking-toggle settings.
- Membership counters and role information (e.g., whether you are a club administrator).
e. Subscription and billing data
- Subscription status and plan tier, and identifiers issued by our payment processor (customer and subscription IDs). We do not receive or store your full card number. Payment card details, billing address, name, and phone number provided at checkout are collected and processed directly by Stripe.
f. Technical and locally stored data
- Browser local storage: your theme preference and, during social tennis sessions, session state, pairing history, and audit records stored locally on your device.
- A cookie used to remember the collapsed/expanded state of the navigation sidebar.
- Standard server/network data (such as IP address and request metadata) generated by hosting and infrastructure providers when they deliver the Service.
We do not use advertising, cross-site tracking, or third-party analytics SDKs in the Service.
2. How We Use Your Information
We process your information to:
- Create and manage your account and authenticate you (including email verification and password reset).
- Maintain your player profile and display your club, ladder position, points, match history, and WTN rating within your club.
- Operate core features: ladder rankings and ELO/points calculations, match recording, court booking, and social tennis sessions.
- Provide access controls so data is limited to members of your own club (and to club administrators for club management).
- Retrieve your World Tennis Number from the World Tennis Number service when you supply a TennisID.
- Administer paid club subscriptions: create checkout sessions, process renewals via our payment processor’s webhook, reflect subscription status, and open the billing portal.
- Communicate service-related notices (such as verification and password-reset emails).
- Maintain the security and integrity of the Service and comply with legal obligations.
Legal bases (where required, e.g., GDPR): performance of a contract (providing the Service), your consent (e.g., optional phone number and TennisID), legitimate interests (security, improving the Service), and legal obligation (billing/tax).
3. Data Sharing & Third-Party Services
We share personal information with the following service providers (subprocessors) strictly to operate the Service:
| Provider | Purpose | Data involved |
|---|---|---|
| Google LLC — Firebase Authentication | Identity, sign-in, email verification, password reset, Google Sign-In | Email, password (hashed, handled by provider), Google profile identifiers |
| Google LLC — Cloud Firestore / Google Cloud | Database and infrastructure storing application data | Profile, club, match, booking, session, league, and subscription-status data |
| Stripe, Inc. / Stripe Payments Europe, Ltd. | Payment processing, subscription billing, hosted checkout, customer billing portal, and tax calculation | Payment card details, billing name/address, phone number, customer and subscription identifiers |
| Vercel Inc. | Application hosting and serverless/edge functions | Request/network data; processed data in transit |
| ClubSpark / World Tennis Number (ITF) — worldtennisnumber.com | World Tennis Number lookup | The TennisID you provide; returned player name and WTN rating |
We do not sell your personal information. We may disclose information where required by law or to protect rights and safety, and in connection with a merger, acquisition, or transfer of assets.
4. Data Security & Retention
Security. We rely on industry-standard safeguards, including:
- Authentication and identity management through Firebase Authentication, which hashes passwords and issues short-lived identity tokens.
- Access control enforced by Firestore Security Rules: data is scoped to your own club, users can generally read only their own records (with club administrators able to read records of members in their club), and subscription fields can only be written server-side.
- Financial endpoints (create-checkout, billing-portal) verify the caller’s Firebase ID token and require club-administrator rights; the Stripe webhook verifies Stripe’s cryptographic signature.
- Encryption in transit (HTTPS/TLS) between your browser, our infrastructure, and third-party providers.
No method of transmission or storage is completely secure; we cannot guarantee absolute security.
Retention. We retain personal information for as long as your account is active and as needed to provide the Service, meet legal, tax, and accounting requirements, and resolve disputes. Specifically:
- Locally stored data (theme, social-session state and audit records) remains on your device until you clear your browser storage.
- WTN lookups are cached for approximately 24 hours per the Service’s caching behavior.
- Subscription and billing records are retained by Stripe and by us as required for financial and legal compliance.
- Club removal is handled as a soft removal (membership flags are set rather than records being erased) to preserve match-history integrity.
You may request deletion of your account and associated personal data as described below.
5. User Rights & Choices
Depending on your location, you may have the right to:
- Access the personal information we hold about you.
- Correct inaccurate information (much of it is editable directly in your profile).
- Delete your account and personal data, subject to legal/financial retention obligations.
- Object to or restrict certain processing.
- Data portability of information you provided.
- Withdraw consent (for information processed on that basis) and opt out of optional data such as your phone number or TennisID.
- Lodge a complaint with your local data protection authority.
You can exercise many of these choices in-app (edit your profile, remove optional fields, clear local storage). For other requests, contact us using the details below. We will verify your identity before acting on a request. If you believe a club administrator holds your data, you may contact them or us.
6. Contact Information
Email: netrankbuilder@protonmail.com
Postal address: Calum O’Donoghue, Carrickmacross, Co. Monaghan, Ireland
If you are in the EEA/UK, you may also contact us about data-protection matters at the same email address.