Privacy Policy

Information we collect

• Account information — when you sign in with Apple, we receive a basic identifier and, depending on your choices, your name and email. When you sign in with Google, we receive your Google account ID, name and profile photo (see “Google user data” below).
• Profile & play data — your display name, avatar, skill level / rating, and your activity such as sessions joined, check-ins, match results and stats.
• Location — with your permission, approximate device location is used to power the “Near me” filter and distances. You can disable this in your device settings.
• Device & usage data — basic technical information needed to run the app reliably and to send notifications you have enabled.
• Camera & microphone — only while a league organizer is live-streaming a match, and only after they start that stream from inside the app. Video and sound are both captured for as long as the broadcast runs — every broadcast carries sound — and the app asks for camera and microphone access before it opens the camera. Neither is ever captured in the background.

How we use information

• To provide core features: discovery, joining sessions, check-in, the live queue, and fair matchmaking.
• To display your profile, ratings and stats to you and, where relevant, to hosts and other members of clubs you belong to.
• To send you notifications (invites, match status and updates) that you have opted into.
• To operate, secure and improve the Service.

How information is shared

Some information is visible to others by design — for example, your name, avatar and rating are visible to hosts and members of clubs and sessions you take part in. We do not sell your personal information. We share data with service providers (such as cloud hosting and push-notification delivery) only as needed to run the Service, and where required by law.

Advertising

The free PickClub app shows one banner ad at the top of the main screens, served by Google AdMob. To choose, deliver and measure that ad, Google and the advertising partners that bid through AdMob may receive information about your device — such as its advertising identifier (on Android), IP address and the approximate location derived from it, device type, operating system, language and app activity — and may use similar technologies to do so.

• Partners: Google AdMob and the ad exchanges that bid through it (PubMatic, Index Exchange, Magnite, OpenX, Smaato, Sharethrough, InMobi, Verve Group, Equativ, Media.net), and the ad networks that compete for the same banner through AdMob mediation (Pangle, AppLovin, Mintegral, Liftoff). Each handles this data under its own privacy policy; Google's is at https://policies.google.com/technologies/ads.
• We never give advertisers your name, email address, phone number, profile, or match and league history.
• On iPhone, PickClub does not ask for permission to track you, so ads there are not personalised using your activity in other apps.
• On Android, you can reset or delete your advertising ID, or opt out of personalised ads, in Settings → Google → Ads (or Settings → Privacy → Ads).
• When no advertiser bids, the banner shows PickClub's own partner brands instead; no data is sent to anyone for those.
• These advertising partners may process this data outside Vietnam.

Importing players from a photo

A league organizer can add players by uploading a photo of a sign-up sheet, chat or poster. To read the names on it, the photo is sent to OpenAI, an AI service, which returns the names it finds. The app links to this section where the photo is chosen, and nothing is sent unless the organizer chooses one.

• We do not store the photo: it is passed to OpenAI and discarded once the names come back. The organizer reviews the names before any is added, and only the names they keep are saved, as temporary players in that league.
• OpenAI processes the photo under its API terms and privacy policy (https://openai.com/policies/privacy-policy) and does not use data sent through its API to train its models. It may process the photo outside Vietnam.
• Only organizers can use this, and it is optional: players can always be added by typing their names.

Live streaming a match

Organizers of a league can broadcast a match they are running. The video and sound go from the phone straight to YouTube — they do not pass through, and are not stored on, our servers. We keep only a record of the broadcast: which match it belongs to, who started it, its YouTube link, and when it started and ended.

• When every PickClub YouTube lane is busy, a match may be broadcast to a PickClub Facebook Page instead. A live video on a Facebook Page is public on that Page (Facebook has no unlisted option), and the recording stays there, where Meta's own privacy policy and terms apply.
• Only a league's host, a sub-admin or a live-stream assistant they appoint can start a broadcast. Players cannot, and no broadcast starts on its own.
• Anyone on or near the court may appear or be heard in a broadcast. If you would rather not be filmed, tell the organizer before the match — they control whether it is streamed at all.
• Broadcasts are unlisted by default, meaning they do not appear on the channel or in search and are reachable only by link. The app never makes a broadcast public; a host who streams to their own channel can change a video's visibility in YouTube Studio.
• Once a broadcast ends, the video stays on YouTube as a recording, where Google's own privacy policy and terms apply to it.
• To have a recording taken down, email us and tell us which match it was. We can remove a video from our channel.

Shop orders (Vietnam)

In Vietnam, PickClub has a Shop where you can order products. An order is a request — no payment is taken in the app. To place one you give a recipient name, a phone number, a delivery address and, if you like, a note. We store them with the order and the items you chose.

• We use these details only to confirm the order with you, quote delivery, ship it and arrange payment outside the app. Our team may call or message the phone number you gave.
• To quote or deliver an order we may give the recipient's name, phone number and delivery address to a delivery company (such as GHTK or Ahamove). They receive only what is needed to deliver the parcel.
• If you delete your account, the recipient name, phone number, address and note are removed from your orders. What was ordered, the price and the dates are kept as a sales record.

DUPR ratings

Connecting DUPR is optional. When you connect your DUPR account from your profile, you sign in on DUPR's own screen and agree there; we then receive your DUPR ID, your name as DUPR shows it and your doubles and singles ratings. The sign-in credentials DUPR issues are stored encrypted.

• When every player in a match has connected DUPR, we send that match's result to DUPR so it can be rated: the players' DUPR IDs, the score, the date, whether it was singles or doubles, the event name and the location. Corrections and removed results are sent too.
• DUPR's own privacy policy applies to the data DUPR holds.
• You can disconnect DUPR in the app at any time. Nothing more is sent after that; results already sent stay at DUPR.

PickClub on a Garmin watch

The PickClub watch app works on its own: your sessions stay on the watch, and the activity it records goes to your own Garmin Connect account under Garmin's privacy policy. Only if you choose to connect the watch to your PickClub account — by entering the code it shows into the PickClub app — does it send anything to us.

• What it sends: for each session, when it started, how long it lasted, time spent in games, average and maximum heart rate and calories; for each game, when it started, how long it took and the score. Games you played before connecting are sent once you connect. We use them only to show the games in your Matches History and stats.
• Watch games name nobody but you. They are never sent to DUPR and never counted in leagues, social sessions or rankings.
• Nothing is sent in the background: the watch sends only when you save a session or open its History, through your phone's connection.
• Disconnect the watch in the app (Profile → Garmin watch) and it sends nothing more. Deleting your PickClub account deletes these games and sessions.

Google user data

This section explains how PickClub accesses, uses, stores, shares and protects the data we receive from Google (“Google user data”).

• What we access — Google Sign-In: your Google account ID, name and profile photo, used only to create your PickClub account, sign you in, and show your name and photo in the app. We do not keep your Google email address, and we never request access to your Gmail, contacts, files or calendar. YouTube: only if you are a host and choose to connect your channel — see “YouTube API Services” below.
• How we use it — only to provide the user-facing features described in this policy. We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve or train generalized AI or machine-learning models.
• Sharing — we do not share or transfer Google user data to third parties, except the cloud providers that host our servers on our behalf, when required by law, or with your explicit consent.
• Protection — Google user data travels only over encrypted (HTTPS/TLS) connections. The account credentials we store — a connected YouTube channel's token, DUPR sign-in tokens and the stream keys used to broadcast — are also encrypted at rest (AES), with the encryption key kept separately from the database. Our database is not reachable from the public internet, access is limited to our servers and authorised staff, and these credentials are never returned to the app or included in any API response.
• Retention and deletion — we keep it while your account is active. Delete your account in the app (Profile → Settings → Delete Account) or as described at https://pickclub.co/delete-account/: your Google account ID, name and photo, and any connected YouTube credential, are removed immediately. You can also remove PickClub's access to your Google Account at any time at https://myaccount.google.com/permissions.
• Limited Use — PickClub's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

YouTube API Services

PickClub uses YouTube API Services to create, run and end live broadcasts of matches. By using PickClub's live-streaming features you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms). Google's Privacy Policy (https://policies.google.com/privacy) applies to how Google handles that data.

• What we access: to broadcast, PickClub's servers call the YouTube Data API to create a broadcast, bind it to a reusable stream (created once, the first time a channel is used), start it and end it — on the PickClub channel, or on a host's own channel if they connect one — and to read that channel's ID, title and thumbnail.
• Connecting your own channel (hosts): when you choose to connect your YouTube channel, you sign in with Google and grant PickClub permission to manage your YouTube account. We store an access credential (a refresh token) together with your channel's ID, title and thumbnail, and use them only to create and end broadcasts of matches in leagues you host. We never read, change or delete your other videos, comments, playlists or subscriptions.
• We do not sell YouTube data, use it for advertising, or share it with anyone else. Credentials are encrypted at rest on our servers and are never sent to the app.
• Revoking access: disconnect the channel in the app (Profile → Live Stream Settings → Disconnect) — we then delete the stored credential and revoke it at Google immediately. You can also revoke PickClub's access at any time from your Google Account security settings: https://security.google.com/settings/security/permissions.
• Deletion: disconnecting your channel, or deleting your PickClub account, deletes the stored credential and channel details at once. If you revoke access only from Google's settings, we delete the stored credential when we next try to use it and Google refuses it. Records of broadcasts (match, link, start and end time) are kept as described in “Live streaming a match” above.

Facebook Pages

Admins of a Facebook Page can connect it to PickClub so that matches can be broadcast to that Page. Connecting is optional and is done on Facebook's own sign-in screen, where you choose what to allow.

• What we receive: your Facebook account ID and name, the name and ID of each Page you manage and can post to, and an access token for each of those Pages. We do not receive your password, friends, messages, or your personal timeline.
• How we use it: only to create, end and link to live videos of PickClub matches on the Pages you connected, and to show you which Pages are connected. We do not post anything else, read your Page's messages, or use this data for advertising, and we do not sell it or share it with anyone else.
• Protection: Page access tokens are encrypted at rest (AES) with the key kept separately from the database, travel only over encrypted connections, and are never sent to the app or included in any API response.
• Removing access: disconnect in the app (Profile → Live Stream Settings → Disconnect Facebook Pages) and we delete the stored tokens immediately. You can also remove PickClub Live from your Facebook account at any time (Facebook Settings → Business integrations); we then stop using the tokens and delete them when Facebook refuses them. Deleting your PickClub account deletes them as well.
• Data deletion requests: email us, or follow https://pickclub.co/delete-account/. Records of broadcasts (match, link, start and end time) are kept as described in “Live streaming a match” above.

Data retention

We keep your information for as long as your account is active or as needed to provide the Service. You may request deletion of your account and associated personal data by contacting us.

Your choices

• Control location, camera, microphone and notification permissions in your device settings. Refusing camera or microphone access only stops you broadcasting; everything else in the app keeps working.
• Edit your profile details in the app.
• Request access to or deletion of your data, or the removal of a broadcast recording, by emailing us.