Privacy Policy

1. Introduction

Aldur LLC (“Aldur,” “we,” “our,” or “us”) owns and operates the PlayRez website at playrez.com and the PlayRez mobile application for iOS (collectively, the “Service”). PlayRez is the name of the Service, not a separate legal entity. Aldur LLC is responsible for the information described in this Privacy Policy.

This Privacy Policy explains what information we collect, why we use it, when we disclose it, how long we keep it, and the choices available to you. Aldur LLC is located at 2108 N St Ste N, Sacramento, CA 95816.

2. Information We Collect

Account Information

When you create an account, we collect:

• First and last name
• Email address
• Phone number
• Password (stored securely using bcrypt hashing—we never store plaintext passwords)

Booking & Club Data

When you use the Service, we collect:

• Club memberships and community associations
• Court booking details (date, time, court, status)
• Event sign-ups and attendance records

Tournament Registration Data

When you register for a tournament hosted on PlayRez, we collect the information the organizer's signup form requests, which may include:

• Your name, email address, and phone number
• Skill or rating information (for example, a DUPR rating) if requested
• Partner or team member names and contact details you submit on their behalf
• Registration status, payment status, attendance confirmations, and match results

Payment Information

Payments are processed entirely by Stripe, Inc. We never receive, store, or have access to your full credit card number, debit card number, or bank account details. Stripe may collect payment card information, billing address, and transaction data in accordance with their own Privacy Policy.

Device & Usage Information

We automatically collect certain technical information, including:

• Device type, operating system, and version
• IP address and approximate location (derived from IP)
• Pages or screens viewed, actions taken, and usage patterns
• Browser type, language preferences, referring page, and timestamps (web)
• Cookie identifiers and pseudonymous account or device identifiers used for analytics

We do not intentionally send your name, email address, phone number, or mailing address to Google Analytics or PostHog. PostHog may receive a pseudonymous account identifier, role, plan, and product activity. Identifiers used for server-side product analytics are cryptographically pseudonymized before they are sent. Analytics providers may still receive technical data such as your IP address as part of normal internet communications.

Mobile App–Specific Data

When you use the PlayRez iOS app, we additionally collect or store:

• Authentication tokens: Stored securely in the iOS Keychain on your device to keep you signed in. Tokens expire after 30 days.
• Notification preferences: If you grant permission, we may send push notifications for booking confirmations, reminders, and event updates. You can disable notifications at any time in your device settings.
• App preferences: Onboarding progress and selected club are stored locally on your device.

3. How We Use Your Information

We use your information to:

• Create and manage your account
• Process court bookings, event registrations, and tournament signups
• Run tournaments you enter — including rosters, schedules, brackets, standings, and results
• Facilitate payments between you and your club via Stripe
• Send booking confirmations, cancellation notices, and reminders
• Display club schedules, availability, and event information
• Measure website traffic and understand how features are used
• Improve, maintain, and troubleshoot the Service
• Detect and prevent fraud, abuse, or security incidents
• Comply with legal obligations

4. How We Share Your Information

We do not sell, rent, or trade your personal information. We share information only in the following circumstances:

• Club administrators: Your name, email, phone number, and booking details are visible to the administrators of clubs you join or book with. This is necessary for the Service to function.
• Tournament organizers: If you register for a tournament, your registration details (including partner or team information you submit) are shared with the tournament's organizer so they can run the event. Your name and results may also appear on public tournament pages such as rosters, brackets, schedules, and standings.
• Payment processor (Stripe): Transaction data is shared with Stripe to process payments. Stripe acts as an independent data controller for payment data.
• Infrastructure providers: We use Vercel for hosting and MongoDB Atlas for data storage. These providers process data on our behalf under appropriate data processing agreements.
• Analytics providers: Google Analytics and PostHog receive device, usage, and pseudonymous identifier data to help us measure and improve the Service. We do not use these providers for targeted advertising. Depending on applicable state law, providing online activity data to an analytics provider may be treated as a sale or sharing even when no money changes hands; you can opt out of browser analytics through our Privacy Choices page.
• Legal compliance: We may disclose information if required by law, subpoena, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers: In connection with a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any such change.

5. Data Security

We take the security of your data seriously and implement appropriate safeguards, including:

• All data transmitted between your device and our servers is encrypted using TLS (HTTPS)
• Passwords are hashed using bcrypt before storage
• Authentication tokens are stored in the iOS Keychain (the most secure storage available on the device)
• Payment card data is handled exclusively by Stripe, a PCI-DSS Level 1 certified processor
• Database access is restricted and authenticated

While we implement commercially reasonable security measures, no system is completely secure. We cannot guarantee absolute security of your information.

6. Data Retention

We retain account and service data while your account is active and for as long as reasonably needed to provide the Service, complete requested transactions, maintain security, resolve disputes, and meet legal, tax, accounting, or reporting obligations. When you request account deletion, we delete or de-identify information that we no longer need, subject to those obligations and our backup cycles.

Browser analytics identifiers are configured to remain for up to six months unless you opt out sooner. Short-lived booking cookies expire within seconds or minutes, and authentication cookies generally expire within 30 days. We may retain aggregated or de-identified data that cannot reasonably identify you for longer.

Retention can vary based on the type and sensitivity of the information, the reason we collected it, legal requirements, and the risk of harm from unauthorized use or disclosure.

7. Your Rights & Choices

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal data
• Portability: Receive your data in a structured, machine-readable format
• Opt out: Opt out of the sale or sharing of personal information, targeted advertising, or certain profiling where applicable
• Limit or withdraw consent: Limit certain uses of sensitive personal information or withdraw consent where processing is based on consent
• Appeal: Appeal our decision on a privacy request where applicable

We do not sell personal information for money and do not use personal information for targeted advertising. To opt out of browser analytics, visit Privacy Choices. To exercise another privacy right, contact hello@playrez.com. We may need to verify your identity and will respond within the time required by applicable law. We will not discriminate against you for exercising a privacy right.

When your browser sends a recognized Global Privacy Control signal, we treat it as a request to turn off browser analytics on that browser or device. Because the signal is device- and browser-specific, you may need to enable it separately elsewhere.

Notifications: You can disable push notifications at any time through your device's Settings app. This does not affect your ability to use the Service.

9. Third-Party Services

The Service integrates with the following third-party services, each of which has its own privacy policy:

• Stripe – Payment processing (Privacy Policy)
• Google Analytics – Website analytics unless browser analytics is opted out (Privacy Policy)
• PostHog – Product analytics unless browser analytics is opted out (Privacy Policy)
• Sentry – Server-side error monitoring when enabled (Privacy Policy)
• Google Fonts and CDNFonts – Web-font delivery (Google Privacy Policy)
• Vercel – Web and API hosting (Privacy Policy)
• MongoDB Atlas – Database hosting (Privacy Policy)

10. Children's Privacy

The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete it promptly. If you believe a child under 13 has provided us with their information, please contact us at hello@playrez.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated policy on this page, update the effective date above, and provide any additional notice required by applicable law.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: