Privacy Policy
Effective July 22, 2026.
1. Who We Are
PicklPass is operated by Blue Sargo Ventures, LLC, a Massachusetts limited liability company. For privacy questions, contact privacy@picklpass.com. Mailing address available on request.
2. Scope and Our Role
This policy covers three data flows:
- Club/operator accounts. PicklPass is the controller of account and billing data we collect from you directly.
- Player accounts. PicklPass is the controller of the profile data players create with us (name, email, credentials, preferences).
- Player roster data uploaded by clubs. PicklPass acts as a processor on behalf of the club, which is the controller. Our Data Processing Addendum governs this processing.
3. Data We Collect
| Category | Examples |
|---|---|
| Account | Name, email, password hash, role, preferences |
| Club / operator | Club details and contacts |
| Player roster | Name, email, phone, DUPR ID, ratings, reliability, attendance, match and standings history |
| SMS program (optional) | Mobile number, consent date and source, disclosure version, delivery status, and opt-out records |
| DUPR-sourced | Ratings and reliability retrieved from DUPR on the club's behalf |
| Google Contacts (optional) | Contact email addresses used for a one-time Find Friends match when you explicitly authorize access |
| Billing | Plan, invoices, billing contact (card data stored by Stripe, not PicklPass) |
| Usage / telemetry | Device, IP, pages, feature use, error and performance logs |
| Cookies | Session, authentication, minimal product analytics |
4. How We Use Data
- Provide, secure, and improve the Service.
- Run screening, leagues, standings, invitations, and score submission.
- Match email hashes from contacts you choose to import against existing PicklPass players.
- Communicate about the Service, billing, and support.
- Send optional account and league text messages after affirmative SMS consent.
- Detect and prevent fraud, abuse, and security incidents.
- Comply with legal obligations and enforce our terms.
5. GDPR Legal Bases
Where GDPR or UK GDPR applies, we rely on: contract (to provide the Service you or your club requested), legitimate interests (to secure and improve the Service and communicate with customers), consent (where required, e.g., certain communications), and legal obligation.
6. How We Share Data
- Service providers. Cloud, email, payment, error-monitoring, and related vendors listed in Section 6a below.
- Your club. Player data flows to the club whose roster you are on. Standings and schedules may be publicly shareable when the club enables it.
- Business transfers. In connection with a merger, financing, or sale of assets, subject to this policy.
- Legal. When required by law or to protect rights, safety, and security.
We do not sell personal information and we do not share personal information for cross-context behavioral advertising.
We do not sell, rent, or share mobile numbers or SMS opt-in data and consent with third parties or affiliates for their marketing or promotional purposes. We disclose mobile numbers only to service providers acting on our behalf to deliver and secure the SMS program, such as Twilio. Those providers may not use the information for their own purposes.
6a. Service Providers (Subprocessors)
We engage the following vendors to deliver the Service. Under our Data Processing Addendum, we give clubs at least 30 days' notice of any new subprocessor by email to the administrator on file, and customers may object on reasonable data-protection grounds.
| Vendor | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Managed Postgres, auth, storage, edge functions | United States |
| Vercel Inc. | Web hosting, serverless functions, edge network | United States (global edge) |
| Stripe, Inc. | Payment processing and subscription billing | United States |
| Resend, Inc. | Transactional email delivery | United States |
| Twilio Inc. | Phone verification and optional transactional SMS delivery | United States (global infrastructure) |
| Universal Rating LLC (DUPR) | Source of pickleball ratings and reliability data | United States |
| Google LLC | Optional Google Sign-In and read-only People API contacts import | United States (global infrastructure) |
| Smartproxy / Decodo UAB | Proxy network used to query the DUPR API | European Union |
| Sentry / Functional Software, Inc. | Error monitoring and performance diagnostics | United States |
7. Player Data Specifics
If you are a player, your club is generally the controller of your roster data. Requests to access, correct, or delete roster data should be directed to your club in the first instance; PicklPass will assist. Where required by law, players may also contact PicklPass directly at privacy@picklpass.com.
8. DUPR Data Flow
PicklPass retrieves DUPR ratings and reliability values on behalf of clubs using the DUPR API. DUPR is the source of truth for ratings, and DUPR's own terms and privacy policy apply to your DUPR account. DUPR is a trademark of DUPR, Inc. PicklPass is an official DUPR integration partner. Your agreement is with PicklPass, not with DUPR, and DUPR is not responsible for PicklPass products or services.
8a. Optional SMS Program
PicklPass sends text messages only after a player actively checks the separate, unchecked-by-default SMS consent box next to the mobile phone field. Messages may include verification codes, registration and payment reminders, score and schedule updates, substitute requests, and similar account or league notifications. Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe or HELP for help. SMS consent is optional and is not a condition of using PicklPass or making a purchase.
We retain an audit record of when and where consent was given and the disclosure version presented. We do not sell or share mobile numbers or SMS consent with third parties for marketing or promotional purposes. A mobile number may be provided to Twilio solely to verify the number and deliver requested PicklPass messages.
8b. Google Contacts and Find Friends
If you choose to import Google contacts, PicklPass requests read-only access to contact email addresses through Google's People API. We use those addresses only for the user-facing Find Friends feature. The import checks whether a contact email matches an existing PicklPass player.
PicklPass converts imported Google contact email addresses into one-way SHA-256 hashes. We do not retain the raw Google contact email addresses, Google access tokens, or Google refresh tokens. We do not use Google contacts data for advertising, sell it, share it with third parties, or display a user's contacts to another user. You can remove imported Google contact hashes at any time from Profile, Connected.
PicklPass's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
9. International Transfers
PicklPass is hosted in the United States. Where personal data of individuals in the EEA, UK, or Switzerland is transferred to the US, we rely on the EU Standard Contractual Clauses (Module 2), the UK International Data Transfer Addendum, and, where applicable, the Swiss addendum, all incorporated through our DPA.
10. Retention
- Account data: for the life of the account plus 90 days.
- Player roster data: until the club deletes it or terminates the account, then 30 days.
- Backups: rolling 30 days.
- Access and security logs: up to 12 months.
- Billing records: up to 7 years for tax and accounting.
11. Security
We use industry-standard measures including transport encryption (TLS), encryption at rest for managed databases, Postgres Row-Level Security, least-privilege access, and hardened deployment on Supabase and Vercel. Payments are handled by Stripe and card details never touch our servers. No system is perfectly secure and we cannot guarantee absolute security.
12. Breach Notification
If we become aware of a personal-data breach affecting your information, we will notify affected customers and, where required, regulators without undue delay and, where GDPR applies, within 72 hours of becoming aware.
13. Your Rights
EEA / UK / Switzerland (GDPR). You may request access, rectification, erasure, restriction, portability, and objection, and you may withdraw consent where processing is based on consent. You may lodge a complaint with your local supervisory authority.
California (CCPA/CPRA). California residents may request to know, access, correct, delete, and limit use of sensitive personal information, and to appeal a denial. We do not sell or share personal information for cross-context behavioral advertising. You may use an authorized agent to submit requests.
Other US states. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, New Jersey, and New Hampshire have similar rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, or certain profiling. You may appeal a denial by replying to our response email.
To exercise any right, email privacy@picklpass.com from the account email.
14. Children and Youth Players
PicklPass is not directed to children under 13. Clubs must not upload roster data about anyone under 13 without verifiable parental consent as required by COPPA and applicable law. If you believe we have collected data from a child under 13 without proper consent, contact privacy@picklpass.com and we will delete it.
15. Cookies
We use strictly necessary cookies for authentication and session management, and a limited set of first-party product analytics and error-monitoring cookies. You can control cookies through your browser; disabling strictly necessary cookies may break sign-in.
16. Changes
We may update this policy. Material changes will be posted here with a new effective date and, where practical, notified by email or in the Service.
17. Contact
Blue Sargo Ventures, LLC. Massachusetts. Mailing address available on request.
Privacy: privacy@picklpass.com · Legal: legal@picklpass.com