Last updated: June 17, 2026

Dropspot Privacy Policy

This Privacy Policy explains how Dropspot ("Dropspot", "we", "us", or "our") collects, uses, shares, and protects personal information when you use the Dropspot mobile app and related services.

Oleg Bystrov is the controller responsible for your personal information under the EU General Data Protection Regulation (GDPR). We have not appointed a data protection officer, as we are not legally required to. Our competent supervisory authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

This policy is written for Dropspot's current product: a padel app that helps hosts fill last-minute openings and helps players find games in their city.

Information We Collect

We collect information you provide, information generated when you use the app, and limited information from service providers that help the app work.

Account Information

When you sign in, our authentication provider (Supabase Auth) processes account information such as your email address, account identifier, display name, profile image, and sign-in provider details. You sign in using Sign in with Apple or Google; the provider you choose shares basic account information (such as name, email, and profile image) with us through Supabase Auth. If you use Apple's "Hide My Email" option, we receive an Apple private relay email address instead of your personal email address. Dropspot uses this information to create and maintain your app session.

Profile Information

You can provide or update profile information such as your name, city, padel level, profile photo, bio, preferred hand, search status, and onboarding settings. Dropspot also stores reliability and participation signals such as saves, no-shows, games played, attendance confirmations, level feedback, and money-saved counters.

Contact Information You Choose To Add

You may add contact methods such as Telegram username, phone number, Instagram handle, and Playtomic profile URL. These details are hidden from other users until a host approves a player for a game. After approval, relevant host and player contact details are revealed to each other so they can coordinate the match.

Game And Application Information

When you post, apply to, or manage a game, we collect information such as club, city, start time, duration, level range, number of spots, player roster, price, currency, public note, application message, application status, booking link, confirmation note, attendance confirmations, and related notifications.

Photos And Profile Imports

If you choose a profile photo, we upload and store the image you selected. If you use a Playtomic-assisted profile import, we process the Playtomic URL you provide and may retrieve basic, publicly accessible profile details from Playtomic, such as name, photo, and level, so you can review and use them in Dropspot.

Location And Travel-Time Information

Dropspot only requests your device location when you ask the app to calculate travel times to clubs. When you use that feature, your current coordinates are sent to our backend and to Google Routes to calculate travel time and distance. We use the result to sort or display clubs by travel time. We do not use this location feature for advertising, background tracking, or sale of location data.

Notifications And Device Information

If you allow push notifications, we store your Expo push token, device platform, notification records, read status, and notification payloads so we can send updates about relevant games, applications, approvals, and post-game prompts.

Technical Information

Our service providers may process technical information needed to provide, secure, and maintain the service, such as IP address, device and app information, logs, authentication events, and request metadata. Dropspot does not currently use a third-party advertising or product analytics SDK in the app.

How We Use Information

We use personal information to:

• create and manage your account;
• show you relevant openings in your selected city and clubs;
• let hosts post openings and manage applicants;
• let players apply for openings and see application status;
• reveal contact details only after a player is approved;
• send operational push notifications;
• calculate travel times when you request that feature;
• keep the service secure, debug issues, prevent abuse, and enforce app rules;
• maintain reliability signals, attendance records, and game history;
• respond to privacy, support, legal, or safety requests.

We do not sell your personal information. We do not use your personal information for third-party behavioral advertising.

When We Share Information

We share information only as needed to run Dropspot:

• Other Dropspot users may see limited profile and game information, such as your name, profile photo, level, reliability signals, public game details, and contact-service badges. Contact values such as phone number or handles are revealed only to the approved match counterparty.
• After approval, the host and approved player can see each other's saved contact methods. The approved player may also see booking links and confirmation notes.
• We use Supabase Auth for authentication, Apple and Google as sign-in providers, Supabase (hosted in the EU) for database, storage, realtime, and edge functions, Expo/Apple/Google for push notifications, Google Routes for travel-time calculations, and Playtomic when you use Playtomic profile import or open a Playtomic profile.
• We may disclose information if required by law, to protect rights and safety, to investigate abuse, or to respond to valid legal requests.
• If Dropspot is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, with appropriate notice where required.

Data Retention And Deletion

We keep personal information while your account is active or as long as needed to provide Dropspot, maintain game records, resolve disputes, enforce rules, protect safety, or comply with law.

You can delete your account from the app. Account deletion removes your sign-in account and email from our auth provider, deletes push tokens, notifications, subscriptions, pending notification queue entries, active applications, and hosted openings that do not have approved players. For games with approved players, some match records remain so the confirmed counterparties can still coordinate the match. Contact details you had already shared with an approved counterparty stay visible to that counterparty until the game is archived; after that they are no longer shown. Apart from those contact details, your user profile is anonymized where it remains in retained game records.

If you want deletion help or want to make a privacy request outside the app, contact us at hello@padelday.app.

Your Choices

• You can edit your profile and contact methods in the app.
• You can choose whether to grant push notification permission.
• You can turn off push notifications in your device settings.
• You can choose whether to grant location permission.
• You can turn off location permission in your device settings.
• You can delete your account in the app.
• You can contact us to request access, correction, deletion, restriction, objection, or export of your personal information, where those rights apply.

Legal Bases For Users In The EEA, UK, And Similar Regions

Where data protection law requires a legal basis, we process personal information for:

• Contract: to provide the app features you request, including account access, posting games, applying to games, notifications, and contact exchange after approval.
• Consent: for optional device permissions such as push notifications and location access, and for any optional profile information you choose to provide.
• Legitimate interests: to secure the app, prevent abuse, debug issues, maintain reliability signals, and improve core app functionality in ways users reasonably expect.
• Legal obligations: to comply with applicable laws and respond to valid legal requests.

You may have the right to access, correct, delete, restrict, object to processing, request portability, withdraw consent, or complain to your local data protection authority (for us, the Berliner Beauftragte für Datenschutz und Informationsfreiheit).

Automated Decision-Making

We do not make decisions that produce legal effects concerning you, or that similarly significantly affect you, based solely on automated processing. Reliability signals (such as saves, no-shows, and attendance confirmations) are displayed to help users coordinate games, and any account suspension or moderation decision is subject to human review.

California Privacy Note

If California privacy law applies to Dropspot and to your information, you may have rights to know, access, correct, delete, and opt out of sale or sharing of personal information, and to limit certain uses of sensitive personal information. Dropspot does not sell personal information and does not share personal information for cross-context behavioral advertising.

Minors

Dropspot is intended only for people who are 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided personal information to Dropspot, contact us and we will take appropriate steps to delete it.

Security

We use reasonable technical and organizational safeguards designed to protect personal information, including authentication, database access controls, secure transport, and provider security features. No app or internet service can guarantee perfect security.

International Transfers

Our core database, storage, realtime, and backend functions are hosted within the European Union (Supabase). Some of our other service providers — including our authentication provider, the Apple and Google sign-in services, push-notification services, and our travel-time provider — are based in, or process data in, countries outside the European Economic Area (EEA), including the United States. Where we transfer personal information outside the EEA, we rely on a European Commission adequacy decision where one applies, the EU–US Data Privacy Framework where the recipient is certified, and/or the European Commission's Standard Contractual Clauses, together with additional safeguards where appropriate. You can request more information about these safeguards, or a copy of the relevant clauses, by emailing hello@padelday.app.

Changes To This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date and provide additional notice where required.

Contact Us