Privacy Policy

Last updated: 23 October 2026

This policy explains how Alex Cortés ("we", "us") collects, uses and protects your personal data when you use PadelMates (the "app"): the iPhone and Android app, its Apple Watch and Wear OS apps, and the servers behind them. PadelMates keeps the score of your padel matches, lets you play with friends in rooms, and shows your stats. We handle your data under the EU General Data Protection Regulation (GDPR) and Spanish data-protection law.

1. Who is responsible for your data

The data controller is Alex Cortés, Calle Voluntaria Entrega 7, Vitoria, 01010, Spain. For any privacy question, or to exercise your rights, write to [email protected].

2. The data we collect

Your account

• Your email address. You sign in with a 6-digit code we send to it; there are no passwords.
• The profile you fill in: display name, an optional photo, your playing hand, the wrist you wear your watch on, your language (English or Spanish), and an optional birth year (used only to work out your heart-rate zones).
• Your settings: which notifications you want, and your health and motion choices.
• If you sign in with Apple or Google instead, the data that provider sends us: an account identifier, a verified email address and, if you share it, your name. We don't receive your Apple or Google password.

When you upload a photo we remove its metadata (such as location and camera details) and keep a resized copy.

Friends, rooms and matches

• Your friends and friend requests, the rooms you create or join, and guests you add (people without the app, by the name you give them).
• Your matches: the players, teams, every point and whether it was scored from a watch or a phone, the result, corrections, and when the match was played.
• What we work out from your matches: stats (win rate, streaks, partners and opponents, golden points, tie-breaks), achievements and your place on your friends' leaderboard.
• Your notifications inbox in the app (friend requests, room invites, match starts, corrections, achievements and news from PadelMates).

Health data (only with your consent)

If you agree to the health consent and allow it in your watch's settings, your watch records your heart rate and active energy (calories) during matches and sends them to us after the match. From them we show your average and maximum heart rate, calories, heart rate per point, "clutch points" and, if you gave a birth year, your time in each heart-rate zone. Health data is a special category of personal data under the GDPR, so we process it only with your explicit consent (see section 4).

Motion recordings (only with your consent)

If you agree to the separate motion consent, your watch records its accelerometer and gyroscope during live matches and uploads the recording afterwards, together with your wrist, your playing hand, the watch model and the app version. We keep these recordings to build shot detection in a future version of the app. They are off unless you turn them on.

Devices and technical data

• A push-notification token for each phone or watch you allow notifications on, with its platform.
• An identifier for each watch you pair, so it can keep the score of your match with its own sign-in.
• The app version, and your IP address and request times when the app talks to our servers. We use these to keep the service working and secure, for example to limit repeated sign-in attempts.
• A record of each health or motion consent you give or withdraw (the consent version, the date, the app version and your language).

What we don't collect

PadelMates has no advertising, no analytics or crash-reporting services, and no tracking across other apps or websites. It doesn't use your location, contacts or microphone. The camera is used only to read room QR codes; nothing is recorded or sent to us. The result card you share is made on your phone and goes wherever you choose to send it, not to us.

3. Why we use your data, and on what legal basis

• To provide the app: your account, friends, rooms, live scoring across your devices, stats, achievements, the leaderboard, your inbox and notifications about your account. Legal basis: performing our agreement with you (GDPR art. 6(1)(b)).
• Health figures: to show you your effort and, if you choose, to share it with friends. Legal basis: your explicit consent (art. 9(2)(a) and 6(1)(a)).
• Motion recordings: to develop shot detection. Legal basis: your consent (art. 6(1)(a)).
• Push notifications: sent only if you allow them on your device, and only for the types you keep switched on in Profile › Notifications (art. 6(1)(b)). Occasional news from the PadelMates team can be switched off there too (our legitimate interest in telling players about the app, art. 6(1)(f)).
• Security: to protect accounts, prevent abuse and keep the service running, using logs and rate limits. Legal basis: our legitimate interest in a safe, working service (art. 6(1)(f)).
• Legal obligations: to answer your requests about your rights and to comply with the law (art. 6(1)(c)).

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects, and we don't build profiles for advertising.

4. Your health and motion data

• Each consent is separate, optional and off until you agree. The app works without them.
• Your health figures are private. Your accepted friends see them only if you turn on Share with friends (off by default), and a friend sees a match's figures only if they played in it. Your detailed heart-rate series is never shown to anyone else. Health data never appears on the leaderboard, in your stats for friends, or in notifications.
• Motion recordings are never shown to other players.
• You can withdraw either consent at any time in Profile › Privacy and data. Withdrawing stops recording and deletes that data from our servers right away. You can also delete your motion recordings without withdrawing.
• If the text of a consent changes, we ask you to agree again before collecting more.
• Saving matches to Apple Health or Health Connect is a separate switch, off by default. When you turn it on, the workout is written on your own device; Apple and Google then handle it under their own terms.

5. What other players see

• Players who share a room or a match with you, and your friends, see your display name and photo. They never see your email, birth year or settings.
• Room members and co-players see the matches you play together, including the score and the teams. If you remove a friend, they still see you by name in rooms and matches you shared.
• Your accepted friends see your stats, achievements and leaderboard figures (matches played, win rate and current streak).
• Someone who played a confirmed match with you may see you in their list of people they've played with, and can send you a friend request. Anyone can send a request to your email address, but the app never tells them whether that address has an account.

6. Who we share data with

We don't sell your personal data or share it for advertising. We use these services to run PadelMates:

• Hosting: our servers, database and file storage run on a server we operate ourselves in Spain. Sign-in emails are sent through our own mail server for imaleex.com.
• Cloudflare: our websites and API pass through Cloudflare's network, which protects them and carries the traffic between your device and our server.
• Apple Push Notification service and Google Firebase Cloud Messaging: to deliver notifications to iPhones, Apple Watches and Android devices. They receive your device's push token and the notification (names only, never scores or health data).
• Sign in with Apple and Google Sign-In, only if you choose them: they confirm who you are when you sign in.

Your phone and watch also talk to each other through the operating system (Apple's WatchConnectivity, Google's Wear OS Data Layer). Within our own team, access to account data is limited to administrators, it never includes health or motion data, and every administrative action is logged. We may also disclose data where the law requires it.

7. International transfers

We store your data in the European Union. Apple, Google and Cloudflare may process the data they handle for us (push tokens and notifications, sign-in data, network traffic) outside the European Economic Area, mainly in the United States. Those transfers rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

8. How long we keep your data

• Your account data: for as long as you have an account.
• Health data and motion recordings: until you withdraw the consent, delete the recordings or delete your account. Unfinished motion uploads are deleted after 3 days.
• Your inbox: the newest 200 notifications; older ones are deleted.
• Sign-in codes expire after 15 minutes and are deleted a day later. A signed-in session ends after 90 days without use.
• A data export you request can be downloaded for 24 hours, then it is deleted. Links to motion recordings inside it stop working when those recordings are deleted, and after 7 days at most.
• Server logs are rotated as they fill up; security logs (for example refused requests) are kept for 90 days.
• Backups: our database is backed up every night and each copy is kept for 14 days, so deleted data can remain in a backup for up to 14 days before it disappears for good. Our backup of uploaded files follows deletions at the next nightly run.

9. Your rights

Under the GDPR you have the right to:

• access and portability: in Profile › Privacy and data, choose Download your data to get a file (JSON) with everything we store about you;
• rectification: edit your profile in the app, or ask us;
• erasure: delete your account in the app (see section 10);
• withdraw consent at any time, in Profile › Privacy and data;
• object to or ask us to restrict processing.

You can also write to [email protected] to exercise any right. We answer within one month, and we may ask you to confirm the request from the email address on your account. If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos), www.aepd.es.

10. Deleting your account

In Profile › Privacy and data, choose Delete account and type the confirmation word. Your profile, photo, friends, the rooms you are the last member of, health data, motion recordings, notifications, sessions and exports are deleted at once. Matches you played with other people stay in their history, but you appear there as "Deleted player". If you can't use the app, email us from your account's address and we will do it for you. Deletion cannot be undone; copies in backups disappear within 14 days (section 8).

11. Children

PadelMates is not meant for children under 14, and we don't knowingly collect data from anyone under 14. If you believe a child under 14 has given us personal data, contact us and we will delete it.

12. Guests

A room owner can add a guest by name for someone who doesn't use the app. That guest's name and matches are stored in the room. Guests can claim their history with a link the room owner shares. If you are a guest and want your name removed, write to us.

13. How we protect your data

All connections are encrypted (HTTPS). There are no passwords to steal: sign-in codes are single use and short-lived, and codes and session tokens are stored only in hashed form. Files such as photos and exports sit in private storage reachable only through links that expire. Health data is checked against your consent and sharing choices on every request. Logs leave out email addresses and tokens. No system is perfectly secure, but we work to keep your data safe.

14. Data stored on your device

The app keeps your sign-in in your device's secure storage, plus a few things locally so it works offline: your name and language, and points scored while you had no connection until they are sent. Signing out removes your sign-in and your local match data. This website uses no cookies.

15. Changes to this policy

We may update this policy. We will post the new version here and change the date at the top; we will tell you about important changes in the app.

16. Contact

Questions about this policy or your data: Alex Cortés, [email protected], or by post at Calle Voluntaria Entrega 7, Vitoria, 01010, Spain.