Privacy Policy

Last updated 20 October 2026

1. Background

We recognise the importance of protecting your privacy and safeguarding your personal information.

This Privacy Policy explains how Alexander Lucas Westcott, trading as KourtUp (ABN 28 939 608 758), handles personal information ("we", "us" or "our"). It applies to our website at kourtup.com, our KourtUp mobile app and related account, support and app-opening pages, including app.kourtup.com (Services). The app-opening pages are not a browser version of the tennis app.

Our Services are intended for use within Australia only. We aim to comply with all relevant privacy laws, including the requirements applicable to us under the Australian Privacy Act 1988 (Privacy Act) and relevant Australian State laws and various jurisdiction-specific privacy laws that apply to us.

2. Our Privacy Policy

Our Privacy Policy sets out how we look after personal information. It explains the kinds of personal information we collect and why we collect it. It also describes how we hold, use, and disclose personal information.

This Privacy Policy applies to everyone who interacts with our business and Services.

This policy explains our data practices; reading it or using the Services does not replace any separate consent or device permission required for a feature. We explain optional access when you enable it. You can withdraw an optional permission in your device or connected-service settings, disconnect a calendar in KourtUp, or contact us using the details below. Withdrawing access may prevent the related feature from working.

We may need to know certain information about our users for specific reasons. Wherever possible, we maintain the anonymity of our users.

3. Third party sites

This Privacy Policy does not apply to websites, platforms, services or apps that we do not operate, such as linked third party websites and booking platforms (Third Party Sites). Those Third Party Site owners are responsible for the privacy of the information they collect and should be contacted directly for details of their privacy policies.

If we link to or refer you to a Third Party Site, we are not making any representations to you regarding the privacy or security of your personal information when collected or held by the other site. The privacy practices applicable to other Third Party Sites may differ substantially from ours. You should read the privacy policy of any other Third Party Sites you visit before using them. We do not accept responsibility for the content or practices of Third Party Sites that are linked from our Services.

4. What personal information do we collect?

We collect information needed to provide the Services when you register, create or manage a player profile, arrange tennis, communicate, or enable an optional feature. A parent may provide information about a child they are authorised to represent. This policy covers that child information even though the child has no login.

We also collect information where we are required to do so by law.

The types of personal information we collect depends on the circumstances in which the information is collected.

Depending on the features you use, this information includes:

Your name
Account-holder contact details, such as your email address
Your profile photo and images you choose to upload where image sharing is allowed. Parent-managed child profiles use initials rather than child photos
Information that you include in any online profile you create on our Services, which may include your home suburb, skill level (including any UTR rating, UTR profile link or screenshot you choose to provide), gender and handedness (used for match filters), playing preferences and bio
Your playing suburb or area and its coordinates, and device location when you give permission. Depending on device settings, that location may be precise. We do not ask for a residential street address
In-app chat messages, attachments and conversation membership, including the parent sending a message and the child players they represent
Device push notification tokens, where you enable notifications, so we can send you alerts about beacons and matches
Information regarding your use of our products or services (including submission of content, beacons you light, matches you arrange, messages you send, and reports or blocks you submit)
Information regarding your use of our Services including interactions you undertake on our Services and information that you provide to us via our Services, including reporting any issues, or reporting or blocking another user
Records of communications and dealings with you, such as emails and in-app messages, including information that you provide to us in those communications
Private dates of birth for age eligibility; child first name, surname, gender, playing level, handedness and playing area; family ownership, authority declarations, verification status and records of account handover
Information we may collect as part of a survey or customer feedback request
Event responses, confirmed places and attendance, noticeboard posts, comments and reactions, identifiable event feedback, confirmed tennis activity, court history and eligible leaderboard totals
In-app connections, such as follows, approvals, vouches and the players you arrange tennis with. We do not import your phone address book
Optional calendar data: available calendar names and identifiers, the appointments you choose to display, authorization tokens for Google connections, and identifiers linking confirmed hits to calendar events

We also collect information about people who are our suppliers and business partners, or who are employed by our suppliers and business partners. The information we collect is that which we need to do business with that party.

5. Sensitive Information

We do not seek to collect sensitive information. Sensitive information includes information about your health, racial or ethnic origin, religious beliefs and criminal record. (Sensitive information is defined in section 6 of the Australian Privacy Act 1988).

If we do have to collect sensitive information, we will do so in accordance with all relevant laws. We will only collect sensitive information about you with your consent and where it is reasonably necessary for us to do so, or if we are otherwise allowed or required by law to collect that information.

Please do not send identity documents, biometric information or other sensitive information through chat or support email. Any identity-check service must explain the information it needs and obtain any required consent separately before collection; a general acceptance of this policy is not consent to a biometric check.

6. Additional information regarding collection when using our Services or communications

When using our Services, we and our technology partners process the request, usage and technical information needed to run the features and measurement described here. Some information is linked to an account or app instance. This includes:

requests needed to display profiles, search for players or courts and arrange tennis; searches are sent to our server to return results. This does not mean that every search is saved as a personal search-history record
technical device information, such as device model, operating system, app version, time zone and app-instance identifiers; crash reports and limited performance diagnostics where enabled
server log information, such as details of how you used the service, IP address, hardware settings, browser type, browser language, the date and time of your use and referral URL
information that may uniquely identify your browser or your account, and other online identifiers
authentication information needed to sign in, handled by our authentication service; we do not make passwords available to other players
location used for maps and matching as described in section 11.

We also collect some statistical information about visitors to our Services (for example, the number of visitors, pages viewed, types of transactions conducted, content viewed and time online), but this is not personal information because we may not know who the visitor is (where they are not using a Service account) or because we may aggregate this information so that no person can be identified from the statistical information.

We may use publicly available sources to approximate your geographic region and Internet Service Provider based on your IP address. We use various technologies to collect and store information, including cookies, pixel tags, tracking tags, and local storage such as browser web storage or application data caches, databases, and server logs. These technologies help us track your usage and remember your preferences.

Our website uses Meta Pixel for page-view and advertising measurement as described under Service providers. Our mobile app uses the separate Meta App Events integration described there. We do not use session replay or record everything you type into the app.

You may refuse the use of cookies by selecting the appropriate settings on your browser. However if you do, you may not be able to use the full functionality of our websites.

Some public web pages may be viewable without signing in. Core app features require an account. If we offer a guest or preview mode, information entered before account creation may be stored locally on the user's device until it is submitted or the user signs in.

7. How we collect Personal Information

We collect personal information in several ways, including:

directly from you, or from a parent or authorised guardian setting up and managing a child player profile
when you create or update an account or player profile, confirm your email, make a parent authority declaration, complete handover, or authorise calendar access
when you complete an entry form for a competition or participate in a survey
when you email, text or telephone us, engage in live chat or when you share information with us from other social applications, services and websites
when you interact with our websites, online content and advertising, including when you upload content
using technology to deduce information about you, such as demographic information
if you are or work for a supplier or business partner of ours, or a potential supplier or business partner, as part of business dealings with you

If you choose not to provide us with information, we may be unable to supply products or services to you or we may not be able to provide you with products, services or information that is relevant to you.

8. Use and Disclosure of Personal Information

We may use and disclose your personal information for the following purposes:

to provide our products and Services to you
to identify you and to assist you to obtain and use our products and Services
to administer accounts and family permissions, check the age information and parent declaration you provide, apply privacy and contact rules, and retain playing history when an eligible child moves to their own account
to provide you with information and advertising that we think may be of interest to you
to respond to inquiries from you
to facilitate transactions for you
to review your dealings with us, including the products and Services you use, your potential needs, and new products that might be of interest to you or other users
to improve our websites, app, products and services
to administer surveys, contests and promotional activities or events sponsored or managed by us or our business partners
to create reports for our management and business partners
to carry out consumer, market, community and product research, compile demographics, to analyse data and to deduce information
to respond to reports lodged through our Services and other complaints
to comply with our legal and regulatory obligations
to gain an understanding of your needs to provide you with or to recommend to you better and more personalised products tailored to your requirements
to help preserve the personal safety and security of our customers, users, staff and the public
to monitor and detect possible fraud or breaches of our terms and conditions relating to our Services
as otherwise required or authorised by law

We may also use personal information for purposes as would be reasonably expected by you in connection with those activities described above.

9. Direct Marketing and Opt Out

If you join the Kourtup waitlist, we will use your email address to send you essential waitlist, launch and early-access communications. The waitlist form explains this before you join. You may separately choose to receive occasional Kourtup news, tennis community updates and offers by selecting the optional newsletter checkbox or by using a form clearly labelled as a newsletter signup.

We will not treat joining the waitlist by itself as consent to unrelated or ongoing newsletter marketing. Should you no longer wish to receive waitlist or marketing communications, you may unsubscribe or opt out:

by following the link or instructions in the communication
by changing the communication preference settings for your account via the app
by changing settings on your device, such privacy settings or push notification settings

If you unsubscribe from marketing communications, this will not stop you receiving service-related communications from us in relation to your account if we are otherwise legally entitled to send them to you.

10. Disclosure of Personal Information

We only disclose personal information for a purpose for which it was collected, or for a secondary purpose in circumstances permitted by law. This includes where you consent to us disclosing your personal information. You can give us your consent expressly or your consent may be implied.

We may disclose your personal information:

to eligible other players to arrange tennis, according to profile and contact permissions. For a parent-managed child this includes first name and surname initial, age group (4–8, 9–12 or 13–15), Child label and parent/guardian details, tennis details, aggregate Court Activity, and the arranging parent’s name and profile image. Full birth dates, full child surnames, private contacts and verification records are not part of that public profile
to any organisation where you request us to do so, including those that interact with our Services
to insurance companies
to a court or tribunal
to anyone who acquires or is considering acquiring our assets or business (or part of it)
to a person who serves us with a subpoena or other legal document requiring us by law to disclose information or documents about you to them
to our consultants, contractors, subcontractors, suppliers, service providers and professional advisors, who assist us in operating our business including IT service providers
to government agencies, regulators and law enforcement bodies
to other organisations where necessary or reasonable to do so in relation to the operation of our business.

Service providers we rely on

To run the Services we use a small number of trusted third party providers. We only share the personal information each provider needs to perform its function, and each is bound by its own privacy and security obligations. Our key providers are:

Supabase - our database, authentication and file storage. Your account data, profile, in-app chat messages and uploaded images are stored here. We host our Supabase project in the Australian region (Sydney, ap-southeast-2), so this data is held in Australia.
Google Maps Platform / Places API - powers maps and court information. Google processes map and search requests, technical request information and the area or location needed to return results; location may be precise when you allow it. Google’s privacy policy is at https://policies.google.com/privacy. Use of Google Maps features is also subject to the Google Maps/Google Earth Additional Terms at https://www.google.com/help/terms_maps/.
Resend - sends our transactional and account emails, waitlist and launch updates, and optional marketing emails to your email address in accordance with your communication choices.
Vercel - hosts our website, app-opening and account-related web pages and processes standard server and request logs.
Expo push notification service, Apple Push Notification service and Google Firebase Cloud Messaging - deliver notifications to your device. Delivery uses push tokens and notification content, which can include names, message previews and identifiers or links for the relevant player, hit or event. These providers may process delivery data outside Australia, including in the United States. Your device settings control lock-screen previews. In-app notification preferences, device permissions, signing out and token cleanup are separate controls; switching off a category does not by itself mean its device token has been deleted.
Google Calendar / Apple and other device calendars - optional calendar access described in section 13b. Google processes calendar requests through its API; device calendar access is controlled by the operating system and the calendar accounts you enable.
Sentry - where enabled, receives crash and limited performance diagnostics to help us find and fix faults. Default personal-information collection, session replay and diagnostic logging are disabled in our configuration; error context can still contain technical information.

Parent setup uses email confirmation, a supplied birthday and an authority declaration. It does not use a phone, identity-document or biometric verification provider, and does not independently verify identity or legal guardianship.

Meta (Facebook) App Events - in our mobile app, measures app installs, launches, account creation and completed registration to help us understand app usage and the effectiveness of Kourtup advertising. Meta receives these events, the registration method, an app-instance identifier and technical device and network information. We do not send your profile, email address, chat messages or photos as part of these events. Advertising identifier collection is disabled. Our iOS app does not request permission for cross-app tracking and does not enable advertiser tracking. These restrictions do not prevent collection of the limited event and technical data described here. Meta may process this information outside Australia. For information about Meta's processing and privacy choices, visit https://www.facebook.com/privacy/policy/.
Meta Pixel - on our website, sends page-view events and associated page URL, browser, cookie and network information to Meta to measure visits and advertising effectiveness. Meta may associate these events with information it holds and process them outside Australia, including in the United States. You can manage cookies in your browser and advertising preferences with Meta. This website integration is separate from mobile App Events; KourtUp does not send calendar appointment details, child-profile records or private chat content to Meta for advertising.

Some providers or their sub-processors may process data outside Australia, including in the United States. Australian hosting of the core database does not mean every provider processes all data in Australia. We require appropriate privacy and security protections from service providers and take reasonable steps to protect overseas disclosures in accordance with obligations that apply to us.

10a. Community events and tennis activity

The event host can see responses and manage places and attendance. For events with a visible Players list, expressing interest makes your name, tennis rating and interest or confirmation status visible to eligible signed-in adult players viewing that event, even if they have not responded. Your photo remains subject to profile permissions and blocking. Withdrawn or declined responses are not listed, and a provisional host selection is not shown as a confirmed place. Events without a visible interest list do not expose all responses to other viewers.

Event noticeboard posts, comments and reactions are available to the host and confirmed attendees, subject to access controls and blocking. Feedback is identifiable to its submitter and the host, and is not anonymous or published to other attendees. KourtUp may access event records when needed to operate the Services or handle a safety report.

When the host records that you attended, that attendance can count towards your tennis history and eligible leaderboard totals without another confirmation from you. Ordinary hits use their own participant-confirmation flow. Profile privacy and age restrictions still apply: under-16 players do not appear on leaderboards, and independent 16–17-year-olds have a separate opt-in. Contact the host or KourtUp support about incorrect attendance or records.

11. Location data

KourtUp uses location to find nearby courts and players and help arrange tennis. You can select a playing area manually or allow location access while using the app.

We store coordinates for your chosen playing area. If you allow device location, it may be precise depending on your permission settings and is used for the feature you request, such as centring a map or finding courts. We do not continuously track your location in the background.

Profiles display a general playing area rather than private home coordinates. Publishing a Beacon or confirming a hit shares its court or chosen playing location and time with the audience or participants for that activity. Do not use a private home address as a public tennis location.

You can turn off location permission in your device settings and use manual area selection. Google Maps processes the request information needed to supply maps and court results.

12. Security and Storage of Personal Information

We use access controls on accounts, player records, verification records and private storage, and encrypted transport, to protect against unauthorised access, loss, modification and disclosure. Backend checks restrict who can operate a child profile. Chat is access-controlled, not end-to-end encrypted; authorised service personnel may access information where necessary to operate the service, investigate abuse or comply with law.

We take measures to enhance the security of our Services. If you are a user who has an account with us, it is important for you to protect against unauthorised access to your password and to your computer. You should have a unique and complex password and make sure to regularly update your operating system. You must not disclose your password to others.

We cannot guarantee the total security of any data transmission over the Internet.

Although due care is taken, we cannot guarantee the security of information provided to us via electronic means or stored electronically. No security measures are perfect, and we cannot promise to be able to withstand security threats in all circumstances.

Personal information is only retained for as long as is necessary or as required by law.

You can delete your account in KourtUp Settings, or request account or child-profile deletion without reinstalling the app by emailing alex@kourtup.com. Use the subject “KourtUp account deletion” and identify the account email; do not send your password or identity documents. We may need to verify your control of the account. Deletion ends sign-in permanently; logging in does not reactivate it. We remove private account data and uploaded media through our deletion process, anonymise associated player records, and stop new contact. Limited shared hit or conversation records, reports and audit evidence may remain where necessary for the other participants, safety, disputes, fraud prevention or legal obligations. We do not keep identifiable information indefinitely merely because it is useful.

Uninstalling the app or signing out does not delete your account. We assess requests to delete particular information against the same shared-record, safety and legal-retention exceptions, and explain any information we need to retain.

We use secure methods to destroy or de-identify any personal information, provided the information is no longer needed by us for any purpose and doing so is not prohibited by law.

Chat and playing records remain available while needed for active accounts and tennis arrangements. Deleting an account removes or de-identifies its private information; shared records and safety evidence follow the exceptions above. Push tokens, verification requests and calendar credentials are removed through the relevant account-cleanup processes. Backup copies may persist until their normal expiry and are protected against routine access. We destroy or de-identify information when its purpose and any required retention have ended.

13. Independent junior accounts (16–17)

Independent accounts are available from age 16. We collect a private date of birth before registration to apply age rules; a self-reported age is not verified identity. Children under 16 cannot create an independent login. Contact us if an age is incorrect or a child has signed up independently.

Accounts aged 16–17 must remain private until age 18, and leaderboard visibility starts off with an optional opt-in in Privacy and Safety. Eligible signed-in players, including adults, can discover the Junior label, tennis details and aggregate Court Activity and request to follow a junior. Junior profile photos are restricted to approved mutual friends and confirmed-hit participants. Following requires approval; ordinary direct messaging involving an independent junior requires mutual approved following. A junior can also send one message request to a child’s adult parent before following; the parent must accept before chat opens. This does not let adults initiate unapproved requests to juniors. Confirmed-hit participants can use their hit chat. Invitations and public Beacon responses can occur before friendship.

New image uploads are disabled for everyone in a direct or group conversation if an independent 16–17-year-old has access. Existing images may remain readable. Confirmed mixed adult–junior tennis lineups show a brief Hit safety strip, not a consent or guardianship check. At 18, the player reviews their settings; privacy choices do not silently become public. Blocking prevents new prohibited contact but cannot recall information already seen or saved.

13a. Parent-managed child profiles (4–15)

Where parent-managed setup is available, an adult parent or authorised guardian owns the account and supplies their own email and profile photo. They can manage several child player profiles and optionally play themselves. Children aged 4–15 have no separate login, verification email or direct access to conversations. The parent handles requests, messages, notifications and tennis arrangements.

Parents provide each child’s first name, surname, private date of birth, gender, playing level, hand and playing area. We use these to check eligibility, find suitable tennis partners, arrange hits and keep each child’s playing history. Eligible signed-in players can see first name and surname initial, age group (4–8, 9–12 or 13–15), Child label and parent/guardian details, tennis details and aggregate Court Activity, plus the arranging parent’s name and photo. Child photos are not required or used for these profiles. Child profiles are not offered for anonymous public discovery, and under-16 players do not appear on leaderboards.

Parent setup requires email confirmation and an adult authority declaration. We check the supplied birthday for adult eligibility. Parent setup does not collect a phone number or require SMS confirmation. No separate identity-document check is required. We retain the wording, version and time of the declaration; historic verification records, if any, remain access-controlled and subject to our retention rules. The declaration is the adult’s statement of their age and authority, not verified proof of identity, the child’s existence or a legal relationship. Child profiles remain drafts until required setup is completed. The current KourtUp setup does not accept or store raw identity documents or biometric templates. Any future provider collection must be explained before a check.

Private birth dates, full child surnames, parent contact details, verification records and private playing-area coordinates are protected by backend permissions. The parent’s ordinary profile photo is publicly addressable, while restricted junior photos and chat attachments use private storage and access checks. A parent acts as the account holder in chat and the interface identifies the children they represent. Images can be shared when everyone with chat access is an adult, including parent-to-parent conversations; independent junior access disables new images for everyone.

A family block applies across the parent’s and managed children’s contact paths. Reports identify the reporting parent and affected player or hit. A parent can request access, correction or deletion of a child’s information using the contact details below. Deleting the parent account anonymises the child profiles still owned by that account and ends their use; a profile already handed over to an independent account is not deleted with the former parent account.

From age 16, an explicit handover to the young person’s own verified login can retain the same player identity, history, connections and future hits. The parent’s private conversations, login credentials and calendar authorisations do not transfer. Future notifications and calendar responsibility follow the new account; existing calendar copies may need to be removed. All delegated parent access ends when handover completes, including access to private lists and managing future tennis. The parent retains their own account and other child profiles. Disputed guardian authority is reviewed manually through KourtUp support; there is no automatic ownership transfer. A birthday or edited birth date alone does not transfer ownership.

13b. Optional calendar connections

Calendar linking is optional. KourtUp reads available calendar names and identifiers so you can choose a destination for confirmed tennis hits and which calendars to display. It accesses event titles, dates and times, and available location details for appointments you choose to show. Personal appointments appear only in your calendar view, remain non-interactive, and do not enter tennis Upcoming or become visible to other KourtUp players.

Google Calendar access goes through our server to retrieve the calendar list and selected appointments and to create, update or cancel KourtUp hit events. We store encrypted authorisation tokens, selected calendar identifiers and names, sync status, and mappings and event-body copies used to detect changes to the tennis events we create. Personal appointments are returned to your app for display, not saved as appointment records in our database. Google permission may allow access to events across your calendars; KourtUp uses the calendars you select and changes only events it manages.

Apple and other device calendars use the permission granted on your phone. Their appointment data is read on the device; KourtUp does not upload those personal appointments to its server. Device-calendar hit updates run while KourtUp is used. Google server sync can update confirmed hits while the app is closed once the server integration is enabled.

Parents can sync confirmed child hits to their selected calendar; events include the child’s name, time, court and a link to the hit. A shared sibling hit uses one event containing both names. People who already have access to that external calendar may see these details under its sharing settings.

Disconnecting Google revokes the connection and deletes our stored connection credentials and identifiers. You can also revoke KourtUp access in your Google Account. Device permissions can be removed in phone settings. Disconnecting stops future access and updates but may leave calendar entries previously written; remove those in your calendar app. Deleting your KourtUp account does not delete your unrelated calendar events.

KourtUp’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar data is used only for the calendar features described here, not sold or used for advertising, profiling or model training. Human access is limited to your specific permission, necessary security or legal investigations, or other access permitted by that policy. Google, Apple and your calendar provider have their own privacy policies.

14. Amendment of this policy

We may amend this policy from time to time. If we do, we will update the Privacy Policy on our Services. The changes will come into effect immediately upon publication on our Services. You should check our Services from time to time to understand how the current version of our Privacy Policy applies to you.

15. Access to your information

You can request access at any time to personal information we hold about you by using the contact details below for our Privacy Officer.

We will process your request within a reasonable time, usually 21 days for a straightforward request. There is no fee for requesting access to your personal information; however, we may charge you the reasonable cost of processing your request. If a fee applies, we will advise you before we provide access. Sometimes we are not required to provide you with access, for example if the law says we can deny access.

You may ask us at any time to correct personal information held by us about you, which you believe is incorrect or out of date. We will deal with your request within a reasonable time. If you have an account with us, you are responsible for ensuring your personal information linked to your account is accurate and up to date and you can do that within your account.

If you would like to make an update or correction to any personal information we hold about you, please let us know by sending an email to the contact details below.

You may choose to interact with us anonymously or through the use of pseudonyms where lawful and reasonable, for example if you have questions general in nature. However, you are required to provide true and accurate details when requesting an account for our Services. You agree to provide accurate information if so required.

16. Contact Details and Complaints

For any privacy question or request, including to access, correct or delete your personal information, you can email us at alex@kourtup.com. If you have a complaint about privacy related issues in connection with our Services, please contact our Privacy Officer at privacy@kourtup.com.

Following receipt of your complaint, we will acknowledge receipt within 5 business days, and investigate and respond to you within a reasonable period.

If you are not satisfied with our response, you may also contact the relevant regulator. As at the date of this Privacy Policy, the contact details are as follows:

Office of the Australian Information Commissioner

GPO Box 5218

Sydney NSW 2001

Phone: 1300 363 992

Email: enquiries@oaic.gov.au

Online: https://www.oaic.gov.au/individuals/how-do-i-make-a-privacy-complaint

If you would like more information about the Privacy Act or Australian privacy requirements in general, please visit the Office of the Information Commissioner's website at www.oaic.gov.au.

17. Disclaimer

While your privacy is important to us, nothing in this Privacy Policy constitutes a voluntary opt in by us to any privacy laws, anywhere in the world, which we are not legally bound to comply with.

This policy was last updated on 20 October 2026. Feature-specific descriptions apply when the relevant feature is enabled in your version of KourtUp.