Privacy policy

• Session details hosts enter: the session name, location, organizer name, date and times, court and rotation settings, and the players’ names and skill levels.
• What happens during a session: who checked in, the queue, who played whom, scores and results. We also keep it as a step-by-step log (check-ins, breaks, each game and the line of players waiting when it started), which only the host can see. It never includes payments, receipts or contact details.
• A host cookie. Hosting doesn’t need an account. Your browser gets a random secret in a cookie, and we store only a one-way hash of it, so the session can be linked back to you without a name or password. It lasts 90 days and renews each time you come back.
• Payment records and receipts, only for sessions with a player fee: whether each player has paid and how (cash or online). Players can choose to send a screenshot of their payment screenshot. We re-save it as a new image without its hidden details (like location or camera data), keep it in private storage, and show it only to the session’s signed-in host.
• Requests to join, only for sessions that take them: the name, email address and skill level a player enters, whether the host approved it, and any refund the host owes. The email is used only to send that player updates about their request for that session (confirmation, payment checks, refunds or cancellation).
• A player cookie. When a player claims their name on a session’s link, that browser gets a similar cookie for that session only.
• Google account details, only if you choose to sign in with Google: your Google account ID, name, email address and profile photo. We ask Google only for basic sign-in access (openid, email, profile). We never see your Google password and can’t access your Gmail, contacts, Drive or anything else. Google’s sign-in tokens are stored encrypted, and we don’t use them after you sign in.
• Your player profile, only if you choose to save games to it: when you claim your name on a session’s link while signed in, or tap Save to my profile from that same phone, we note which account the claimed player belongs to. My profile (your games, wins, partners and activity) is worked out from those sessions and only you can see it. If you add a bio or set your own skill level, they show on your profile too. Your profile is private unless you turn on Public profile in Account settings: then anyone can see it in Players, with your name, @handle, photo, level, bio, game stats, where you play most and the open plays you’ve finished (never your email, your partners’ names or a session you’re in right now). Turning it off hides it again right away. Your account also gets a unique handle (like @yourname, made from your name and changeable in Account settings), shown on your profile. If you upload a profile photo, we store a small square copy of it, with location and camera details removed, and show it instead of your Google photo; removing it deletes the copy. In a session you saved, your Google profile photo shows as your avatar to people viewing that session, and the host also sees your account name next to the name they entered for you (for example, “Mike (Michael Reyes)”).
• Anonymous usage statistics: page views counted by Vercel Web Analytics, which doesn’t use cookies or identify you.

• To run your sessions: the queue, courts, check-ins, leaderboards and recaps.
• To let you come back to your sessions. With Google sign-in, you can open them on any device; without it, on the device you used.
• To suggest players from your earlier sessions when you set up a new one.
• To keep the service working and secure, and to understand which pages are used.
• To improve how players are matched into games, by looking back at how sessions went.

We don’t use your information for advertising, and we don’t sell or rent it to anyone.

• Anyone with a session’s link or QR code can see that session: player names, the queue, courts and results. Hosts share it with their players; treat it like an invitation.
• The results card a host or player shares shows the session name, the champion and first names with a last initial.
• The public stats page lists sessions by name, location, actual start and end times when available, duration, and how many players and courts they have. People appear only as first name and last initial, and it shows no session links.
• Requests to join: each player sees only their own request. Only the host sees everyone’s, including their email addresses.
• Payments: each player sees only their own payment status. Only the host sees everyone’s, and only the host can open a receipt.
• Only the host can manage a session, through their host cookie or their signed-in account.

When place suggestions are turned on, what you type in the location field is sent to our place search provider (Google Places or Mapbox) to find courts. If you allow it, your browser’s location is used for that search only and is never stored. When you pick a place, we save its name, address and map position so other hosts nearby can pick it too. Details from Google are kept for no more than 30 days.

Sideout runs on a hosting provider and a PostgreSQL database that store the information above. Receipt images are kept in Vercel’s private file storage. Request emails are sent through Resend, our email provider. Google provides sign-in (and place search when it’s on), Mapbox may provide place search, and Vercel provides the anonymous analytics. Each of them handles data under their own privacy terms and only as needed to provide their service to us.

Payment receipts are deleted 15 days after upload, whether or not the host has checked them, and right away if the host marks one as not received. The record that a player paid stays with the session.

Email addresses from requests to join are deleted two days after the session ends. We don’t send marketing email.

Sessions are kept so hosts can look back at their history. Hosts can permanently delete their sessions from Your sessions, including their games and player history. Sign-in sessions expire on their own, and signing out ends yours immediately. You can ask us to delete your account, your sessions, or a player’s name from a session at any time (see below).

• You can host and play without signing in, and you can sign out at any time.
• You can remove Sideout’s access to your Google account at myaccount.google.com/permissions.
• Clearing your browser’s cookies removes the host and player cookies from that device.
• To get a copy of your information, correct it, or delete it, email edwin@trysideout.com. We’ll reply within 30 days.

Cookies are HTTP-only and sent only over HTTPS on the live site, we store hashes of them rather than the secrets themselves, and only the server can read the database. No system is perfectly secure, but we work to protect what you share with us.

Sideout isn’t directed at children under 13, and we don’t knowingly collect their personal information. If you believe a child’s information was added, contact us and we’ll delete it.

If we change this policy, we’ll update it here and change the date at the top. Questions or requests: edwin@trysideout.com.