Privacy Policy

1.Introduction

This Privacy Policy describes how Innovation Unknown Inc. ("CourtSauce," "we," "us," or "our") collects, uses, shares, and protects personal information when you use our products and services.

This policy applies to:

• The marketing and informational website at courtsauce.com and its subdomains
• The CourtSauce Tournaments application at tournaments.courtsauce.com
• The CourtSauce Leagues application at leagues.courtsauce.com
• The CourtSauce mobile applications: CourtSauce Pickleball, CourtSauce Tennis, and CourtSauce Squash (available on the Apple App Store)
• Any future products operated by Innovation Unknown Inc. under the CourtSauce brand

We refer to all of the above collectively as the "Services."

If you do not agree with the terms of this Privacy Policy, please do not use the Services.

Contact information for privacy inquiries:

Innovation Unknown Inc.
115 George St., Suite 605
Oakville, ON L6J 0A2, Canada
Email:

2.Summary (plain language)

Before the detailed sections, here is a summary in plain language. The detailed sections that follow are the legally operative parts of this policy.

• We collect information you give us when you sign up, create tournaments or leagues, register for tournaments, join leagues, send messages, or contact us. We also collect technical information automatically when you use the Services (browser, device, IP address).
• We use your information to operate the Services. This means showing you tournaments or leagues you've registered for, sending you match notifications, processing payments, managing your account, and similar core functions.
• We share your information with third parties only as necessary to operate the Services. We use Stripe for payments, Supabase for our database, Resend for email, Twilio for SMS, Cloudflare for hosting, Sentry for error alerting and error tracking, PostHog for usage flow, Geoapify for address autocomplete and Anthropic for the optional AI scheduling assistant. We do not sell your personal information to anyone.
• You have rights over your information. You can access, correct, delete, or export your data. You can also opt out of marketing communications.
• We protect your information with industry-standard security measures including encryption, access controls, and regular security audits.
• Children under 13 cannot create accounts. Children between 13 and 18 may use the Services with parental consent. Some tournament and league organisers run events that include minors; in those cases, the organisers are responsible for collecting appropriate consents.

3.Information We Collect

We collect information in several categories, depending on how you use the Services.

3.1 Information you provide directly

When you create a tournament or league organiser account

If you sign up to run tournaments or leagues, we collect:

• Your full name
• Your email address
• Your phone number (optional)
• Your password (stored as a salted hash; we never see your plaintext password)
• Your role at your organisation (e.g., director, manager)
• The organisation's name, address, and contact information
• Optionally, a profile photo

When you register as a player for a tournament

When you register for a tournament or league, we collect:

• Your name (or the name of the person you are registering)
• Your email address
• Your phone number (optional but recommended for match notifications)
• Your skill rating (where applicable to the sport)
• Your home city, region, and country (for tournament location preferences and analytics)
• For doubles events: your partner's name, email, and phone number
• Your acceptance of the tournament's specific rules and waivers

You may register anonymously without creating a CourtSauce account. In that case, we still process this information as described in this policy. You will receive a one-time link to claim the registration as part of a CourtSauce account if you wish.

When you create a CourtSauce account (player or organiser)

If you choose to create an account (so you can track your tournaments over time, manage your profile, or run tournaments or leagues), we additionally collect:

• A unique user identifier
• Your authentication credentials (handled by Supabase Auth, including optional Google OAuth and Apple OAuth)
• Optional profile information: photo, bio, city, region
• Your skill ratings per sport (you control these; they are not set by us)
• Your preferences for public profile visibility (you choose whether your profile is public)

When you connect a Stripe account (organisers only)

To accept payments through the Services, tournament and league organisers must connect a Stripe account. The information you provide to Stripe during onboarding (legal entity name, tax ID, banking information, government ID, date of birth, social insurance number where required by Canadian law) flows directly from you to Stripe.

Important: We do not see, store, or have access to your Stripe onboarding information. Stripe processes this information directly. We only receive confirmation from Stripe that your account is verified and able to accept payments, along with an account identifier we use to route funds.

When you communicate with us

When you contact us via email, our contact forms, or our support channels, we collect:

• The content of your message
• Your email address (so we can respond)
• Any attachments or screenshots you share
• Timestamps and contextual information

When you provide payment information

If you are a player paying for tournament or league registration or an organiser running tournaments or leagues, payment information (credit card number, expiry, security code, billing address) is collected by Stripe's hosted checkout interface. We do not see or store your card information. Stripe handles all payment data and provides us with non-sensitive information about the transaction (success/failure, amount, last 4 digits of the card for display purposes, transaction identifier).

3.2 Information about tournament activities

When you participate in tournaments or leagues, we collect data about your participation:

• Match results and scores
• Tournament placements and standings
• League standings, win/loss records, and statistical summaries
• Match schedules and your assigned matches
• Court assignments and time slots
• Verification status of submitted scores
• Whether you completed check-in
• Any disputes you filed or received

This data is used to operate the tournament/league, render brackets and standings, and provide you with historical records. Some of this data is visible publicly as part of normal tournament operations (your name on a bracket, your score in a published result).

3.3 Information collected automatically

When you use the Services, we automatically collect:

Technical information

• IP address
• Browser type and version
• Operating system and device type
• Screen resolution and viewport size
• Language and timezone preferences
• Referring website
• Pages visited within our Services
• Date, time, and duration of visits

Usage information

• Features used and actions taken
• Search queries and filter selections
• Click patterns and interaction events (used in aggregate for analytics; see Section 4 below)
• Error and crash reports

Cookies and similar technologies

The CourtSauce marketing website (courtsauce.com) does not use cookies. The CourtSauce Tournaments and Leagues web applications use cookies and similar technologies (local storage, session storage) for:

• Keeping you signed in (session cookies and authentication tokens)
• Remembering your preferences (language, sport filter, dismissed banners)
• Analytics about how the Services are used
• Security (detecting suspicious activity)

You can control cookies through your browser settings. Disabling cookies may prevent some Services from working correctly (e.g., you would have to sign in repeatedly). See Section 9 for details about your choices.

3.4 Information from third parties

We may receive information about you from third parties in limited circumstances:

Google OAuth (if you sign in with Google)

If you choose to sign in with your Google account, Google shares with us:

• Your Google account email address
• Your display name
• Your profile picture (if you have made it available)
• A unique Google identifier

We use this only to authenticate you and create or link your CourtSauce account. We do not access your Gmail, Google Drive, Google Calendar, or other Google services.

Apple OAuth (if you sign in with Apple)

If you choose to sign in with your Apple account, Apple shares with us:

• Your Apple account email address
• Your display name
• Your profile picture (if you have made it available)
• A unique Apple identifier

We use this only to authenticate you and create or link your CourtSauce account. We do not access any of your Apple services.

Stripe

After you complete Stripe Connect onboarding as an organisation, Stripe shares with us:

• Confirmation that your account is verified
• The status of your payout settings
• The status of your charges-enabled flag (whether you can accept payments yet)
• A unique Stripe account identifier
• Notification when you receive payouts (amount and date)

Stripe does not share your tax ID, banking information, government ID, or other sensitive onboarding details with us.

Tournament organisers (about players)

When you participate in tournaments or leagues, the organiser may share certain information with us as part of normal operations — for example, marking you as having checked in, recording your scores, or recording your placement. This information becomes part of your tournament or league participation record.

iOS apps

When you use one of our iOS apps (CourtSauce Pickleball, Tennis, or Squash), the app collects information about your use of the app on your device. See Section 3.5 below for details specific to mobile apps. Certain information will sync between the apps and the web platform.

3.5 Information collected by the iOS apps

The CourtSauce Pickleball, Tennis, and Squash iOS apps collect the following information:

On-device information (stays on your device unless you sync)

• Match histories you record locally
• Your skill ratings (manually entered)
• Your preferences for the app (default game length, scoring system, etc.)

Information sent to our servers

• Crash reports (anonymized or pseudonymized)
• Aggregate usage analytics (which features you use, how often)
• If you authenticate with the apps (currently optional): your account identifier and basic profile
• If you purchase a subscription: subscription status and lifecycle information received from Apple, and the CourtSauce app token, as described under "Subscriptions and payments" below

Connecting the app to your CourtSauce account (account linking)

Linking is optional. The apps work fully without an account; you only connect one if you want your tournament and league matches to appear in the app and to score them from your phone. If you choose to connect an app to your CourtSauce account:

• You start the link from your account page. Your signed-in CourtSauce account page generates a short-lived, single-use connect code (shown as a QR code, or optionally sent to you by email or SMS). This code is only a temporary means of establishing the link; it is not a lasting credential and expires shortly after it is created.
• We issue an identity token. When the app submits a valid connect code, our platform issues a durable identity token representing "this app installation belongs to your CourtSauce account." The app stores this identity token in the CourtSauce shared CloudKit container so the link carries across the CourtSauce sport apps and your devices signed into the same iCloud account.
• We keep a server-side link record. We store a record that associates your app installation(s) with your CourtSauce player identity. This record contains the issued identity token and basic per-installation details (which sport app, a device label, when the link was created and last used, and whether it has been disconnected).
• This identity token is separate from your subscription. It is a different credential from the CourtSauce app token used for subscription entitlement (described under "Subscriptions and payments" above), with a separate purpose and lifecycle. Connecting or disconnecting your account does not change your subscription, and subscribing or unsubscribing does not change your account link.
• You can disconnect at any time. You can unlink an app from within the app or from your CourtSauce account page. Disconnecting revokes the link on our servers and removes the identity token from the shared container; the app returns to standalone use, and your locally recorded casual matches are unaffected.

Information shared with the Tournaments/Leagues platforms (when integration is enabled)

When the iOS apps integrate with the web platform (this functionality is optional and only applies once you have connected your account as described above):

• The app can retrieve the list of your tournament and league matches and the limited match context (sport, format, your team assignment) needed to display and score them
• The app may submit scores for specific matches you are playing
• The app stores credentials in the iOS Keychain (encrypted device-side storage) and in iCloud (a CourtSauce shared CloudKit container). These include the CourtSauce app token used for subscription entitlement and, if you connect your account, the separate identity token described above. A cached copy of your subscription entitlement status may also be stored in this shared container so the apps can apply it across your devices.

The iOS apps do not collect:

• Your contacts
• Your photos (other than ones you explicitly attach to a profile)
• Your location (unless you opt in to location-based tournament discovery)
• Your microphone or camera
• Your other device data

Subscriptions and payments

If you purchase a subscription within one of our iOS apps, all payments are processed by Apple through your Apple account. Innovation Unknown never sees, collects, or stores your payment card information — Apple handles all payment data.

To keep your subscription working consistently across the CourtSauce sport apps (Pickleball, Tennis, and Squash) and across your devices, we maintain a record of your subscription status on our own servers. Specifically:

• We receive subscription lifecycle information from Apple. Apple sends our servers notifications about your subscription's lifecycle events (for example, when it starts, renews, enters a billing-retry or grace period, expires, is cancelled, or is refunded) through Apple's App Store Server Notifications service. We may also query Apple's App Store Server API to confirm or reconcile your current subscription status.
• We store a subscription record. From the above, we store: a transaction identifier provided by Apple (used to identify the subscription), the product identifier (which app/feature set the subscription is for), the subscription status, the current expiry date, whether it is set to auto-renew, and whether the subscription is a sandbox/test or production subscription. We do not receive or store your payment card details, billing information, or Apple account credentials.
• We store an app token. When you subscribe, we generate and store a random identifier (the "CourtSauce app token") which we attach to the purchase. This token lets us recognise your subscription across the CourtSauce sport apps and your devices without us needing your Apple account details. The same token is stored in your device's iCloud (in a CourtSauce shared container) so the apps can use it. Account linking uses a separate identity token (see "Connecting the app to your CourtSauce account" above), not this subscription token. Where both exist, we may associate your subscription with your CourtSauce account, but the two credentials remain distinct and are managed independently.
• We use this record only to deliver your entitlement — that is, to unlock the subscription features in each of the CourtSauce sport apps you use, and to keep that unlocked state correct and consistent even if you do not reopen the app you originally subscribed in, or if you remove one of the apps.

This server-side subscription record is processed using our existing infrastructure providers (see Section 5.3): the subscription state is stored in our database (Supabase) and the notifications from Apple are received and processed by a service we operate on Cloudflare.

Apple remains the processor of all subscription payments, renewals, and cancellations. To manage or cancel an app subscription, use your Apple account settings (Settings → your name → Subscriptions on your device). Cancelling or deleting an app does not, by itself, delete the subscription record described above; that record follows the retention rules in Section 7 and your deletion rights in Section 9.

The apps' specific privacy practices, including the data they collect on-device and any analytics, are described in each app's App Store listing in Apple's standard "App Privacy" format.

3.6 Information we do not collect

We want to be clear about what we do not collect:

• We do not collect your government identification numbers except where required (Stripe onboarding requires SIN/SSN for organisers; this is collected by Stripe, not by us)
• We do not collect your banking information (Stripe handles this directly)
• We do not collect your credit card numbers (Stripe handles this directly)
• We do not collect your in-app subscription payment details — Apple handles all payment data (card numbers, billing information, Apple account credentials). We do receive and store subscription status and related lifecycle information from Apple in order to deliver your subscription features across the CourtSauce apps and your devices; see Section 3.5 for exactly what we store and why.
• We do not access your contacts, photos (other than uploads you provide), or other device data on mobile
• We do not track you across other websites or services beyond what is described in Section 4
• We do not sell your information to anyone

4.How We Use Your Information

We use your information for the following purposes:

4.1 To operate the Services

• Create and manage your account
• Process tournament and league registrations
• Process payments (via Stripe)
• Send transactional emails (registration confirmations, match alerts, results)
• Send transactional SMS messages (when you opt in)
• Display brackets, schedules, scores, and standings
• Provide calendar feeds you can subscribe to
• Enable spectators to view live tournament information
• Connect you with organisers and other players in your registered events
• Handle support requests and customer service

4.2 To improve the Services

• Analyze how the Services are used (in aggregate)
• Identify bugs and performance issues
• Develop new features
• Conduct A/B tests (only of UI elements, not of policies)
• Improve search, discovery, and recommendation features

4.3 To communicate with you

• Send service-related notifications (account changes, security alerts, policy updates)
• Send marketing communications (where you have opted in or as permitted by law)
• Respond to your inquiries and provide customer support
• Send tournament-related notifications you have opted into

4.4 To enforce our terms and protect the Services

• Detect and prevent fraud, abuse, and unauthorized access
• Enforce our Terms of Service and acceptable use policies
• Verify the legitimacy of organisations and tournament or league directors
• Investigate complaints and report suspected illegal activity to authorities

4.5 To comply with legal obligations

• Respond to lawful requests from government or law enforcement
• Comply with tax and financial reporting requirements
• Defend against legal claims
• Comply with privacy laws (PIPEDA, GDPR, CCPA, others as applicable)

4.6 With your specific consent

For uses not described above, we will obtain your specific consent first.

5.How We Share Your Information

We share your information only in the following circumstances:

5.1 With other users as part of normal tournament operations

Information about your participation in tournaments is shared publicly as part of normal operations:

• Your name appears in brackets, registration lists, and standings
• Your name and city (if provided) may appear on public tournament or league pages and results
• Your match scores are publicly visible during and after tournaments or leagues
• Your participation history may appear on public profile pages if you opt in to a public profile

Information that is never publicly displayed without your specific action includes: your email address, phone number, payment information, address (other than city/region if you opted to include), and date of birth.

5.2 With tournament or league organisers

When you register for a tournament or a league, the organiser sees:

• Your name and contact information (email, phone if provided)
• Your skill rating
• Your division and registration status
• Your match assignments and results
• Information about your partner (for doubles events)
• Payment status (confirmed, pending, refunded) but not card details
• Any communications you send through the platform regarding the tournament

Tournament or league organisers are responsible for handling this information in accordance with privacy laws applicable to them. We require organisers to agree to a data processing arrangement as part of their use of the Services.

5.3 With service providers (subprocessors)

We use the following third-party service providers to operate the Services. Each is bound by confidentiality and data protection obligations under their respective agreements:

Each of these providers has its own privacy policy. We periodically review their practices and update this list as our subprocessors change. The current list is maintained at courtsauce.com/subprocessors.

5.4 In connection with business transactions

If Innovation Unknown Inc. is acquired by or merged with another company, or if substantially all of our assets are sold, your information may be transferred as part of that transaction. We will notify you of any such change of control before your information becomes subject to a different privacy policy.

5.5 For legal reasons

We may share your information if we believe in good faith that disclosure is necessary to:

• Comply with applicable laws, regulations, court orders, or legal process
• Protect the rights, property, or safety of CourtSauce, our users, or the public
• Detect, prevent, or address fraud, security issues, or technical issues
• Enforce our Terms of Service or other agreements

5.6 With your consent

We may share your information for purposes you specifically authorize.

5.7 Aggregated or de-identified information

We may share information that has been aggregated or de-identified (so it cannot reasonably be linked to you) for any purpose. For example, we might share statistics about tournament participation in Canada with partners or researchers.

6.International Data Transfers

CourtSauce is operated from Canada. The Services are primarily hosted on infrastructure that may be located in Canada, the United States, and other regions. Some of our service providers (listed in Section 5.3) operate globally and may process your information in the United States, the European Union, or elsewhere.

For users in the European Economic Area, United Kingdom, or Switzerland: Where we transfer your personal data outside of these regions, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

For users in Canada: Some processing may occur in the United States. By using the Services, you understand that your information may be subject to U.S. laws including potential government access requests. We have implemented contractual and technical measures to protect your information regardless of where it is processed.

For users in other regions: Please contact us with any specific concerns about international transfers.

7.How Long We Keep Your Information

We retain your information for as long as necessary to provide the Services and for legitimate business purposes, including:

After the applicable retention period, we will delete or anonymize your information, except where retention is required by law or for legitimate business purposes (such as defending against legal claims or maintaining the integrity of public tournament records).

You can request deletion of your account at any time (see Section 9), subject to certain exceptions described below.

Note about tournament and league records: Tournament and league results are intended to be permanent public records, similar to sports record books. Even if you delete your account, your name in past tournament or league results may remain visible. You may request to have your name displayed differently (e.g., initials only) for accessibility or privacy reasons, but the underlying record of your participation remains.

8.Security

We implement reasonable technical and organisational security measures designed to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption in transit: all data exchanged between your device and our servers uses HTTPS with TLS 1.2 or higher
• Encryption at rest: databases, file storage, and backups are encrypted using industry-standard encryption (AES-256 or equivalent)
• Access controls: access to user data is restricted to authorized personnel on a need-to-know basis; all access is logged and audited
• Authentication: strong authentication is required for administrative access (multi-factor authentication for all internal accounts with access to user data)
• Network security: firewalls, intrusion detection, and DDoS protection (provided by Cloudflare)
• Regular security audits: we periodically assess our security practices and address identified issues
• Subprocessor diligence: we evaluate the security practices of our subprocessors before engagement
• Tokenized payment processing: Stripe handles all payment data; we never see card numbers

While we work hard to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security. If we become aware of a security breach affecting your information, we will notify you in accordance with applicable law (e.g., PIPEDA requires notification when a breach poses a "real risk of significant harm").

You play an important role in security:

• Use a strong, unique password
• Enable two-factor authentication when available
• Do not share your account credentials with anyone
• Sign out when using shared devices
• Report any suspicious activity to

9.Your Rights and Choices

You have rights regarding your personal information. The specific rights vary by jurisdiction, but at minimum we offer the following to all users:

9.1 Access

You have the right to know what personal information we have about you. You can:

• View most of your account information in your account settings
• Request a complete copy of your data by emailing
• We will respond within 30 days

9.2 Correction

You have the right to correct inaccurate information. You can:

• Edit most of your profile information directly in your account settings
• Email for corrections you cannot make yourself

9.3 Deletion

You have the right to request deletion of your personal information. You can:

• Delete your account through account settings (deletes most personal data)
• Email for assistance with complete deletion

Important exceptions to deletion: Some information may be retained even after you request deletion:

• Tournament or league participation records (we may retain your name as part of public tournament records, though we will minimize or anonymize at your request where reasonable)
• Information required for legal compliance (tax records, etc.)
• Information necessary for fraud prevention or to defend against legal claims
• Anonymized statistical data that cannot be linked back to you

9.4 Data portability

You have the right to receive your data in a portable format. You can:

• Download your account data from settings (we provide a JSON export of your data)
• Email for specific data export needs

9.5 Opt out of marketing

You can opt out of marketing communications at any time:

• Click the unsubscribe link in any marketing email
• Update your communication preferences in account settings
• Email

You cannot opt out of transactional emails necessary to operate the Services (e.g., match notifications, payment receipts, account security notices) without closing your account.

9.6 Object to processing

You may have the right to object to certain uses of your information, including for direct marketing purposes. Contact to make such requests.

9.7 Withdraw consent

Where we rely on your consent for any specific processing activity, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.

9.8 Region-specific rights

Residents of Canada (PIPEDA)

You have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. You may contact our privacy officer at . If you have concerns we cannot resolve, you may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca or your provincial privacy commissioner.

Residents of the European Economic Area, United Kingdom, or Switzerland (GDPR)

You have additional rights under the General Data Protection Regulation (GDPR), including:

• The right to restrict processing
• The right not to be subject to automated decision-making
• The right to lodge a complaint with your local data protection authority

The lawful basis for our processing of your data is typically: (a) performance of a contract (when we process data to provide the Services), (b) legitimate interest (when we process data to operate, secure, and improve the Services), (c) consent (for marketing communications and other optional features), or (d) legal obligation (for tax and regulatory compliance).

For purposes of the GDPR, the data controller is Innovation Unknown Inc., contactable at .

Residents of California (CCPA/CPRA)

You have additional rights under the California Consumer Privacy Act and California Privacy Rights Act, including:

• The right to know what personal information is collected about you
• The right to delete personal information
• The right to opt out of the sale or sharing of personal information (we do not sell or share personal information as defined by CCPA)
• The right to correct inaccurate information
• The right to limit use of sensitive personal information
• The right to non-discrimination for exercising these rights

To exercise these rights, contact . We will verify your identity before responding.

Other jurisdictions

If you reside in a jurisdiction with specific privacy laws not addressed above, please contact and we will work with you to provide the rights afforded by your local law.

10.Children and Minors

The Services are not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete that information.

For users between 13 and 18: You may use the Services with the consent of a parent or guardian. We encourage parents and guardians to monitor their children's use of the Services.

For tournaments and leagues involving minors: Many racquet sports tournaments include participants under 18. The tournament or league organiser is responsible for:

• Obtaining appropriate consents from parents or guardians of minor participants
• Complying with applicable laws regarding minors' data
• Following any sport-specific safe sport policies for handling minors' information
• Not collecting information from minors that is not necessary for tournament or league operations

When a registration includes a participant who is identified as a minor, we apply additional protections:

• Public profile features are disabled by default
• Public display of contact information is suppressed
• The participant's date of birth (if collected) is not displayed publicly

11.Cookies and Tracking Technologies

The CourtSauce marketing website (courtsauce.com) does not use cookies. The cookies and similar technologies described in this section are used by the CourtSauce Tournaments and Leagues web applications. The CourtSauce iOS apps do not use cookies; see Section 11.3 for the device-level storage they use instead.

11.1 What we use

The Tournaments and Leagues web applications use the following types of cookies and similar technologies:

Strictly necessary (cannot be disabled):

• Session cookies for authentication
• Security cookies for fraud prevention
• Cookies to remember your cookie preferences

Functional (essential — cannot be disabled):

• Cookies remembering your language and sport filter preferences
• Cookies remembering dismissed notifications and onboarding state
• Cookies for accessibility features

Analytics (optional, can be disabled):

• PostHog cookies for understanding how the Services are used (anonymized)
• Cloudflare Web Analytics (does not use cookies)

Marketing (optional, can be disabled):

• We do not currently use marketing cookies. If we add them in the future, we will update this policy and obtain your consent where required.

11.2 Managing cookies

You can manage cookies through:

• Your browser settings (block, delete, or restrict cookies)
• The cookie preference center within the Tournaments and Leagues web applications
• Browser-level "Do Not Track" signals (we honor these signals for non-essential tracking)

Disabling strictly necessary cookies will prevent the Services from working. Disabling other cookies may affect your experience but will not prevent you from using the Services.

11.3 Mobile apps

The iOS apps do not use cookies but may use similar device-level identifiers and storage:

• iOS Keychain for storing authentication tokens
• App-private storage and CloudKit for preferences, offline data, the CourtSauce app token, the account-link identity token (if you connect your account), cached subscription entitlement status, and cross-device (that you control) syncing
• Anonymized device identifiers for crash reporting

You can control these at the device level through iOS settings (Settings → Privacy & Security → Tracking, and the per-app settings).

12.Third-Party Links and Services

The Services may contain links to third-party websites, services, or content not controlled by us (for example, links to a tournament or league organiser's external website, embedded calendar feeds, or social media). This Privacy Policy does not apply to those third parties. We encourage you to review their privacy policies.

If you integrate a third-party service with our Services (for example, subscribing to a calendar feed in your personal calendar app, or linking your social media for sharing), the third-party service will receive information necessary for that integration. Their handling of that information is governed by their own privacy policies.

13.Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last updated" date at the top of this policy
• Notify you of material changes by email or through the Services
• Where required by law, obtain your consent before applying changes to existing data

We encourage you to review this policy periodically. Continued use of the Services after a change indicates your acceptance of the updated policy.

For users in jurisdictions requiring more explicit consent (e.g., GDPR), we will obtain affirmative consent before applying material changes to your existing data.

14.Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of your information:

General privacy inquiries:
Email:

Security concerns:
Email:

Mailing address:
Innovation Unknown Inc.
115 George St, Suite 605
Oakville ON L6J 0A2, Canada

We will respond to inquiries within 30 days. If you are not satisfied with our response, you may contact the relevant privacy authority in your jurisdiction.

15.Specific Notices

15.1 Notice for iOS app users

When you use the CourtSauce Pickleball, Tennis, or Squash iOS apps, additional information is available:

• Each app's "App Privacy" disclosure on the Apple App Store
• The in-app privacy settings (Settings → Privacy within each app)
• This Privacy Policy

15.2 Notice for tournament or league organisers

When you act as a tournament or league organiser, you have additional obligations:

• You are responsible for complying with privacy laws applicable to you and your participants
• You must obtain appropriate consents from participants for their data to be collected and shared with CourtSauce
• You agree to use participant data only for tournament or league operations and not for marketing without consent
• You must protect participants' information using reasonable security measures
• You agree to assist us in responding to participants' data subject requests where applicable

By creating an organisation on CourtSauce, you agree to these obligations as part of our Terms of Service.

15.3 Notice for spectators

If you use the Services only to view public tournament or league information (brackets, schedules, scores, results) without creating an account, we collect only technical information necessary to deliver the website (IP address, browser type, pages viewed). This information is used for security, abuse prevention, and aggregate analytics.