Privacy Policy
1. Who is responsible?
Julia Röchner
Email: hello@courtsplit.de
2. What is the app for?
CourtSplit helps groups that meet regularly (for example sports groups) organise their sessions – who is coming, who is not – and split costs fairly. The app does not process payments; it only keeps track of who owes whom how much.
We show no advertising, use no analytics or tracking services, and do not sell data.
3. What data do we process, and why?
3.1 Account and sign-in
Your email address and a technical user ID. Sign-in works without a password: we email you a six-digit one-time code that you enter in the app. That lets you sign in to your existing account again on a new device.
Legal basis: Art. 6(1)(b) GDPR (providing the app).
3.2 Profile and groups
Your display name, your group memberships (role as admin, member or guest, an "inactive" flag, join and leave times) and the group data itself: group name, session series (period, weekdays, time), payment mode and amounts in euros. Whoever joins a group through an invite link enters a display name; the link itself only contains the group's invite code.
Display name, role and status are visible to all members of the same group, and not to members of other groups.
Legal basis: Art. 6(1)(b) GDPR.
3.3 Sessions, confirmations and declines
Your confirmation or decline per session, with the time of your response and, if you like, a reason as free text. This information is visible to the members of that group. Please do not enter sensitive information in the free text (for example about your health).
Legal basis: Art. 6(1)(b) GDPR.
3.4 Costs and settlements
Who paid for a session, which amounts arise, who settled which amount with whom, and which vouchers or cost splits exist for cancelled sessions. This is bookkeeping within the group only – we do not collect bank, credit card or other payment details and do not carry out payments.
Legal basis: Art. 6(1)(b) GDPR.
3.5 Guests
Admins can create guests, meaning people without an account of their own. Only a name is stored for a guest. Admins may only enter names of people who agree to it. If you are listed as a guest and do not want that, contact the group's admin or us.
3.6 Error reports (Sentry)
When an error or crash occurs in the app, a report is sent automatically to our error monitoring service Sentry. It contains the error message, technical trace information (stack trace), the last steps taken in the app, device and system information (for example device model, operating system and app version, language) and a pseudonymous user ID. We do not send your email address or display name. Sentry's option to send default personal data, such as the IP address, is not enabled.
Purpose: finding and fixing errors so the app runs reliably and securely. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). You can object to this, see section 6.
3.7 Technical server data
When the app communicates with our servers, the hosting provider processes connection data such as the IP address and time in server logs as a technical necessity. Legal basis: Art. 6(1)(f) GDPR (secure and stable operation).
3.8 Push notifications
Group admins can set up reminders that the app sends as push notifications before sessions – for example to everyone who hasn't responded yet, or, in "Training mode", depending on how many have confirmed. For this, after you sign in the app asks your device for permission to show notifications. If you allow it, we store a device token (a technical address for your device, issued by Apple or Google), the platform (iOS or Android) and your device language (for the notification's language), linked to your account.
A notification contains the group name, the weekday and date of the session and a text written by an admin of the group. Depending on your device settings it may be visible on the lock screen. To decide whom to remind, our server uses the responses for that session; it also records which reminder was sent for which session, and when the responses to a session last changed.
You can turn notifications off at any time in your device's settings. The device token is deleted when you sign out, when you delete your account, and when Apple or Google report it as no longer valid (for example after uninstalling the app). Legal basis: Art. 6(1)(b) GDPR (providing the reminder feature).
3.9 Data on your device
The app stores a sign-in token locally so you stay signed in; it is removed when you sign out. We do not use cookies. The app does not access contacts, location, camera, photos or microphone.
3.10 Contact by email
When you write to us at hello@courtsplit.de, we process your email address, your name (if given) and the content of your message in order to answer your request. Emails are stored in a mailbox at IONOS. Legal basis: Art. 6(1)(b) GDPR where it concerns your use of the app, otherwise Art. 6(1)(f) GDPR (our interest in answering requests).
4. Who receives data?
- Other members of your groups: the information listed in 3.2 to 3.5, as far as it is part of using the group.
- Supabase (Supabase, Inc.): database, sign-in and hosting. Server location: Frankfurt am Main (EU).
- Resend (Resend, Inc.): sending the sign-in emails. Your email address is processed for this.
- Sentry (Functional Software, Inc.): error reports as described in 3.6, stored in a data centre in the EU (Germany).
- Google (Firebase Cloud Messaging): delivering push notifications as described in 3.8 – the device token and the content of the notification. On iPhones, Firebase hands the notification on to Apple's push service (Apple Push Notification service).
- IONOS (IONOS SE, Montabaur): storing emails sent to us and our replies, as described in 3.10.
- Apple and Google: when you download the app from the App Store or Google Play, these companies process data under their own responsibility.
Data processing agreements under Art. 28 GDPR are in place with these providers. As some of them are based in the USA, data may be transferred to a third country; this happens on the basis of appropriate safeguards, in particular EU standard contractual clauses or an adequacy decision.
We do not pass your data on for advertising and do not sell it.
5. How long do we keep data?
- Account and group data are kept as long as your account or the group exists.
- If the person who created a group deletes it, all data of that group is deleted.
- If you leave a group, sessions that have already taken place and their settlement stay visible to the remaining members so that accounts remain traceable.
- You can delete your account in the app at any time: account icon at the top right of the groups overview, then "Delete account". This deletes your login, you leave all your groups, and your name there is replaced by "Deleted user"; your decline reasons are deleted. The remaining members' settlements stay unchanged, but can no longer be traced back to you. While you have created a group or still have open payments in a group, the app tells you what to sort out first. Alternatively you can request deletion by emailing hello@courtsplit.de.
- Error reports are kept by Sentry only for a limited period.
- We delete emails sent to us once the request has been dealt with, at the latest after 6 months. Deletion requests and our confirmation of them are kept as proof for up to 3 years.
6. Your rights
You have the right to:
- access the data we hold about you (Art. 15 GDPR),
- have inaccurate data corrected (Art. 16),
- erasure (Art. 17),
- restriction of processing (Art. 18),
- receive your data in a common format (Art. 20).
Where we process data based on a legitimate interest (Art. 6(1)(f) GDPR, sections 3.6 and 3.7), you can object to that processing at any time on grounds relating to your particular situation (Art. 21).
Just write to hello@courtsplit.de. You can also lodge a complaint with a data protection supervisory authority, for example in the EU member state where you live or work.
7. Do you have to provide data?
An email address is required for an account; without it you cannot use the app. All other information, such as a reason for declining, is optional.
8. Automated decisions
There is no automated decision-making and no profiling.
9. Security
Data between the app and the server is transmitted encrypted (TLS). Access rules on the server ensure that you only see data of the groups you are a member of.
10. Children
The app is not directed at children under 16.
11. Changes
If the app or the legal situation changes, we will update this policy. The current date is shown above.