Privacy

What we store about you

If you have an account, we store what you typed into it:

• Your email address — it is how you sign in, and the only thing we require.
• Your profile: name, sports, level (including an NTRP or DUPR rating if you enter one), neighbourhoods, courts you like, when you are usually free, the “about you” text, and until when you have stepped out of player search, if you have.
• Your profile photo, if you added one.
• The games you create, the requests you send and receive, and the messages in those conversations.
• Reports you send us about another player.
• A record of each device you have signed in on, so we can send you notifications and keep you signed in. The record stays after that sign-in expires.

If you do not have an account

Anyone can open a game link and join without signing up — that is the point of the product. When you do, we store the name you typed and the note you left, and show them to the person who created the game. We do not ask for anything else, and we cannot contact you.

If you ask us to email you the link to your game chat, we send that one email straight away and do not keep your address — it is not saved anywhere, so we cannot write to you again. What we do keep is how many times that link was emailed, and when — never to whom — so the form cannot be used to send our emails to strangers.

If you join the Hitaround Scoreboard waitlist, we keep your email, the wording you agreed to and when, a one-way fingerprint of your IP address (to limit sign-ups from one connection), the page that sent you, and any answers you give on the second form. We email you only after you confirm from our first email, at most once a month, and every email has a link to unsubscribe. Unsubscribing stops the emails at once; to have the entry deleted, write to us.

Who else sees it

Other people using Hitaround see:

• Your name, photo, sports, level, neighbourhoods and free hours — in player search, in a request you send to someone, and on a game you joined.
• A game you create — its sport, level, time, court and your name — is shown to other signed-in players looking for a game, until it fills up or you close it. Your note goes with it, so write it as something strangers will read.
• If you leave that game visible to everyone, its sport, time, court and free spots also appear on public pages of this website, where anyone can see them without an account. Your name and your note are not on those pages — they are on the game page itself, which anyone with the link can open. Create the game as “only people with the link” and it stays off both lists.
• Your messages — in a request, only the other person; in a game, everyone who is in that game, the host included.
• Your email address — never. We do not show it to anyone.

Who we send it to

We use a small number of services to make the app work, and nothing beyond what each one needs:

• OpenStreetMap, when you type an address on the courts page and press Enter — the text you typed goes there to be turned into a point on the map. Nothing else goes with it, and we do not store it.
• An email provider, to send your sign-in code, or the game chat link you asked for.
• Apple or Google, if you choose to sign in with one of them. They tell us your email address — that is all we ask for, and it is the same address you would have typed yourself. We also fetch their public keys to check that the sign-in really came from them. On the website that choice happens on their own page, so they see that you came from here.
• Cloudflare R2, to store profile photos.
• Expo’s push service, to deliver notifications to your device. A notification carries the sender’s name and the beginning of the message — that is what makes it useful on a lock screen, and it means that much leaves our server. Expo hands it to Apple or Google, whichever runs the notifications on your phone, so that company sees the same text on its way to you. Turn notifications off in your phone’s settings and nothing is sent at all.
• Google Maps, to draw the map of courts on Android.
• OpenStreetMap, for the map tiles on the website. Your browser fetches those images directly, so their servers see your IP address. Maps appear on the court pages, and on a game page and its chat when the game has a court.
• Google Analytics, on the website, and only after you press “Allow” in the bar at the bottom. It counts visits — which page, what kind of device, roughly which region — and steps such as signing in (and which way), creating a game or joining one. It never gets your email, your name, your messages or your account: the private part of a game link is replaced with “[key]” before anything is sent. To change your answer, clear the hitaround_consent cookie in your browser.
• Google Analytics in the app (through Firebase): which screens and steps get used — signing in and which way, creating or joining a game, sharing a link — plus the kind of device and roughly the region. It never gets your email, your name, your messages or your account, and no advertising identifier. It is on unless you turn it off: Profile → Usage statistics.

What we do not do

We do not sell your data. There are no ads, no advertising identifiers and no third-party trackers. Google Analytics counts visits and steps — on the website only if you allow it, in the app unless you turn it off (see above). We do not build a profile of you beyond what you typed in.

Reports, and what we read

We do not read your messages, and nothing scans them. There is no filter watching what you write to another player, and no system that flags words. Your conversations are between the people in them.

When a conversation offers you a reply to pick, that choice is made by your own browser. The page carries a short list of phrases, and the browser matches the last message against it right there on your device. What the message says never reaches us, and nothing about it is stored.

The one exception is a report. When you report someone, we learn who reported whom, why, and which conversation the report came from. Only then does a person here open that conversation — the one the report points at, and nothing else — because a report about what someone wrote cannot be judged without reading it. The email that tells us about a report carries the reason and a pointer to the conversation, not the messages themselves.

A report also separates the two of you straight away, before we have read anything: you stop seeing each other in player search, open conversations close, a pending request is declined, and neither of you can join the other’s games. If you were already in one of theirs, you are taken out of it.

If we are told that something here is child sexual abuse material, Canadian law requires us to report it to the authorities, and we will. Anything else unlawful we pass on when the law requires it, or when someone is in danger.

How long we keep it

Your account and everything in it stay until you delete the account. Sign-in codes last minutes. A sign-in on a device expires after 90 days without use.

Our server keeps a log of which requests came in — not of what was in them. Your messages, your sign-in code, the values you typed and the tokens inside game links are kept out of it deliberately. The log itself is rotated and deleted after 30 days.

Every night we make a copy of the database, so that a failure does not lose everyone’s games. Each copy is kept for 7 days and then deleted — so when you delete your account, it is gone from the database at once and from the copies within 7 days.

Deleting your account

On the website: Your account → Delete your account. In the app: Profile → Delete your account. Either one deletes everything you told us about yourself — your name, photo, email, level, courts and availability — and signs you out everywhere. Conversations you had stay with the other people in them, without your name on them, because that record is theirs too. It cannot be undone. If neither works for you, write to us and we will do it for you.

Your photo is removed from our storage straight away, but its web address can keep serving the old copy from the content network for up to 4 hours after that. Nothing new points at it — the address is random and nobody can guess it — but if it was already open in someone’s browser, it keeps working for that long.

Who we are, and which law applies

Hitaround is run from Ontario, Canada, and Ontario and Canadian law applies to it — including PIPEDA, the federal privacy law.

Your data does not stay in Canada, and you should know where it goes. The server and the database are in Germany (Hetzner, Falkenstein). Email — your sign-in code, or a game chat link you asked for — is sent through Resend, which delivers from the United States. Profile photos sit on Cloudflare R2, which stores them close to whoever looks at them. That means your data crosses borders and is subject to the law of those countries as well as ours.

If something here is wrong or you want your data gone, write to us first: the address is at the bottom of this page. If we do not sort it out, you can complain to the Office of the Privacy Commissioner of Canada.

Children

Hitaround is for people aged 16 and over. We do not knowingly collect anything from anyone younger; if you believe a younger person has an account, write to us and we will remove it.

Contact

Questions about any of this, or a deletion request:

privacy@hitaround.com