Privacy Policy

01Who we are

ClubDojo (“we”, “us”) operates clubdojo.app — a club management platform for racket sports clubs and active communities. Clubs use ClubDojo to run activities and bookable resources, memberships, events, programs, box leagues, announcements, and optional payments; members use it to reserve resources, register, play, and—when their club charges—pay their club.

This policy covers clubdojo.app and its supporting services (api.clubdojo.app and auth.clubdojo.app). It is written to reflect what the product actually does today. [Legal entity name, registered address, and data-controller details to be confirmed by counsel]

02Information you provide

When you create an account and use ClubDojo, you may provide:

• Account basics — your name, email address, and a password. Passwords are stored only as cryptographic hashes, never in plaintext.
• Optional profile details — first and last name, gender, date of birth, phone number, a short bio, a skill level, and a profile photo. All of these are optional; you choose what to share.
• Club activity — resource reservations you book, events and programs you register for, box leagues you join and the match scores recorded in them, posts and announcements you write, and photos you upload.

03Sign-in and security data

• Google or Apple sign-in — if you sign in with Google or Apple, we receive your name and email address from that provider (Google also shares your profile image; Apple does not). We never receive your Google or Apple password. We store the technical sign-in tokens the provider issues so your account stays linked to it.
• Passkeys — if you add a passkey, we store the public-key credential needed to verify it. Biometric data (like a fingerprint or face scan) stays on your device and is never sent to us.
• Two-factor authentication — if you enable it, we store the data needed to verify your second factor, including backup codes.
• Email verification and password reset — we send these messages through our email delivery provider and keep short-lived verification records.

04Information clubs provide about you

Some information about you can reach ClubDojo through a club rather than from you directly:

• A club admin may enter your email address to invite you to join their club.
• A membership holder may invite you to a family membership by providing your email address; you create your own account and fill in your own details when you accept.
• Clubs maintain membership records about you — your role, membership plan, and subscription status.

05Information collected automatically

• Session records — when you sign in, we record the session's IP address and browser user-agent, and when it expires.
• Server logs — standard technical logs used to operate and secure the service.
• Bot protection — the sign-up, sign-in, and password-reset forms use Cloudflare Turnstile to block automated abuse; Turnstile processes technical signals from your browser to tell humans from bots, and Cloudflare may set its own operational cookies for that purpose.
• Cookies and local storage — we use cookies needed to keep you signed in, and your browser's local storage holds small preferences such as your active club and preferred activity. We do not use third-party advertising or analytics cookies.
• Address autocomplete — if you use the address field when creating a club or editing a club's location in settings, the text you type is sent to Google Places to power suggestions.

06Payments

Two separate payment flows run through ClubDojo:

• Member → club (Stripe): when a club charges, membership dues, resource reservations, and social, program, or competition registrations are paid to the club through Stripe. Funds settle directly to the club's connected Stripe account. Stripe collects and processes your card details; we store payment status and non-sensitive references (for example, a checkout session identifier and the amount).
• Club → ClubDojo (Polar): a club's subscription to ClubDojo itself is billed through Polar. Polar collects and processes the card details; we store the subscription's status, tier, and identifiers.

Stripe and Polar act as their own data controllers for the payment data they collect, under their own privacy policies.

07How we use information

• To provide the service: reservations, rosters, events, programs, box leagues, standings, announcements, and notifications.
• To send transactional email — verification, password reset, two-factor codes, and invitations — and to deliver club communications such as announcements and emails your club's admins send to members.
• To provide support and respond to your requests.
• To keep the service secure: preventing fraud, abuse, and unauthorized access.
• To understand usage and improve the product.

We do not sell personal data, and we do not run third-party advertising.

08What your club sees

ClubDojo is club software — joining a club shares information with that club:

• Club admins and owners can see roster details: your name, contact information, profile details you've provided, and your membership and payment status with that club.
• Other members may see your name where club life is visible — on event participant lists and box league standings and match results. Your court reservations are not among these: on the schedule, other members see only that a slot is booked, never your name; club admins and owners can see who booked. Your email address is shown to other members only if you turn on contact sharing for that club (it is off by default); admins and owners can always see it.
• Audiences and gendered play — if you share your gender, your club can use it to run men's or women's competitions and to address club email to a specific audience (for example, all women in the club).
• The public sees club pages (name, location, selected activities, resource count, and member count) — not member personal data.

Club admins are required by our Acceptable Use Policy to use member information only to run their club.

09Clubs and ClubDojo: who is responsible

Clubs on ClubDojo are independent organizations. For the member records a club keeps — its roster, membership plans, notes on bookings, and the communications it sends — the club decides what to collect and how to use it, and ClubDojo processes that information on the club's behalf to provide the software. For your ClubDojo account itself (sign-in, profile, security), ClubDojo is responsible.

If you have a question about how a specific club uses your information, start with that club's admins; questions about the platform come to us. [Formal controller/processor designations and a data-processing agreement for clubs to be prepared with counsel]

10Service providers

We share data with providers who process it on our behalf to run the service:

• Stripe — member-to-club payments and club payout accounts.
• Polar — billing for club subscriptions to ClubDojo.
• Resend — email delivery.
• Cloudflare — storage for uploaded photos and files (R2) and bot protection (Turnstile).
• Google / Apple — sign-in, if you choose it, and Google Places address autocomplete.
• Hosting and infrastructure providers — [final subprocessor list, hosting locations, and data-processing terms to be confirmed before launch]

We may also disclose information if required by law, or to protect ClubDojo, our users, or others.

11Data retention and deletion

• We keep your account data while your account is active.
• Club records — posts, reservations, registrations, match results — are part of the club's operating history and remain with the club while your account exists.
• If a club cancels its ClubDojo subscription, the club's data is not deleted; if the club returns, it picks up where it left off. A club owner can, separately, delete the club from its settings.
• You can delete your account yourself at any time from the account page (“Delete account”). This permanently removes your profile, sign-in methods, club memberships, resource reservations, event and program registrations, posts, uploaded photos, and any club where you are the only member. Membership plans you pay for are canceled with the payment provider as part of deletion.
• Some situations require an extra step first. If you own a club that has other members, transfer ownership or delete the club. If a club only you belong to still has an active ClubDojo subscription, cancel that subscription from the club's billing settings and delete once the paid period ends. And if you appear in recorded competition match results — which are part of a club's league history — self-serve deletion is blocked; contact us and we'll help close out your account.
• You can also request deletion of your personal data by contacting us. [Concrete retention windows to be finalized with counsel]

12Security

Passwords are stored only as hashes; sessions expire; connections to the service are encrypted in transit; payment webhooks are signature-verified; and card data is handled entirely by Stripe and Polar rather than our servers. Optional passkeys and two-factor authentication add further protection to your account. No online service can guarantee perfect security, but we design for it from the start.

13Children and family memberships

Clubs may use family memberships to cover household members, including juniors added by a parent or guardian who holds the membership. [Minimum account age and the approach to children's data to be set with counsel before launch]

14Regional disclosures

[This draft does not yet include region-specific privacy disclosures (for example GDPR or US state privacy laws). Counsel to determine which regimes apply and add the required sections]

15Changes and contact

When this policy changes, we will update it here and revise the date at the top. [Notice mechanism for material changes to be confirmed]

Questions or requests: [email protected].