Privacy Policy
The Crew is a private app for your pickleball crew. We collect what we need to run sessions, track scores, and remember rivalries; nothing more. We don't sell your data, we don't run ads against it, and we don't share your contacts or photos with anyone outside your crew.
If you have a question, email privacy@rulethecrew.com.
1. Who we are
The Crew ("we," "us," or "the app") is operated by Jeff Holway, a sole proprietor based in Connecticut, USA. The app is published at rulethecrew.com and through the Apple App Store and Google Play Store under the bundle identifier com.thecrew.app.
This policy explains what information we collect when you use The Crew, how we use it, and the choices you have. It applies to the mobile app, the marketing website, and any related services we provide.
2. Data we collect
We collect only the data needed to run the app's core features. Every category below is linked to your account and is never used for cross-app tracking or advertising.
| Category | What it is | Why we collect it |
|---|---|---|
| Email address | The address you sign up with, or the address returned by Apple or Google when you use Sign in with Apple or Sign in with Google. | Account creation, sign-in, transactional email (verification, password reset, group invites). |
| Name | The display name you enter, plus the name returned by Apple or Google if you use social sign-in. | Shown to other members of groups you join. |
| Profile photo | An optional avatar image you choose from your photo library. | Shown next to your name in groups and game history. |
| User identifier | An internal user ID generated by Supabase Auth (a random UUID). | Joining your account to your gameplay data and group memberships. |
| Device identifier (push token) | An APNs token on iOS or an FCM token on Android, generated by the operating system. | Sending push notifications you opt in to receive (game start, schedule changes, invitations). |
| Gameplay content | Match scores, bracket history, sessions, group memberships, and scheduled-game RSVPs. | Running the core gameplay-tracking features of the app. |
| Payment status | A confirmation that you paid and your subscription tier. Billing details are handled entirely by Apple, Google, or Stripe; we never see or store your full card number. | Granting access to paid features and preventing fraud. |
3. Device APIs we access
Apple requires apps to declare which device APIs they call and why. The Crew accesses the following APIs solely for the listed reasons. None of this data is sent to our servers.
- File timestamps — used by app dependencies for cache invalidation.
- User defaults — used to remember your last-selected group and other UI preferences.
- System boot time — used by app dependencies to schedule timers correctly across device sleep.
- Disk space — used to avoid writing local caches when the device is out of space.
We also access your contacts only when you tap "Add from contacts" while inviting players. Contacts are read locally on your device to suggest names; they are never uploaded to our servers. We store contact info only for people you actually invite.
We access your photo library only when you tap "Change avatar." The image you select is uploaded to our storage so it can be shown to your crew.
4. How we use your information
We use what we collect to:
- Run the app: create accounts, schedule sessions, generate brackets, record scores, maintain standings and head-to-head history, and let your crew see what's happening.
- Send notifications you've asked for, like "your session starts in 30 minutes" or "Mike just challenged your record."
- Process subscriptions and prevent fraud or abuse.
- Diagnose crashes and fix bugs.
- Understand which features matter so we can make the app better.
- Communicate with you about your account, security, or material changes to the app.
- Comply with legal obligations and enforce our Terms of Use.
We do not use your information to build advertising profiles, and we do not sell it. Full stop.
5. Sub-processors
We use a small set of trusted vendors to operate the app. Each vendor processes data only on our behalf and only for the purpose listed.
| Vendor | Purpose | Data processed |
|---|---|---|
| Supabase | Database, authentication, file storage, server-side functions. | Email, name, profile photo, user ID, gameplay content. |
| Resend | Transactional email delivery. | Email address, email body (verification codes, invitations, password resets). |
| Apple Push Notification service (APNs) | Delivering push notifications on iOS. | Device push token, notification payload. |
| Firebase Cloud Messaging (FCM) | Delivering push notifications on Android. | Device push token, notification payload. |
| Vercel | Hosting admin web pages (this page, account deletion, group join links). | Standard web access logs. |
| Apple / Google / Stripe | Subscription billing and payment processing. | Billing details (processed directly by the provider; we receive only subscription status). |
6. Identity providers
You can sign in with email and password, or you can use Sign in with Apple or Sign in with Google. When you use a social sign-in, the provider returns your email address and, optionally, your name. We do not receive anything else from the provider, and we do not send anything to them beyond what is needed to complete the sign-in.
7. Who sees your information
By design, your activity in The Crew is visible to your crew: the other members of the groups you join. That includes session results, standings, head-to-head records, and anything you post in the crew feed. If you don't want a crew to see something, don't post it there.
Beyond your crew, we share information only in the limited cases described in Section 5 above, plus:
- Legal requirements. If we receive a valid subpoena, court order, or similar legal demand, we may have to disclose information. We push back on overbroad requests when we can.
- Safety. If we genuinely believe disclosure is necessary to protect someone from harm, we may share what's needed.
- Business changes. If The Crew is ever sold, merged, or acquired, your information may transfer to the new owner. They'd be bound by this policy or one substantially similar, and we'd notify you of any material change.
8. How long we keep things
We keep your account and crew data while your account is active and as long as we need it to run the service. When you delete your account from inside the app:
- Your account is signed out and locked immediately.
- Your profile, photo, and personal information are scheduled for permanent deletion.
- Permanent deletion runs on a daily background job and completes within 30 days.
- Aggregate gameplay statistics for groups you played in are anonymized: your name is removed but the historical match scores remain so other group members keep their history.
About crew history. The Crew is built around persistent group history, so some records you took part in stay with the crew even after you leave or delete your account. Where a record is meaningful only with names attached (a head-to-head rivalry, for instance), your display name may remain visible to that crew unless you ask us to remove it. Email privacy@rulethecrew.com and we'll handle it.
Invitations to people who never join. If a crew member invites someone who doesn't end up signing up, we hold that person's contact info only long enough to deliver and manage the invitation, and no longer than 90 days, after which we delete it. If you've been invited and want your information removed sooner, email us and we'll delete it.
Backups roll off on a 30-day cycle. Logs and access records are kept up to 90 days unless we need them longer to investigate something.
9. Security
Account passwords are hashed by Supabase Auth using industry-standard algorithms. Session tokens are stored on your device using the platform secure store (iOS Keychain, Android EncryptedSharedPreferences). All network traffic is encrypted in transit with TLS. We also apply row-level security so one crew can't read another crew's data, and we maintain strict access controls on who can see what on our end.
No system is perfectly secure, but we take this seriously and we're paranoid by default. If we ever discover a breach affecting your information, we'll notify you and the appropriate authorities as required by law.
10. Your choices and rights
You can:
- See your data. Your profile, name, email, and group memberships are visible in the Profile screen. Email us for a full export.
- Correct it. Edit your display name, avatar, and email in the Profile screen. For anything else, email us.
- Delete it. Tap Profile, then Danger zone, then Delete account. That removes your profile and personal data within 30 days. As noted above, some session history may remain in anonymized form, and you can ask us to strip your name from a crew's history.
- Turn off notifications. In your device settings or in the app's notification preferences.
- Revoke contacts or photo access at any time in your device settings.
- Cancel a subscription through the App Store or Google Play, depending on where you subscribed.
If you live in California
The California Consumer Privacy Act ("CCPA") gives California residents the right to know what personal information we collect, the right to request deletion, the right to correct inaccurate information, and the right not to be discriminated against for exercising these rights. We don't sell or "share" personal information as those terms are defined under the CCPA. To make a request, email privacy@rulethecrew.com. We may need to verify your identity before responding.
If you live in Connecticut
The Connecticut Data Privacy Act gives Connecticut residents rights similar to those above: to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of targeted advertising or the sale of personal data. We don't sell personal data or use it for targeted advertising. To make a request, email privacy@rulethecrew.com. If we deny a request, you may appeal by replying to our response, and you can contact the Connecticut Attorney General if you have concerns.
If you live in the EEA or United Kingdom
You have additional rights under the GDPR and UK GDPR, including the right to object to processing and to lodge a complaint with your local supervisory authority. Contact us at privacy@rulethecrew.com to exercise any of these rights.
11. Children and teens
The Crew is intended for users 13 and older. We don't knowingly collect personal information from children under 13. If you're a parent and you believe your child under 13 has signed up, email privacy@rulethecrew.com and we'll delete the account and associated data.
If you're between 13 and 18, you should get a parent or guardian's permission before using the app or making any purchases. We do not use the personal data of users we know to be under 18 for targeted advertising, and we don't sell it. A parent or guardian can email us at any time to review, correct, delete, or stop further collection of their teen's personal information.
12. Outside the United States
The Crew is operated from the United States. Our sub-processors operate primarily in the U.S. If you use the app from somewhere else, your information will be transferred to and processed in the U.S., where privacy laws may differ from your local laws. By using the app, you consent to that transfer.
13. Changes to this policy
We may update this policy as the app evolves. If a change is material, we'll let you know in the app or by email before it takes effect. The "Last updated" date at the top will always reflect the current version. Your continued use of the app after a change means you accept the updated policy.
14. Contact us
Questions, requests, complaints, or anything else:
Jeff Holway, sole proprietor
The Crew
Email: privacy@rulethecrew.com