Privacy Policy

Last updated 7 November 2026

Courtsy (“we”, “us”) runs the Courtsy app, which lets people book and host tennis sessions on private condominium courts in the Klang Valley, Malaysia. This policy explains what personal data we collect, why, who can see it and the choices you have. It is written to meet Malaysia’s Personal Data Protection Act 2010 (PDPA).

What we collect

• Your email address — to sign you in with a one-time code. It is never shown to other people.
• If you sign in with Apple or Google — we receive your name and email address from them to create your account, plus an ID that links your Apple or Google account to Courtsy. With Apple you can choose “Hide My Email”, and we then only get a private relay address that forwards to you. We don’t get your Apple or Google password, contacts or anything else from those accounts.
• Your profile — your name and photo (a photo is needed to book or host, so people can recognise you at the gate), and the short bio and skill level you choose to add.
• Your date of birth — to confirm you’re 18 or over. It’s required, and private: hosts and players never see it.
• Your address and phone number — only if you choose to add them under Personal information. They’re private too, and we only use them to reach you about a booking or a safety issue.
• What you do in the app — courts you list, sessions you open or book, invites, messages in booking chats, reviews you write or receive, and reports or blocks you make.
• Support requests — what you send us through Help & support, with your email, the booking it’s about if you choose one, and your device type and app version so we can help faster.
• Notification token — if you allow notifications, a token that lets us send booking and message alerts to your phone, and the phone type (iPhone or Android).
• Technical data — our hosting provider records basic request logs (such as IP address and time) to keep the service secure and working.

That’s all. We only collect what the app needs to work: no contacts, no microphone, no background location, no advertising ID and no analytics or crash-tracking tools.

What we don’t collect

• Your location is not sent to us. If you allow location access, your phone uses it only to sort courts by distance. It is never stored on our servers.
• Your phone number and address are optional and never shown to other people — messages happen in the booking chat. When you list a court, the condo name you pick is shown so players know where to go.
• We don’t use advertising or third-party tracking.
• Payments aren’t switched on yet, so we hold no card or bank details. We will update this policy before that changes.

Who can see what

• Everyone signed in can see your name, photo, bio, skill level, the courts you list and reviews about you.
• Only you can see your email, date of birth, address and phone number. Courtsy staff look at them only when needed to sort out a booking or safety issue.
• People in the same booking — the host, the booker and invited friends — can see that booking and its chat.
• Courtsy admins can see what’s needed to review reported content, look over new listings and keep people safe.
• Verified resident photos — if you ask for the badge, the photo you send is seen only by Courtsy admins and is deleted as soon as it’s been checked.
• If you block someone, you and they can no longer see each other’s courts or sessions, book with each other or send invites.

Why we use it

To run the service: signing you in, showing courts and sessions, making bookings, letting hosts and players talk, showing reviews, handling reports and preventing abuse. We rely on your consent and on the need to provide the service you asked for. We don’t sell your data.

Services we use

• Supabase — database, sign-in and photo storage. Your data may be stored on servers outside Malaysia.
• Resend — sends your sign-in code emails.
• Sign in with Apple and Google Sign-In — only if you choose them. Apple or Google confirms who you are and shares your name and email with us; see their own privacy policies for what they do.
• OpenStreetMap (Photon by Komoot) — when a host searches for a condo, the text they type is sent to this service to suggest matching places.
• OpenStreetMap tiles — the small map shown when a host places a court’s pin is loaded from OpenStreetMap, which sees your IP address like any website you visit.
• Expo, Apple and Google — deliver notifications to your phone. They receive your notification token and the text of the notification (for example “Aisha booked your court for Sat 8am”).

None of these services may use your data for their own advertising. We don’t use analytics, advertising or social-media SDKs in the app.

Cookies and storage on your device

Courtsy doesn’t use cookies, advertising identifiers or tracking pixels, in the app or on courtsy.my. The app keeps a few things on your own phone (or in your browser’s local storage on app.courtsy.my), all strictly necessary for it to work:

• your sign-in session, so you stay logged in;
• whether you chose light or dark mode;
• whether you’ve finished setting up your profile;
• an unfinished court listing, if you tap “Save & exit”.

Logging out removes your session. Deleting the app (or clearing the site’s data in your browser) removes all of it. Because none of this is used for tracking or advertising, we don’t show a cookie banner.

How long we keep it

We keep your data while you have an account. Resident-check photos are deleted once checked, and server request logs are kept for a short time by our hosting provider. When you delete your account we remove your name, photos, bio and skill level, your date of birth, address and phone number, your notification tokens, blocks, court requests and support requests, delete reviews written about you, cancel your upcoming bookings and hosted sessions, take your listings off Courtsy, and delete your sign-in, so your email can no longer log in. If you signed in with Apple, we also tell Apple to disconnect Courtsy from your Apple ID. Past bookings, messages and reviews you wrote stay so other people’s records make sense, but they show as “Deleted user”. See Delete your account.

Your choices and rights

• Edit your profile at any time in the app under Account.
• Get a copy of your data in the app: Account → Download my data. You get everything we hold about you — account, profile, personal information, bookings, hosted courts and sessions, messages you sent, reviews, blocks, reports, support requests and devices — as a file.
• Delete your account in the app: Account → Delete account, or without the app on this page.
• Turn off notifications or location at any time in your phone’s Settings. Courtsy only asks for notifications after you book or host, and for location only when you tap “Share your location”.
• Under the PDPA you can ask to see or correct the personal data we hold about you, or withdraw consent. Send a request through Help & support or email support@courtsy.my, and we’ll respond within 21 days.

Age

Courtsy is for people aged 18 and over.

Security

Data is sent over encrypted connections, and access rules in our database limit each person to what they are allowed to see. No system is perfectly secure, so please don’t share anything in chats you wouldn’t want others to see.

Changes

If we change this policy we’ll update the date above, and tell you in the app if the change is significant.

Contact

Questions or requests: Help & support, or support@courtsy.my.