PadelTab stores what it needs to run your padel group, and not much else. This page lists all of it. Who runs the service and how to reach them is on the legal notice page.
What gets stored
Your account. Your email address and a hashed form of your password. The password itself is never written to the database; at sign-in we only check that what you typed produces the same hash.
What your group enters. Sessions, venues, court counts, prices, who played, what the evening cost, and the organizer's note about how to be paid. Amounts here are records you type in — PadelTab never touches actual money (more on that in the terms).
Player names. Someone joining a session through its link types a name, and that name is shown to everyone else who has the link. A first name or nickname is enough.
Payment details. A member's own note on how to be paid, and, if they upload one, a QR code or similar image — shown to whoever is settling up. Editing yours later keeps a copy of what a past session already showed, so a correction cannot rewrite what people were told at the time.
Prepaid access. Your trial status, purchased terms and payment reference identifiers. We do not store cards or renew automatically. PadelTab does not receive, hold or transfer money between players (more on that in the terms).
A technical log. Which account did what, and when — created a session, changed a setting. This log never contains player names.
Cookies
Cookies here are required for the site to work. One keeps you signed in. One, set only on a session's player page when you join, remembers that you joined so you can take your name off again. One remembers the language you picked. There are no analytics, no ads, no trackers, and no third-party scripts of any kind — the site's security policy blocks them outright.
One exception applies to these public pages, not to the app: the typefaces they use are loaded from Google Fonts, so opening padeltab.app sends your IP address to Google in order to fetch them. No cookie is set by that request, and nothing about it is stored by us. The app itself makes no such request.
Where the data lives
PadelTab runs on Cloudflare (Workers and the D1 database). Cloudflare processes the data on our behalf and does not use it for its own purposes.
Session links
A session's player page is reachable by anyone who has its link — that is what makes joining work without an account. Treat the link like a group chat: it stays private as long as it is shared carefully. An organizer can hide a session's page at any time, and hiding it takes the player names off the internet immediately.
PadelTab sends two kinds of email. One is a link to reset your password, when someone asks for one for your address. The other is an invitation to join a group, which goes out only when the organizer writing that invitation chooses to type an address for it. There is no newsletter and no marketing.
Anyone who knows your address can ask for that link, so receiving one does not mean your account was touched — the link is useless to whoever asked unless they can also read your mailbox. We limit how many can be sent to one address per hour. To do that we store a one-way hash of the address and of the requesting IP address rather than either value itself, and those counters are deleted within a few hours. A hash of a short value is not a secret from someone who can guess the value and check it, so treat this as us not keeping the list rather than as us protecting it.
Mail is queued before it is sent, so the address it is going to is held with the queued message until it is delivered or given up on. Thirty days after that, the address is erased and only the record that something was sent remains. Delivery itself is carried out by Resend, which receives the address and the message text in order to deliver it.
An address typed into an invitation is held that way and no other way — it is never added to the group's records, so the queued message is the only copy and the same thirty days above are the whole of it. That is also true when the invitation is withdrawn or used before the message goes out: the message stops, and the address is erased on the same schedule rather than straight away. Somebody who is invited and never joins leaves nothing behind once that window passes.
Deletion and your rights
Write to privacy@padeltab.app to have your account deleted. Data that belongs to the group rather than to you alone — sessions, cost records — stays with the group, because the other people in it still need their numbers. Depending on where you live, the law may also give you rights to access, correct, or export your data; the same address handles those requests.