Privacy Policy — Courtovo

1. Who is responsible

HandSoft Kft., Hárslevelű utca 40/a, 1106 Budapest, Hungary, info@handsoft.hu (company registration number: 01-09-865957, registered by the Metropolitan Court of Registration / Fővárosi Törvényszék Cégbírósága).

For the data described in section 3 there is, in practice, nothing for us to be responsible for: it stays on your watch and we never receive it. We are named here because you are entitled to know who publishes the app and where to ask a question.

2. Summary

An account is optional and the app is complete without one: scoring, history, statistics and measurement all work signed out and offline, forever. No advertising. No analytics. No crash reporting. No third-party tracking libraries of any kind.

Legal bases (Art. 6 GDPR). Each kind of processing rests on one of these:

• Performance of a contract — Art. 6(1)(b): the match data synchronised with your Joinovo account, and running that account.
• Legitimate interests — Art. 6(1)(f): the web server's security logging (the IP address recorded with the update check) and keeping support emails.
• Consent — Art. 6(1)(a): recording a location fix and starting the update check, and — together with Art. 9(2)(a) — sharing with your club what your watch measured.

3. What the app stores on your device

Match data. For each match: the format, who served first, every point in the order it was played with the time it happened, and the resulting score. This is the app's purpose. If you type an opponent's name it is stored with the match — see section 6.

Results you enter afterwards. You can also add a match you did not score on the watch: its sport, format, the day and time you give, the set scores and any names you type. It is stored like a scored match, without points or health data, and marked as entered.

Training sessions. You can start a session with nothing to score — no opponent, no score, no winner — when you only want what your watch measures. It is stored the way a match is, with its own start, finish and health data, and it is marked as a session everywhere it appears.

The sport you chose. If you have told the settings which sport you play, it is stored with the session as well — without it a round of golf and an hour in the gym would be the same line in your history. It is only a name you picked from a list. It goes to a club with the match or session it belongs to, whenever that match or session is uploaded (section 4), so the club can tell a football game from a round of tennis; it is never uploaded on its own.

Formats you make. If you make a scoring format of your own, its rules and the name you typed for it are stored on your watch, and the name is kept with every match played under it so the history still says what you called it after you rename or delete the format. The name travels with the match to your phone when you copy your matches there. It is not uploaded to a club: an upload carries a format's rules, never its name.

A training session goes to a club only under a consent of its own. Consent under Article 9(2)(a) GDPR is specific to the purpose it was given for: agreeing to share what your watch measured during a match is not agreeing to share every session. Joinovo therefore asks you separately, per club, and the watch reads the two answers separately — a yes to one is never read as a yes to the other. Until you have given the second one, sessions stay on your watch.

A training session consists entirely of its measurements. There is no scoreline to file without them, which is why a session with no recorded metrics is never sent anywhere, and why there is no way to send a session without the health data in it.

Health data — only if you switch it on. Heart rate, calories, steps and distance, read through Health Services, a component of your watch's operating system. A summary (lowest, average and highest heart rate, calories, steps, distance) is stored with the match or the training session, together with the heart-rate curve of it — at most one reading every five seconds, and less often on the battery-saving power profile, which is the default. Health data is a special category under Article 9 GDPR, which is why each metric has its own switch, why they can all be turned off at any moment including mid-match, and why the app is fully usable with all of them off.

Location — only if you switch it on, and it is off by default. A single position fix taken when a match starts, so the match can record which court it was played on. It is one point, not a track: the app does not follow you and records nothing while you play. The stored fix keeps its accuracy figure; the screen shows the position rounded to about a hundred metres, or the name you gave the place.

Settings. The scoring format, which side of the screen is yours, who serves first, the appearance, the power profile, and which measurements are switched on.

Your club connection — only if you connect one. Your name as Joinovo knows it, the names of the clubs you belong to, and an access token. The token is encrypted with a key generated inside the watch's secure hardware, which never leaves it, so a copy of the app's files is not enough to use the token. Your Joinovo password never reaches the watch and the watch never asks for it.

4. What we receive

If you do not connect a club account: nothing about you. Every feature still works. The one request the app can make without an account is the update check described immediately below, and it is made only if you agreed to it.

The update check. A watch app cannot be told by the Play Store that a new version exists — the Play in-app update mechanism does not exist on Wear OS — so Courtovo can ask our own website instead. It fetches one small file from courtovo.com saying which version is the newest, compares that with the one you have, and tells you on the home screen if you are behind. Tapping that opens the Play Store, which is what installs the update: the app never downloads or installs anything itself.

The request contains no account, no name, no device identifier and nothing about your matches. Like any visit to a website it reaches our web server with your IP address, the time, and which version is asking. That is what a web server records — for this request and for any visit to courtovo.com — and it is deleted after 14 days: long enough to trace a fault or an attack back, and no longer.

It is asked, never assumed. On the first launch the app asks whether it may check, and "no" is a complete answer: nothing is sent unless you tap Check now in Settings yourself. The answer is changeable in Settings at any time, in both directions.

If you connect one, the watch talks to Joinovo, which is run by the same company as this app and has its own privacy policy. During the connection it sends the model name of your watch, so you can tell your devices apart in the list, and it receives your name, the names of your clubs and an access token. You approve the connection in a browser where you are already signed in; the watch never sees your password.

Once you connect an account, your finished matches are uploaded to the club you selected. That includes matches you recorded before connecting: connecting is what creates the copy, and it copies what is already there. A result you entered afterwards is uploaded the same way, with its set scores in place of a point log. This holds for every sport and every line-up: a team match — volleyball with more than two a side, a football, handball or basketball game — is uploaded like any other.

What is uploaded is the match: the sport, the scoreline, when it started and finished, how it ended, and the point-by-point log the watch keeps — who won each point, the ends, a retirement. What is not uploaded is the venue fix, or the opponent name you typed on the watch. Those stay on the watch.

For a doubles match you started from one of your club's court bookings, the line-up goes with it — the four players' names, and the club member ids of those the booking already identified, yourself included. Those names came from that club and go back to that club, and to no one else. The club matches a name to a member only for people who were already on that booking; anybody else is recorded as a name attached to no account. See section 6.

A training session is uploaded only under the separate consent described in section 3, and to the club selected on your watch when it is sent. It goes whole and in one piece: when it started and finished, the sport, the lowest, average and highest heart rate, the calories, the steps, the distance and the heart-rate curve. There is nothing to send before that consent and nothing to add after it. A session with nothing measured on it is never sent. Like a measurement, an uploaded session is visible to you alone.

What your watch measured during a match is uploaded only if you say so. Heart rate, calories, steps and distance stay on the watch unless three separate conditions are met: your club's plan includes the feature, the club has enabled it, and you have given that club your explicit consent in Joinovo. What is uploaded then is a summary of the match — lowest, average and highest heart rate, calories, steps, distance — as well as the match's heart-rate curve. The club deletes the heart-rate curve one year after the match rather than keeping it as long as the numerical summaries.

The watch asks the server what you have consented to before it sends anything, rather than remembering the answer. That is why withdrawing your consent works even if your watch was switched off at the time: there is no message for it to miss.

Consent is given to one club at a time, and withdrawing it deletes. Each club is asked separately, because giving one club your heart rate says nothing about the next. Withdrawing your consent in Joinovo does not only stop future uploads — it deletes the measurements that club already holds, and moving a match to another club deletes them for the same reason. In Joinovo a measurement is visible to you alone: not to the people you played, not to club administrators, not to tournament organisers.

The two consents are withdrawn separately as well, and each withdrawal deletes only what that consent covered: withdrawing the one about matches deletes that club's copy of what your watch measured during your matches, and withdrawing the one about sessions deletes that club's copy of your sessions. Neither touches the other, and neither touches what is on your watch.

The watch also receives. With an account connected, it shows today's court bookings from your clubs, and that includes the names of the people booked on court with you. It is the same list you already see in Joinovo; it is on your wrist so that a match can record who played without you typing it. Nothing about those people is stored on the watch beyond the day's list, and picking a booking sends nothing but its number.

An uploaded match is visible to you and to nobody else until you decide otherwise in Joinovo. Naming who you played against, and letting them see the result, is done there and is your choice.

Disconnecting the watch stops any further uploads and clears any queued data. Copies already on the server are not withdrawn by disconnecting — they are yours, in your account, and you manage or delete them in Joinovo.

If you write to us. courtovo.com invites you to send a bug report or a feature request by email. That mail reaches us with your email address and whatever you chose to put in it — which, for a bug report, is usually your watch model, your Wear OS and Courtovo versions and what happened. We use it to answer you and to fix or build what you wrote about, and for nothing else. It is not linked to anything from the app, because unless you connected a club account we hold nothing from the app to link it to. Writing to us is entirely your choice; if you would rather not be identifiable, write from an address that does not identify you.

5. Permissions, and what each one is for

Internet access is not in the table, because it is not a permission you are asked about: it is granted when the app is installed and cannot be declined separately. It is used for one thing, and only when you have connected a club account — talking to Joinovo. Section 4 describes everything that travels over it.

Every permission may be refused, and refusing is a normal way to use the app. Scoring a match depends on none of them. The app asks only at the moment a permission is actually needed — when you start a match with the relevant measurement switched on — and never blocks anything if you decline.

Heart rate and movement are read through Health Services, part of the operating system supplied by your watch's manufacturer. What that system component itself does with sensor data is governed by your watch manufacturer's privacy policy, not by this one.

6. Someone else's name

Other people's names reach this app in exactly two ways, and never from your contacts: the app never reads them and never fills a name in for you.

A name you type — an opponent in singles; a partner and two opponents in doubles when no court booking names them — is another person's personal data, and you are the one who decided to write it down. It is stored with the match on your watch, and copied with the match to your phone if you copy your matches there. It is never uploaded to a club or anywhere else, it is not remembered for a later match once the app is closed, and it is deleted with the match. A name you type is never mixed into a line-up that came from a booking.

The line-up of a doubles match comes from your club's own court booking. When you say which of the people on it is your partner, the watch stores all four — their names, and the member ids the club already attached to them — and sends them to that club with the match. Three things follow, and they are the whole of it: the names come from that club and go nowhere else; the watch can name nobody the club had not already shown you on that booking; and deleting the match on your watch deletes them with it. If you never pick a booking, or never play doubles, none of this ever happens.

Your own name and member id are always part of that line-up. That is what tells the club which pair was yours, and without it your own result could be recorded against the wrong side.

7. How long it is kept, and how to delete it

Match data is kept until you delete it. There is no automatic expiry, because a match you played three years ago is exactly the sort of thing a match history is for.

• The match you are playing: match menu → "End match" → "Discard match". It is deleted instead of being recorded, so nothing about it is kept at all.
• One match already recorded: open it in Matches and choose "Delete match".
• Everything: uninstall the app. All match data and settings are removed with it.

A club connection, if you made one, is separate from your matches and outlives them: it stays until you end it. Disconnect on the watch makes this watch forget the token; Remove in Joinovo withdraws the access itself, immediately and everywhere, and is the one to use if a watch is lost. Uninstalling the app removes the copy on the watch but does not withdraw the access, because an uninstalled app cannot tell anyone.

Apart from that connection, nothing was ever sent anywhere, so deleting on the watch is deletion — there is no copy elsewhere to chase.

Mail you sent us is kept while we are dealing with what you wrote and for as long as it explains a decision — a bug report is part of the record of why something changed — and at the latest until twelve months after the last message in the exchange. Ask at any time and we delete it sooner, unless we are required to keep it.

8. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection, and the right to complain to a supervisory authority (in Hungary: NAIH, the Hungarian National Authority for Data Protection and Freedom of Information, 1055 Budapest, Falk Miksa utca 9–11, www.naih.hu; in Austria: Datenschutzbehörde).

For everything that stays on your watch these rights are exercised on your own device, because that is the only place the data exists: you can read it in the app, correct it (undo a point, rename a venue), and delete it. We cannot produce a copy of those matches on request for the same reason we cannot lose them — we do not have them.

Where you have connected a club account, the copies described in section 4 are held in Joinovo, and the same rights are exercised there: access, correction, export and erasure are part of that account and reach the copies it holds. Withdrawing a consent deletes what that consent covered, as section 4 describes. Deleting a match on the watch does not delete the copy in Joinovo, and deleting the copy in Joinovo does not delete the match on the watch — they are two records, and each is removed where it lives.

If you contact us about the app itself, we process what you send in order to answer you, and keep it only as long as answering requires.

9. The app stores

Downloading the app involves Google Play or the Samsung Galaxy Store, which collect their own data about the download and about your device. That processing is theirs and is governed by their privacy policies, not by this one. We receive from them only aggregate statistics that identify nobody.

10. Children

The app is not directed at children under 16. Counting a match needs no account and sends nothing anywhere, so a child can use it exactly as an adult can and we receive nothing either way. Connecting a club account is a different matter: it requires a Joinovo account, which is a club's membership record, governed by Joinovo's own privacy policy and by that club's own rules about minors. This app asks for no age and is not in a position to check one.

11. Changes to this policy

Every published version of this policy carries a version number and the date it takes effect, shown at the top. If a version of the app changes what it stores or sends, a new version of this policy is published with that release, not afterwards, and it lists at its end what changed from the previous published version.

12. Contact

info@handsoft.hu for anything in this policy — a question, or a request under section 8.

support@courtovo.com for a bug report or a feature request. Either address reaches us; they are separated so that a data protection request is not lost in a support queue.