We collect only what we need to run Courtlines: your name, email, phone, date of birth (for waivers), bookings, purchases, and playing history. Courtlines does not put advertising pixels on its own pages; the analytics we do use, and the tags a club can add to its own pages, are listed under “Analytics, cookies and club-added tags” below.
What we collect
- Account info: email, name, phone (optional), home zip (optional)
- Booking + transaction history (used to recommend programs)
- Sign-in details: if you use “Continue with Google”, we receive your name and email address from that provider. If you add a passkey, we store only its public key; the private key never leaves your device.
- Device info (browser, IP) for security and fraud prevention
- Usage data: the pages you view and the actions you take, collected by the analytics tools below
- Marketing preferences (email / SMS / push opt-ins)
How we use it
- Run your bookings, memberships, and check-ins
- Send transactional emails + SMS (confirmations, reminders)
- Send push notifications to your phone or browser, if you allow them
- Marketing emails + SMS if you've opted in (unsubscribe anytime)
- Aggregate analytics to improve the product — no personal data sold
Payments
Card details are tokenized by Stripe. We never store raw card numbers; we only keep the last 4 digits + brand for display. Card-reader payments at a club's front desk (Stripe Terminal) and Apple Pay are processed by Stripe in the same way.
AI features
Some features (the nightly business advisor, marketing copy drafting, support-message classification) send relevant club data to Anthropic's API to generate a response. This is scoped to the operating club's own data — never another club's — and is never used to train models. The optional MCP connector is opt-in per club and exposes only read-only, scoped views plus one narrow write action; a club that doesn't enable it is unaffected. When a club's administrator connects an AI app to it, what the connector returns goes to that app under its provider's terms.
Analytics, cookies and club-added tags
- Sign-in cookies keep you signed in. They are required for the app to work and are not used for analytics.
- PostHog measures how the product is used on every Courtlines page, including club pages: page views, clicks and session replays. Replays mask all text and everything typed into forms, and web addresses are stored without their query strings. PostHog sets a cookie and a browser storage entry to recognise a returning visitor.
- Google Analytics, loaded through Google Tag Manager, measures visits to courtlines.com, our own marketing site. It sets cookies whose names start with “_ga”.
- A club can add its own Google Tag Manager container to its Courtlines pages. The tags a club places there, which can include advertising pixels, are the club's own and are covered by the club's privacy policy.
- Club web addresses served through Cloudflare can include Cloudflare Web Analytics, a page-view count that sets no cookies.
- A club's branded mobile app includes Google Firebase Analytics and Meta's app SDK (for measuring ad conversions) only if that club turns them on.
Data export + deletion
Email privacy@courtlines.com for a full export of your data (GDPR/CCPA) within 30 days. Deletion available on request except for records we're legally required to keep (waivers: 7 years after deactivation). You can also delete your account yourself from the app — see Delete your account.
Who we share with
These service providers process data for us, each under its own privacy policy:
- Stripe — payments, including front-desk card readers and Apple Pay
- Supabase — database, sign-in and file storage
- Railway — application hosting
- Upstash — rate limiting and short-lived caching (IP addresses, email addresses and account IDs, used as counters)
- Resend + Mailgun — email
- Twilio — SMS
- Expo — push notifications to the mobile app (a device push token); web push notifications go through your browser's own push service
- Anthropic — AI features
- Sentry — error tracking
- PostHog — product analytics and masked session replay
- Google — Google Analytics on courtlines.com, and “Continue with Google” sign-in
- Cloudflare — network delivery and security for club web addresses