Privacy Policy
Effective: 2026-05-29
The Crew is a private-group pickleball tracking app operated by Jeff Holway, a sole proprietor based in Connecticut, USA. This policy explains what data we collect, why we collect it, who we share it with, and the rights you have over your data.
1. Who we are
The Crew (formerly The Kitchen) is published by Jeff Holway, a sole proprietor based in Connecticut, USA. The app is distributed on the Apple App Store and Google Play Store under the bundle identifier com.thecrew.app. Contact: privacy@rulethecrew.com.
2. Data we collect
We collect only the data needed to run the app's core features. Every category below is linked to your account and is never used for cross-app tracking or advertising.
| Category | What it is | Why we collect it |
|---|---|---|
| Email address | The address you sign up with, or the address returned by Apple / Google when you use Sign in with Apple or Sign in with Google. | Account creation, sign-in, transactional email (e.g., email verification, password reset, group invites). |
| Name | The display name you enter, plus the name returned by Apple / Google if you use social sign-in. | Shown to other members of groups you join. |
| Profile photo | An optional avatar image you choose from your photo library. | Shown next to your name in groups and game history. |
| User identifier | An internal user ID generated by Supabase Auth (a random UUID). | Joining your account to your gameplay data and group memberships. |
| Device identifier (push token) | An APNs token on iOS or an FCM token on Android, generated by the operating system. | Sending push notifications you opt in to receive (game start, schedule changes, invitations). |
| Gameplay content | Match scores, bracket history, sessions, group memberships, and scheduled-game RSVPs. | Running the core gameplay-tracking features of the app. |
3. Device APIs we access
Apple requires apps to declare which device APIs they call and why. The Crew accesses the following APIs solely for the listed reasons. None of this data is sent to our servers.
- File timestamps - used by app dependencies for cache invalidation.
- User defaults - used to remember your last-selected group and other UI preferences.
- System boot time - used by app dependencies to schedule timers correctly across device sleep.
- Disk space - used to avoid writing local caches when the device is out of space.
We also access your contacts only when you tap "Add from contacts" while inviting players. Contacts are read locally to suggest names; they are never uploaded to our servers.
We access your photo library only when you tap "Change avatar." The image you choose is uploaded to our storage so it can be shown to your crew.
4. Sub-processors
We use a small set of trusted vendors to operate the app. Each vendor processes data only on our behalf and only for the purpose listed.
| Vendor | Purpose | Data processed |
|---|---|---|
| Supabase | Database, authentication, file storage, server-side functions. | Email, name, profile photo, user ID, gameplay content. |
| Resend | Transactional email delivery. | Email address, email body (verification codes, invitations, password resets). |
| Apple Push Notification service (APNs) | Delivering push notifications on iOS. | Device push token, notification payload. |
| Firebase Cloud Messaging (FCM) | Delivering push notifications on Android. | Device push token, notification payload. |
| Vercel | Hosting the admin web pages (this page, account deletion, group join links). | Standard web access logs. |
5. Identity providers
You can sign in with email and password, or you can use Sign in with Apple or Sign in with Google. When you use a social sign-in, the provider returns your email address and (optionally) your name to us. We do not receive anything else from the provider, and we do not send anything to them beyond what is needed to complete the sign-in.
6. How long we keep your data
We keep your account data for as long as your account is active. When you delete your account from inside the app, the following happens:
- Your account is signed out and locked immediately.
- Your profile, photo, and direct messages are scheduled for permanent deletion.
- Permanent deletion runs on a daily background job and completes within 30 days.
- Aggregate gameplay statistics for groups you played in are anonymized: your name is removed but the historical match scores remain so other group members keep their history.
7. Your rights
You have the following rights over your data. All of them can be exercised inside the app.
- Access - your profile, name, email, and group memberships are visible inside the Profile screen.
- Correction - edit your display name, avatar, and email in the Profile screen.
- Deletion - tap Profile then Danger zone then Delete account to permanently delete your data within 30 days.
- Portability - email privacy@rulethecrew.com for an export of your data.
- Objection or restriction - email privacy@rulethecrew.com with your request.
If you are in the European Economic Area, the United Kingdom, or California, you have additional rights under the GDPR, UK GDPR, and CCPA respectively. Contact us using the email above to exercise them.
8. Children
The Crew is intended for users aged 13 and older. We do not knowingly collect data from children under 13. If you believe a child has signed up, contact privacy@rulethecrew.com and we will remove the account.
9. Security
Account passwords are hashed by Supabase Auth using industry-standard algorithms. Session tokens are stored on your device using the platform secure store (iOS Keychain, Android EncryptedSharedPreferences). All network traffic is encrypted in transit with TLS.
10. International transfers
Our sub-processors operate primarily in the United States. If you access the app from outside the United States, your data may be transferred to and processed in the United States.
11. Changes to this policy
If we make material changes to this policy, we will update the Effective date at the top of this page and notify active users by email or in-app message.
12. Contact
Questions, requests, or complaints: privacy@rulethecrew.com.