Privacy Policy

Your account. Your name, email address, and — only if you give it — a phone number. Your email is verified before you can post or join a game.

Your profile. Rating and rating system, formats and session types you like, play style, the general area you play in, your club, and a short bio. This is what a stranger sees when deciding whether to play you.

Your play. Sessions you post or join, and — if you have claimed a league identity — the public match record already published by that league.

What you write. Messages, posts, and post-match notes.

Calendar availability, if you connect a calendar. See the next section, which is specific.

Technical data needed to run the service: a session cookie, and a device token if you enable push notifications.

Connecting a calendar is optional and everything else works without it.

When you connect one, Sessions requests a single Google scope: https://www.googleapis.com/auth/calendar.freebusy. That scope returns only the start and end times of periods when you are busy. It does not return, and Sessions therefore never receives, the titles of your events, their descriptions, locations, attendees, organisers, or any attachment.

We use those busy periods for exactly one purpose: to suggest times when you and another player are both free, so that arranging a match does not require a chain of messages. We look at a rolling two-week window ahead.

Those busy periods are stored on our servers and replaced wholesale each time your calendar syncs. Your Google access and refresh tokens are stored encrypted. When you disconnect a calendar, the stored busy periods and the tokens for it are deleted. If you delete your account, they go with it.

Sessions’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely: we do not sell Google user data, we do not use it for advertising, we do not use it to train generative AI or machine-learning models, we do not transfer it to others except as necessary to provide this feature or to comply with law, and no human reads it except where you have asked us to help with a specific problem or the law requires it.

You can revoke access at any time from your Google account permissions, or by disconnecting the calendar in your Sessions profile.

The exact location of a game is revealed when the person hosting it accepts you, and by nothing else. Before that, everyone sees only the general area.

Post-match notes about another player are visible to you and, when the match was played for a team you are on, to that team. They are never shown to the person they are about, never appear in a feed or a search result, and never cross to a partner.

Public surfaces — feeds, search, player lists — carry a name and a club label. Your email address and phone number are never included in them.

Blocking works in both directions and reveals nothing: neither person can message or see the other, and no wording anywhere indicates who blocked whom.

Files you attach are stored privately and served through short-lived links that authorise each request.

Sessions works with CourtTime, a separate club-management product. If you arrive from CourtTime, the link that signs you in carries your email address and a club label, and nothing else. With your verified email address as authorisation, we may import your existing profile from CourtTime to save you filling it in again; that import only ever fills fields you have left blank.

What CourtTime can see of Sessions is deliberately narrow: that a game exists, roughly where and when. Not the roster, not the exact location, not notes, not ratings, and never anyone’s contact details.

If you play in a league Sessions reads, your results there are already published by that league. Claiming your league identity links that public record to your account so it shows up as yours. It does not give Sessions access to your league login unless you explicitly choose to store one, and you can choose instead to type your league password only when you act, in which case it is never written to our disk.

You may be reading this because a player typed your name and email into Sessions to invite you, and you never signed up. That is the one case where we hold information about someone who has no account, so it is worth being exact about it.

What we hold is what they gave us: your name, your email address, sometimes a phone number, whichever league record they thought was yours, and who invited you. We use it for one thing — sending that invitation and, if you follow it, showing you the record waiting to be claimed. We do not sell it, we do not advertise against it, and we do not hand it to another company.

We never text a phone number belonging to someone who has not signed up. If a member gave us your number it stays on their invitation so they know who they invited; it is not a destination we send to.

Every invitation has an unsubscribe link. Using it stops all Sessions email to that address permanently and blocks any future member from inviting it — we keep the address on a suppression list precisely so that we can keep saying no on your behalf. You can also write to us and ask us to delete an unclaimed invitation outright.

Your account data is kept while your account exists. Calendar busy periods are replaced at each sync and deleted when you disconnect.

You can close your account yourself, from Settings, and it happens immediately. That deletes your profile, your match notes, your calendar connections and their tokens, the games you were hosting, and the messages and posts you wrote — including from conversations other people can see, because they are your words. A team or group chat you created stays with the people still in it. Notes other players wrote about their own matches belong to them and are not affected. We keep nothing except where the law requires it.

You can edit or clear your profile at any time, disconnect a calendar, turn off any category of notification, block another player, and close your account entirely — all from within the app. To ask what we hold about you or to have it corrected, write to us at the address below.

Every email we send that is not about your own account carries an unsubscribe link, and one click is all it takes — no sign-in, no form, no reply required. If you do not have an account, that link is also how you tell us to stop: it puts your address beyond the reach of any future invitation.

Sessions is not intended for children under 13, and we do not knowingly collect their information. If you believe a child has created an account, tell us and we will remove it.

If this policy changes in a way that affects what we do with your information, we will say so here and update the date at the top.

Daeda Group, LLC, North Carolina, USA. Questions about privacy, or a request about your data: support@sessions.tennis.