Privacy Policy

1. Information We Collect

1.1 Information you provide

• Account information: your email address and name, and authentication identifiers managed by third-party sign-in providers (Google, Apple).
• Organization and membership information: organization names, roles, rosters, team and program details, and member profiles you or your organization create.
• Player and member profiles: display name, profile photo, sport(s), and competition details (such as registrations, results, and ratings).
• Tournament and registration information: entries, divisions, schedules, scores, and standings.
• Communications: messages, support requests, and feedback you send us.
• Additional profile details you choose to add: date of birth, gender, and a public @handle.
• Age range and privacy choices: when you sign up we ask for your date of birth to work out your age range, and your account keeps only the age range. It also keeps your choices about usage analytics, screen recordings, and tips and offers, the policy version you made them under, and a history of your changes to them. Your age range decides which choices are open to you: usage analytics needs 13 or older, and screen recordings and tips and offers need 18 or older.
• Home location: a place you type in to personalize your home feed and tournament recommendations. We resolve what you type into a city, province or state, country, and postal code, and store that on your profile. The postal code is used for regional ranking and is not displayed back to you.
• Contacts you choose to share: if you grant the mobile app permission to your device address book, we send us a one-way hash of each contact email address so we can show you which of your contacts already use iMatch. We do not retain those hashes.
• Invitations you send: if you invite one of your contacts, we store that person's email address in plain text so the invitation can be attributed to you and reconciled. That person is not contacted by us and does not receive an iMatch account; the record is deleted when your own account data is purged.
• Video, photo, and audio you upload or capture: match video you submit for review, images you attach, and live audio and video when you broadcast a match.

1.2 Information collected automatically

• Usage data: pages viewed, features used, and basic device/browser information, used to operate and improve the Service.
• Essential cookies: required for sign-in, sessions, and security on the authenticated portal. The public organization websites are read-only and do not set first-party tracking cookies.
• Content engagement in the mobile apps: which cards in your home feed were shown to you, which you tapped, and how long each was on screen. These events are linked to your account, are used to rank what we show you, and are retained for 90 days.
• Product analytics: the iMatch app for iPhone and Android, iMatch Manager for Mac and iPad, imatch321.com, and imatch.tv send our service provider PostHog (PostHog, Inc., United States) records of how they are used: which features and pages are used, how quickly website pages load and respond, when an app is opened or moved to the background, and the app version, device maker and model, operating system, language, time zone, screen size, and type of network connection. When you are signed in, this happens only if your account's "Usage analytics" choice is on and your age range is 13 or older, and the records are linked to your account identifier, together with your age range and your privacy choices; our servers also record organizer actions, such as creating a tournament or certifying a result, linked to your account under the same choice. On imatch321.com and imatch.tv, if you are not signed in, it happens only after you allow it in the analytics prompt and confirm you are 13 or older. Without that, and when you are signed in with "Usage analytics" off, imatch321.com and imatch.tv still count each page view anonymously: the shortened page address, the site that linked to it, how long the page stayed open, how quickly it loaded and responded, and the type of device, browser, and screen. Nothing is stored in your browser for this, the counts are not linked to your account, and they record nothing about the features you use. To tell visitors apart for a single day, PostHog combines your IP address and browser details with the date into a code that changes every day, and then discards the IP address. Browsers that send a Do Not Track or Global Privacy Control signal are not counted at all. If you are signed in to iMatch TV on imatch.tv, everyone who uses that screen is counted under your account while it stays signed in. Apart from those anonymous counts, PostHog keeps random identifiers for each device or browser to tell visits apart. The records contain no names, email addresses, or phone numbers, and page addresses are shortened before they are sent. PostHog receives your IP address when records are sent, and we ask it not to store it or use it to find your location, except that PostHog may use it when the Android app checks which features to try. PostHog is also used to try out some features with some accounts first. The mobile apps do not collect or use the device advertising identifier. App releases from before this change send usage analytics to Google Firebase Analytics instead.
• Screen recordings: if you are signed in and your account's "Screen recordings" choice is on, which also needs usage analytics on and an age range of 18 or older, PostHog records how the iMatch app for iPhone and Android, imatch321.com, and imatch.tv are used, so we can find problems. Recordings hide all text, what you type, images, and video, and are never made of screens or pages with personal details, codes, contacts, payments, or support chat, or of account and settings pages. iMatch Manager makes no recordings, and people who are not signed in are never recorded.
• Crash, error, and performance reports: the mobile apps, the website, and our servers send our service provider Sentry a report when something fails, and timings for a sample of screens, pages, and requests. A report describes the failure, where in our code it happened, a short record of the app events just before it (for example the screen shown and the path of recent requests to our servers, with any query values and identifiers removed), and the app version, device model, and operating system. We remove names, email addresses, account identifiers, and similar details before a report is sent, except that while usage analytics is on (see Product analytics above), a report from the mobile apps carries your account identifier, and reports from the mobile apps and the website carry a link to the matching analytics record. The mobile apps attach a random identifier for the app installation so we can count sessions without a crash; it is not linked to your account unless usage analytics is on. Sentry receives your IP address when a report is sent, and we have set Sentry not to store IP addresses. Sentry records an approximate location (city and country) derived from your IP address; the address itself is not stored. These reports are not used for advertising or to track you across other companies' apps or websites. Mobile app releases that don't yet use Sentry send crash reports to Firebase Crashlytics instead.
• Push notification tokens: issued by Apple or Google so we can deliver match and tournament notifications to your device.

1.3 Payment information

• Tournament entry fees and registration payments are processed by our payment processor (Stripe). We do not store full payment card details on our servers.
• We receive transaction confirmations and limited billing metadata needed to reconcile registrations.
• Subscriptions bought inside the mobile apps are processed by Apple or Google. We receive a purchase token, the product identifier, and the subscription status so we can activate and renew your entitlement. We do not receive your payment card details from either store.

1.4 Your YouTube channel (YouTube API Services)

iMatch uses YouTube API Services, provided by Google, to let you stream a match to your own YouTube channel. Connecting a channel is optional. Apart from a short check when you connect (described below), nothing is sent to your channel unless you choose it for a stream. Google's Privacy Policy (https://www.google.com/policies/privacy) applies to the information Google processes, and YouTube's Terms of Service (https://www.youtube.com/t/terms) apply to your use of YouTube.

• What you allow: you sign in with Google in your device's browser and allow iMatch to "Manage your YouTube account". Google then gives our servers an access token and a refresh token. We never see your Google password, and the iMatch app on your device never receives these tokens.
• What we read: your channel's ID and name. When you connect, we also check that your channel can stream live, by creating a test stream entry on it, titled "iMatch connection check", and deleting it straight away. If YouTube does not let us delete it, the entry stays in your channel's stream settings in YouTube Studio, where you can delete it; it carries no video.
• What we store while you are connected: your channel's ID and name, the permission you granted, the refresh token (encrypted with a key held in Google Cloud Key Management Service), whether the connection still works, the YouTube privacy setting you last chose, and when you connected. We do not store access tokens.
• What happens when you stream to YouTube: for each stream you choose to send there, we create a live broadcast and a live stream on your channel, titled from the tournament, event and court (never a player's name), with the privacy setting you choose (unlisted unless you choose otherwise). We then send the video and audio of your stream to YouTube. We keep the broadcast and stream IDs with our record of the stream. The stream key YouTube issues is held only by our media servers while the stream runs and is never stored in our database. When the stream ends, we end the broadcast and the stream key stops working.
• How we use it: only to provide this feature: to set up, start and end broadcasts on your channel, to send your stream there, to show you which channel is connected and a link to watch your broadcast on YouTube, and to tell you when the connection needs your attention. We do not sell YouTube data or use it for advertising.
• Who receives it: YouTube (Google) receives the video and audio of your stream, its title and its privacy setting, because you asked us to stream there. Who can watch depends on the privacy setting you chose and on YouTube. Everyone who can be seen or heard in the match appears in what is published on your channel. We do not share your YouTube data with anyone else, other than the hosting providers we use to run the Service and as described in Section 6 for legal and safety reasons and business transfers.
• How long we keep it: we keep your connection while you stay connected, and check it with Google about once a week, which also refreshes your channel's name. We delete the YouTube IDs of each stream no later than 30 days after the stream ends. A broadcast that went live stays on your YouTube channel as YouTube keeps it; you manage or delete it in YouTube, and disconnecting iMatch does not remove it.
• Disconnecting: you can disconnect at any time in the iMatch app, under Connected accounts (in Me on iPhone and in Settings on Android). We then revoke iMatch's access at Google and delete your connection straight away. If you delete your iMatch account, we do the same and also delete the YouTube IDs of your streams.
• Revoking access through Google: in addition to disconnecting in the app, you can revoke iMatch's access to your data at any time through the Google security settings page at https://security.google.com/settings/security/permissions. If you do, or if the access expires, we stop using the connection and delete it within 30 days.
• YouTube pages in the app: when you open a YouTube video inside the iMatch app, the page is YouTube's own. YouTube may show its own content and advertisements there and may place cookies or collect information on your device, under Google's Privacy Policy.
• Questions or complaints about how we handle YouTube data: contact our privacy officer using the details in Section 12.

2. How We Use Your Information

We use the information we collect to:

• Provide the Service: operate organization accounts, memberships, tournaments, ratings, and public organization websites.
• Authenticate and secure accounts: verify identity and protect against unauthorized access.
• Process registrations and payments: complete tournament entries and send confirmations.
• Stream to your own YouTube channel when you choose to (Section 1.4).
• Communicate with you: send service-related notifications, respond to inquiries, and (where permitted) share updates.
• Improve the Service: understand usage to enhance features, reliability, and performance.
• Comply with law: meet legal, regulatory, and safety obligations.

3. Information on Public Organization Websites

Public organization pages (rosters, rankings, news, tournaments) may display a member's display name, profile photo, sport, and competition details such as rating, results, and standings.

Public pages do NOT expose legal name, date of birth, email address, phone number, authentication identifiers, or internal account metadata. Organizations control which sections of their site are published and which members appear.

4. Organizations as Controllers; Roles and Responsibilities

Many users interact with iMatch through an organization (a club, league, or academy). The organization decides what member information to collect and publish on its site and is responsible for having a lawful basis and any necessary consents for that information. We process member information on the organization's behalf to provide the Service.

If you are a member and have questions about how your organization uses your information, please contact your organization directly. You may also contact us using the details in Section 12.

5. Children's and Youth Information

We do not knowingly collect personal information directly from children outside of an organization's managed membership. If you believe a minor's information has been provided to us without appropriate consent, contact us and we will work with the organization to address it.

6. How We Share Information

We do not sell, rent, or trade your personal information. We share information only as follows:

• Within your organization: with administrators and members as needed to operate the organization on iMatch.
• Service providers: with vendors who help us run the Service under confidentiality obligations. These currently include Google Cloud and Cloudflare (hosting and delivery), Google Firebase (authentication, push notifications, and analytics and crash reporting in earlier app versions), Sentry (Functional Software, Inc., United States) (crash, error, and performance reports), PostHog (PostHog, Inc., United States) (product analytics and screen recordings), Google Sign-In and Apple Sign-In (authentication), Stripe (payments), and Apple and Google (in-app subscriptions). Where you enter a home location, the text you type is sent to the Google Geocoding API to resolve it.
• At your direction: if you connect your YouTube channel and choose it for a stream, the stream goes to YouTube (Google) as described in Section 1.4.
• Legal and safety: when required by law, legal process, or to protect rights, safety, and the integrity of the Service.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your consent: for any other purpose disclosed to you at the time.

7. Data Security

We use technical and organizational measures designed to protect personal information, including encryption in transit, encryption at rest for stored data, access controls that limit who can access data, and reputable cloud infrastructure. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Data Retention

We retain personal information for as long as needed to provide the Service, while your account or organization membership is active, and thereafter as required to comply with legal obligations, resolve disputes, and enforce our agreements. Payment records are retained as required by law. When information is no longer needed, we delete or de-identify it.

• Content engagement events (Section 1.2) are retained for 90 days.
• Contact email hashes used for matching are not retained.
• An invitation record, including the invited person's email address, is retained until your own account data is purged.
• Payment and subscription records are retained for 7 years.
• Support correspondence is retained for 2 years.
• YouTube connection data is kept and deleted as described in Section 1.4.
• Deleted data may persist in encrypted backups for up to 90 days before those backups age out.
• Crash, error, and performance reports held by Sentry are deleted automatically within 90 days, and some data sooner.
• Product analytics records and screen recordings linked to your account are erased from PostHog when you delete your account: we ask PostHog to erase them starting 90 minutes after your request, and PostHog removes them in its next deletion run. Your age range and privacy choices are deleted with your account.

9. Your Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, and to object to or restrict certain processing. To exercise these rights, contact us using the details in Section 12. Members managed by an organization should also contact that organization.

9.1 Canada (PIPEDA)

If you are in Canada, you may access and request correction of your personal information, withdraw consent (subject to legal or contractual limits), and complain to the Office of the Privacy Commissioner of Canada. You can turn usage analytics and screen recordings off at any time in the privacy settings of the iMatch apps or imatch321.com, or, if you are not signed in, with "Analytics settings" at the bottom of imatch321.com and imatch.tv. The anonymous page counts on imatch321.com and imatch.tv are not linked to you; your browser's Do Not Track or Global Privacy Control setting turns them off.

9.2 California (CCPA/CPRA)

If you are a California resident, you may request disclosure or deletion of your personal information and may not be discriminated against for exercising your rights. We do not sell personal information.

10. International Data Transfers

We are based in Canada, and our infrastructure may process information in Canada and other jurisdictions. If you access the Service from outside these jurisdictions, you consent to the transfer and processing of your information there, with safeguards as required by applicable law.

Some of our service providers process information outside Canada, including in the United States. In particular, crash, error, and performance reports are processed by Sentry in the United States, and product analytics and screen recordings by PostHog in the United States; each may use its own subprocessors in other countries. Information processed outside Canada may be accessible to the courts and authorities of those countries.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated Policy on this page and revise the "Last Updated" date and version. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at the details below.

13. iMatch TV

TV preferences and blocks

On the imatch.tv website you can watch public content without signing in, and guest appearance and sport preferences are saved in this browser. The iMatch TV app for Apple TV requires sign-in and shows only your own live streams, recordings and match reviews. Blocked publishers remain local even when you sign in. Blocks contain a publisher's identity and display name; they are not synced to an account. You can remove blocks in Blocked publishers. Clearing the app or browser's stored data removes local preferences and blocks. Your preferred sport is also sent to our service when you request recommendations.

iMatch TV accounts

Signing in is optional on the website and required in the Apple TV app. If you connect a screen using your existing iMatch account, we link your account identifier, display name, TV preferences, and enabled viewing history to provide account functionality and personalization across your connected screens. Club membership is checked to show resources you are allowed to watch. These data are not used for tracking across other companies' apps or websites. If you buy or restore iMatch Pro on Apple TV, the app sends the App Store transaction identifier to our service, which confirms the plan with Apple and records it on your account. Only approve a connection you started on a screen you trust.

Watch history and your choices

When Save my watch history is enabled, we save the content identifier, playback position, duration, completion status, and last-watched time to your account. History is limited to the latest 100 items and retained for up to 90 days. Pause history in your TV account preferences to stop new progress being saved; existing history remains until it expires or you clear it. Clear history removes saved viewing history from your account across connected screens. Deleting or deactivating your iMatch account also removes TV history and preferences and revokes connected TV sessions.

Connected screens

The TV app stores its session credential in the device Keychain. The TV website stores its credential in this tab's sessionStorage, with an in-memory fallback when storage is unavailable; it is not placed in a page URL or localStorage. Browser session restoration may restore a tab's storage, so sign out when using a shared screen. Credentials are renewed during use, expire after up to 30 days without renewal, and require a new sign-in after at most 90 days. Signing out revokes that screen's session. The temporary pairing request expires after 10 minutes.

Search and service requests

On the website, we receive the search terms, sport filters, preferred sport, channel codes, and content requests needed to show your choices. For the website and the Apple TV app, our Google Cloud service logs retain request URLs and query values, IP addresses, response status, and timing for 30 days. These records support service operation, security, and troubleshooting. Watching without an account does not make these requests anonymous.

Video delivery and analytics

Cloudflare Stream delivers video and provides viewing analytics, including viewing minutes and viewer country. We use this information to understand viewing and operate the service. Video delivery and analytics involve Cloudflare receiving network requests from your device. The 30-day service-log period above does not describe Cloudflare's separate processing or retention.

Content reports

Reporting sends the selected reason and the content's identifier to our service. Reporting members-only video requires sign-in so we can check your current club access. The report record does not store your account identifier, name, contact details, or a written message. Reports are reviewed by authorized staff. Open reports are retained until resolved; resolved or dismissed reports are deleted after 90 days. Staff access and decision records are retained for 365 days. Temporary report rate-limit records are deleted after 48 hours. The service request logs described above still apply.

Privacy questions

For privacy questions or requests about your information, contact info@suparena.ca. Describe the request and when it occurred so we can determine what records can be located. Local preferences and blocks can be removed on your device. The platform policy on this page describes your applicable privacy rights and the wider iMatch service.

14. Support Chat

Who provides it, and when it loads

Our support chat is provided by Intercom, Inc. It loads only after you choose "Turn on chat" in the chat prompt. Until then, nothing is loaded from Intercom. If you choose "No thanks", the chat stays off.

What the chat receives

Intercom receives what you type and the browser details and cookies it needs to remember your conversation. If you are signed in, we also send your account identifier, your name, your verified email address, when you signed up, and a role label (club administrator, club member or individual) so that support can see who they are talking to. Visitors who are not signed in chat without those details. Chat is not offered to accounts we know are under 18.

Where chat data is stored

Intercom stores chat data in its United States data region. This applies to everyone who uses the chat, including people in Canada and the European Union. Intercom may use its AI assistant (Fin) to suggest answers from our help content; the assistant does not change anything in your iMatch account.

When a person takes over

If a conversation is handed to a member of our team, we open a support case in our support tracker and notify our support team in our team chat. The case includes your message, a link to the conversation and, if you are signed in, your account identifier and email address.

Your choices

To change your choice about the chat, clear this site's stored data in your browser; the prompt appears again. To ask what chat data we hold about you, or to have it deleted, email info@suparena.ca.