Privacy Policy

Athlos is operated by Jason Bernados, an individual developer based in Cagayan de Oro City, Misamis Oriental, Philippines, who is the personal information controller for the Service under the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC). This policy explains how we collect, use, share, protect and dispose of your personal information, and how you can exercise your rights.

• Account: your email address and password (stored hashed by our sign-in provider), or, if you sign in with Google, Facebook or Apple, the name, email and profile photo they share with us.
• Profile: your public handle, optional photo, bio, city, playing hand, paddle, and gender (used only for mixed-doubles eligibility). Your real name is kept private (see What other people can see).
• Birthday and age confirmation: your birthday (asked at email sign-up, or when you first accept our Terms if you signed up with Google, Facebook or Apple), used only to confirm your age and never shown to other players; if you sign up with email, your first and last name; whether you are 18 or older, or 13 to 17 with a parent or guardian's consent; and when you accepted our Terms and this policy.
• Location (optional): if you tap Turn on location on the Courts page, your phone or browser gives the page your position so it can sort courts and tournaments by distance. This happens on your device only: your location is never sent to Athlos, stored, or shared. We only remember on your device that you turned it on. You can turn it off on that page or in your browser settings at any time.
• ID verification (optional): see the next section.
• Play: matches you record or play (players, scores, date, venue, whether rated), score photos you upload, disputes, ratings and rating history, analytics derived from your matches (form, win rates, reliability), achievements and Props you give or receive.
• Clubs and tournaments: memberships and roles, tournament entries, partners, seeding, check-in times, venue attendance (when a desk scans your pass), and results.
• Payments: for Pro, club setup fees and tournament entry fees paid by GCash or QR Ph, the reference number, amount, date and the receipt screenshot you upload. We never receive your GCash PIN, one-time codes or card numbers. If card or e-wallet checkout is switched on, PayMongo processes the payment and tells us only whether it succeeded, the amount and the method.
• Referee applications: quiz results, your experience and events worked, your certificate photo and your organizer reference's answer.
• Social: who you follow and block, your messages and chats, message requests, Paddle Taps and reports you make.
• Court bookings: your bookings, GCash reference and receipt, your mobile number (required to book, so the venue can reach you), the ratings you give venues and the ratings venues give you (stars, tags and an optional comment), and a booker record computed from your bookings (completed, cancelled, unpaid, no-shows).
• Technical: sign-in records and security logs kept by our providers (which include your IP address and browser type), and the cookies described below. If you turn on phone notifications, your browser gives us a push address for that device (no phone number or contacts); we use it only to send you Athlos notifications, and delete it when you turn them off or it stops working.
• When you contact us: what you send us and our reply.

Rated matches, tournaments and messaging are limited to verified players, so rankings reflect real, single people and players know who they're dealing with. To verify, you upload a National ID, Driver's License or School ID and a selfie holding it, and give your legal name and ID number. A government-issued ID number is sensitive personal information under the Data Privacy Act; we process it only with your consent, given when you submit.

• Photos are stored in private storage that only you and Athlos admins can open, through links that expire after 15 minutes. Every admin view is logged.
• We don't store your full ID number: only a one-way fingerprint (so the same ID can't verify a second account) and its last 4 characters.
• Other players never see your ID, legal name or ID number. They see only the verified check and your Athlos ID.
• Phone photos are resized on your device before upload, which also removes their location data (GPS).
• Automatic check: when you submit, your ID photos, selfie, typed legal name, ID type and the last 4 characters of your ID number are sent to Anthropic's Claude AI, outside the Philippines, to read the ID and check it matches what you typed and the age you confirmed. It does not compare faces. If every check passes, you're verified automatically; if not, a person reviews it. The AI can approve you but never rejects you. We keep only the pass/fail results and short reasons, not what was read off your card. By submitting, you consent to this.

• To provide the Service you signed up for (performance of our agreement): accounts, matches, ratings, clubs, tournaments, check-in, messaging, payments you make.
• With your consent: ID verification and your age and guardian confirmation. You can withdraw consent by deleting your verification or account; this doesn't affect processing already done.
• Our legitimate interests, balanced against your rights: keeping ratings fair, preventing fraud, fake accounts and abuse, protecting minors, securing the Service, and fixing bugs.
• Legal obligations: keeping payment records, responding to lawful requests, and reporting child exploitation to authorities.

We don't sell your personal information, we don't use it for advertising, and we don't send you marketing. We send service messages (for example about security, payments or changes to our policies).

• Signed-in players can see your handle, photo, bio, city, profile details, verified check, Athlos ID, ratings and record, analytics, badges and Props, followers and following, and the matches, clubs and tournaments you take part in.
• Anyone, without an account, can follow a tournament that is running on its public live page: the event name and venue, and each entry's handles, bracket position, court and scores. Nothing else about you is shown there.
• Your real name is visible only to you, Athlos admins, and verified organizers of tournaments you enter (to match you at the check-in desk).
• Organizers of events you enter see your entry, partner, payment status and references, receipts you upload for their event, and check-in times. Referees and desk staff see check-in and attendance details for their event or venue.
• Referee reviewers: if you apply to be a referee, the organizer you name sees your application; Athlos admins see everything you submit.
• Athlos admins can access account data when needed to run the Service, verify IDs and payments, and enforce our Terms.
• Venues you book with see your mobile number on your bookings, from the booking until 7 days after play (longer only while a refund is open), and your booker record: counts of completed, cancelled and unpaid bookings, no-shows, and the stars and tags other venues gave you. Other venues' written comments about you are never shown to them. You can see every rating given to you on your bookings.
• Your rating of a venue (stars, tags, comment) is shown publicly on its page with your handle. A venue's track record (bookings, declines, refunds, how fast it confirms and replies) is public.
• Your email address and phone number are never shown to other players.

• Athlos is not for children under 13. If we learn an account belongs to someone under 13, we delete it.
• Players aged 13 to 17 may use Athlos only with a parent or guardian's consent, which is confirmed and recorded when accepting our Terms.
• Only people a minor mutually follows can message them or send them Paddle Taps (verified organizers may reach certified referees to staff events).
• A parent or guardian may exercise the minor's privacy rights (see Your rights), including asking us for a copy of, correction of or deletion of their data, by emailing athlosph@outlook.com from an address we can verify.
• We report suspected child sexual abuse or exploitation to the authorities as the law requires.

• Only ID-verified players can follow, message and send Paddle Taps. If you don't follow each other, a first message lands in your Requests. The sender can send at most 3 messages until you reply or accept. Decline, and they can't request you again for 30 days.
• Messages are stored in our database and can be read by the people in the chat (all active members, for club chats). They are not end-to-end encrypted. Athlos admins read a message only when someone reports it, or when the law requires.
• Block someone and they can't follow, message or tap you. Only you can see your block list.
• Who follows whom is visible to signed-in players. Only the sender and the recipient see a Paddle Tap.

We use these service providers, who process data for us under their own security and privacy commitments and only to provide their service:

• Supabase: database, file storage and sign-in.
• Vercel: website hosting.
• Anthropic (Claude AI): the automatic ID check above and, for Pro members who ask for it, the weekly AI Coach report (your match numbers and @handles only). Anthropic processes this outside the Philippines to return a result.
• Google (Gmail): to send our service emails, such as policy-update notices.
• Google, Meta (Facebook) and Apple: only if you choose to sign in with them.
• GCash and other QR Ph banks and e-wallets (under your own agreement with them), and PayMongo if card or e-wallet checkout is enabled.
• Google Maps: venue maps load from Google only if you allow them (see Cookies); “Get directions” opens Google Maps.
• OpenFreeMap and OpenStreetMap: the map on the Courts page loads its map images from OpenFreeMap's servers (or OpenStreetMap's, if those are unavailable), which see your IP address and the part of the map you view. It sets no cookies, and your location is never sent to them.

We also disclose information when the law requires it (for example a court order or a lawful request from the NPC or law enforcement), to protect someone's life, health or safety, to report child exploitation, or to establish or defend legal claims. If Athlos is transferred to a new operator, your data would go with it under this policy, and we'd tell you first.

Our providers store and process data on servers outside the Philippines. We choose providers with strong security, and we remain responsible under the Data Privacy Act for how your data is handled wherever it is stored.

• Account and profile data: while your account exists.
• Mobile number: while your account exists; you can change it in Settings, and it is deleted with your account.
• ID photos and certificate photos: while your account exists, so a verification or certification can be re-checked if disputed; deleted when your account is deleted. The ID fingerprint (not your ID number) is kept to stop the same ID verifying a new account.
• Match results: they are also part of other players' records, so confirmed results are kept after you delete your account, with you shown as “Deleted player”.
• Payment records and receipts: for as long as tax and accounting laws require (generally at least 5 years), then deleted.
• Security and audit logs: as long as needed to investigate abuse and protect accounts, and no longer than necessary.
• Backups: deleted data may remain in encrypted backups until they are overwritten in the normal cycle.

We use organizational, physical and technical measures appropriate to the risk, including encryption in transit, row-level access rules in our database so each person only reaches data they are allowed to, private storage and short-lived links for sensitive files, logged admin access to ID photos, and limiting admin access to people who need it. No system is perfectly secure. If a personal data breach is likely to put you at real risk, we will notify you and the NPC within 72 hours of learning of it, as the NPC requires.

Under the Data Privacy Act you have the right to:

• Be informed about how your data is processed (this policy).
• Access your data and get a copy of it.
• Correct inaccurate data. Most of your profile you can edit yourself in the app.
• Object to processing, and withdraw consent where processing is based on consent.
• Erasure or blocking of data that is no longer needed or was unlawfully processed.
• Data portability: a copy of your data in a common electronic format.
• Damages for harm caused by inaccurate, unlawfully obtained or unauthorized use of your data.
• Complain to the National Privacy Commission (privacy.gov.ph).

To exercise a right, email athlosph@outlook.com from the address on your account. We may need to confirm it's you. We respond as soon as we can, and within the period the law and NPC rules require.

You can delete your account yourself in Settings (you'll confirm with your password, or a recent sign-in for social accounts). Deletion is immediate. You can also email athlosph@outlook.com from the address on your account (or tell us the Facebook, Google or Apple account you signed in with) with the subject “Delete my account”, and we'll complete it within 30 days. The steps are also on our account deletion page, which works without the app.

We delete your login, profile, handle, photos, ID verification, rating history, analytics, Props, Paddle Taps, messages you sent, follows, blocks, notifications, referee applications, badges and club memberships. Kept, as explained above: confirmed match results (shown as “Deleted player”) and payment records the law requires.

If you signed in with Facebook, you can also remove Athlos from your Facebook account under Settings & Privacy → Settings → Apps and Websites.

Athlos sets only essential cookies, which keep you signed in and protect sign-in. We don't use advertising, analytics or cross-site tracking cookies. Venue maps come from Google Maps and load only if you allow them, because Google sets its own cookies. Details, the full list and your settings are in our Cookie Policy, which is part of this Privacy Policy.

Your Athlos Rating (overall, and separately for singles, doubles and mixed doubles), skill bracket, matchmaking suggestions and analytics are calculated automatically from confirmed results. They affect which matches you're suggested and, when an organizer limits an event to a rating range, whether you can register for it. They have no other legal effect on you. If you think a result or rating is wrong, dispute the match in the app or email us, and a person will review it.

We update this policy when the app or the law changes. For significant changes, we notify you in the app and by email and ask you to accept the new version before continuing. Each version is numbered and dated.

Data Protection Officer: Jason Bernados, Cagayan de Oro City, Misamis Oriental, Philippines. Email: athlosph@outlook.com. Please include “Privacy” in the subject.

If you're not satisfied with our answer, you may file a complaint with the National Privacy Commission (privacy.gov.ph).