NextFour: Privacy Policy

This Privacy Policy explains how NextFour (“we”, “us”, “our”) collects, uses, stores, and shares your personal data when you use the NextFour mobile application, our website nextfour.app, and related services (the “Service”). The Service is provided by NextFour Ltd, a company registered in England and Wales, and we comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

NextFour is a mobile application for racket sport clubs and players, enabling session management, court rotation, social features, and club administration.

NextFour Ltd is the controller of your personal data. We are registered in England and Wales under company number 17355223, and our registered office is 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom.

For any privacy-related enquiry, you can reach us at [email protected].

2. Data we collect

We collect only the data needed to operate the Service:

Account information: name, nickname, email address, and (where you provide them) profile photo, gender, age band, and the sports you play with your skill level. Some older accounts also hold a date of birth.
Authentication data: when you sign in with Google, Apple, or Facebook, we receive your name, email address, and a unique identifier from the provider.
Location: your home area, which you set by searching for a place or by tapping “Use my current location”. We store the place (its coordinates and address details) so we can show sessions and clubs near you. If you search, we suggest choosing your town or area rather than your home address.
Current location (optional): only if you tap “Use my current location”, the app asks for your device’s approximate location, never your precise location, and only while you are using the app. The app rounds the position on your device and we look up the town it falls in. We store that town, not your position.
Club & session data: clubs you belong to, sessions you join, check-ins, availability poll answers, match results, statistics, pairings, and queue position.
Skill ratings: we calculate a rating for each sport and format from your match results, to help balance games. Ratings are not shown publicly.
Subscription status: your subscription tier (Free, Performance, Pro, or Club) is managed by RevenueCat. We do not store payment card details.
Device information: a push notification token, and for terminal/kiosk activations, a device name, device identifier, and last-seen timestamp.
Advertising data: the free tier shows ads from Google AdMob. AdMob receives your device’s advertising identifier and IP address, and we pass it the sports you play so ads are relevant. Whether ads are personalised depends on the choice you make in the consent prompt, which you can change later (see section 3).
Usage and diagnostic data: app events (such as signing up or joining a session) through Firebase Analytics and our own event log, and crash reports through Firebase Crashlytics. Firebase data is not linked to your name; our own event log is linked to your account.
Reports, blocks and agreement: if you report a player, club or session, we keep your report and the reason you give, and email it to our moderators so they can review it. If you block a player, we keep the block so it stays in place. The person you report or block is not told. We also record when you agreed to our Terms and this Privacy Policy.

The camera is used only when you take a profile or club photo or scan a kiosk QR code. We do not access your contacts or microphone, and we access your device’s location only as described above.

3. Lawful basis

We process personal data under the following UK GDPR lawful bases:

Contract: to provide the Service you’ve signed up for.
Legitimate interests: to keep the Service secure, prevent abuse, understand how the Service is used, fix crashes, improve features, and calculate skill ratings.
Consent: for personalised advertising and push notifications, which you can withdraw at any time. To change your ad choice, go to Profile → Privacy Settings → Ad privacy choices in the app.

4. How we use your data

To create and manage your account.
To show sessions and clubs near you.
To run live sessions, court rotations, queues, and matches, and to balance games using skill ratings.
To display your club memberships and social interactions.
To process subscriptions via RevenueCat.
To send service-related notifications (e.g. session check-ins).
To show ads in the free tier.
To understand usage, diagnose bugs, and maintain the integrity of the Service.

We use skill ratings to pick and balance games in a session. This is the only automated decision we make about you, and it has no legal or similarly significant effect on you.

We share data only with the sub-processors needed to run the Service:

Supabase: hosts our database, authentication, and file storage. Data is stored in EU regions where available.
RevenueCat: handles subscription state.
Apple, Google, and Meta (Facebook): authentication providers (only if you choose social sign-in).
Google Firebase: usage analytics, crash reports, app configuration, and push notifications (Firebase Cloud Messaging).
Apple Push Notification Service: push notifications on iOS.
Google AdMob: advertising in the free tier, as described in section 2.
LocationIQ: receives the place names you search for, or your rounded position if you use your current location, to find locations.
OpenFreeMap: provides map images; it receives your IP address and the map area you view.
Resend: sends our service emails.

We do not sell or rent your personal data. Apart from Google AdMob as described above, we do not share data with advertisers.

6. Other users and club members

Your name, nickname, profile photo, sports, skill level, and the location you have chosen can be seen by other NextFour users, for example in session lists and player search. Profile photos are stored at a public web address. When you join a club or session, your statistics, queue position, and pairings are visible to other members of that club or session. This is necessary for the Service to function. Club hosts and deputies may see additional information such as your check-in history within their club.

7. Shadow profiles

Hosts may add “guest” players to a session without those players holding a NextFour account. These shadow profiles store only a name and (optionally) email and gender so the player can be referenced in the session. Shadow profiles do not have logins, are not used for analytics, and can be deleted at the host’s request.

8. Club and session listings from public sources

To help players find somewhere to play, some club and session listings in NextFour are created by us rather than by the club. We compile them from publicly available sources such as league, county, club and venue websites. A listing shows the club’s name, venue, day and time, and a link to its source. It does not show anyone’s personal contact details.

Where a source publishes a contact address for a club, we may keep it privately so that we can contact the club about its listing. It is not shown in the app. Our lawful basis is legitimate interests: helping players find clubs and keeping listings accurate.

If you run a club and want its listing corrected or removed, or you object to us holding a contact address, email [email protected]. A club can also claim its listing in the app to manage it directly.

9. This website

This section covers our website, nextfour.app, including the club and session directory.

No cookies, analytics or advertising. The website sets no cookies, has no analytics or tracking, and shows no ads, so it does not ask for cookie consent.
Your theme choice: if you choose light or dark mode, the choice is saved in your browser’s local storage so the next page opens the same way. It stays on your device. Choosing Auto, or clearing your browser’s data for the site, removes it.
Postcode search and “Near me”: a postcode you type is matched in your browser against a list of postcode districts that the page downloads from us, so the postcode itself is never sent to us or anyone else. “Near me” uses your browser’s own location prompt, and your position is used only in your browser, to sort the results.
Hosting: the website is hosted on GitHub Pages, run by GitHub, Inc. Like any web host, GitHub receives your IP address and the pages you request, and keeps them in server logs to run and secure the service.
Maps: club and venue pages show a map, which loads when you scroll to it. Its map images come from the OpenStreetMap Foundation, which receives your IP address and the area of the map shown.
Links to other sites: a club’s website, an operator’s booking page, map directions and the app stores are separate sites with their own privacy policies.
Emails you send us: if you email us from the website, for example to correct a listing, we use what you send to reply and to put things right.

Our lawful basis for the hosting and map requests is legitimate interests: showing you the pages and maps you asked for, and keeping the website secure.

10. Data retention

We retain your data while your account is active. When you delete your account in the app, we delete or anonymise your personal data straight away. When you ask us by email, we do so within 30 days. Copies in our database backups are deleted as those backups expire, and are not used in the meantime.

Anonymised match records, which can no longer be linked to you, may be kept indefinitely so that other players’ statistics stay correct. Where the law requires us to keep data (e.g. financial records), we restrict it from further processing.

11. Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data (“right to be forgotten”).
Restrict or object to processing.
Request a portable copy of your data.
Withdraw consent at any time, where consent is the lawful basis.
Lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

To exercise any of these rights, email [email protected]. See also the Account & Data Deletion page.

12. Security

Data is stored encrypted at rest by Supabase and transmitted over HTTPS. Database access is controlled by row-level security policies. We restrict administrative access and do not log raw passwords (authentication is handled by Supabase Auth or social providers).

13. Children

NextFour is intended for users aged 13 and over. If you tell us you are under 18, we turn off Firebase Analytics for you, stop passing your sports to our ad provider, and ask Google to apply its protections for teenagers to any ads you see. If you believe a child under 13 has created an account, please contact us so we can delete it.

14. International transfers

Several of our sub-processors are based in the United States, including Google (Firebase, AdMob, and Google sign-in), Apple, Meta, RevenueCat, Resend, and GitHub (which hosts the website). Where data is transferred outside the UK or EEA, it is protected by a UK adequacy decision (such as the UK-US data bridge), the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or an equivalent safeguard. You can ask us which safeguard applies to a provider, and for a copy of it, at [email protected].

15. Changes to this policy

We may update this policy from time to time. Material changes will be announced in-app or by email. The “Last updated” date at the top reflects the most recent revision.

16. Contact

For any privacy questions or to exercise your rights, contact: [email protected]

By post: NextFour Ltd, 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom.

Privacy Policy