Privacy Policy

Effective 8 August 2026.

SecondServe ("we", "our") provides court cancellation alerts for tennis and other racket-sport venues in the UK. This page explains what information we collect, why, and what your rights are.

What we collect

Email address — used to sign you in via a one-time code and to contact you about your account if needed.
Push notification token— an Expo push token obtained when you grant notification permission. We store it and use it solely to deliver alerts to your device; Expo's push service relays each alert to Apple (APNs) on iPhone or Google (FCM) on Android.
Device label— derived from your User-Agent (e.g. "iPhone 15" or "Pixel 8") so future versions of the app can let you manage signed-in devices. Not personally identifying on its own.
IP address — captured at the moment you request a sign-in code, used for rate-limiting to defend against abuse. Stored alongside the code record and discarded once the code is consumed or expires.
Watches and tracked venues — the courts you ask us to alert you about. Stored in our database and used to decide which alerts you receive.
Crash & error diagnostics — if the app hits an error or crashes, we collect a diagnostic report (device model, OS version, app version and the technical stack trace) to find and fix bugs. These reports are stripped of personal data — no email address, no account tokens — and are processed by Sentry on our behalf.

What we don't collect

No precise location or background-location tracking.
No advertising or analytics trackers in the app. The iPhone and Android apps carry no ad SDK, no analytics SDK and no cross-app tracking identifier. This website carries a Google Ads conversion tag — see "Advertising on this website" below.
We don't sell your personal information, and we don't share your account data (email, watches, alerts) with anyone for marketing.
No payment information at this stage of the product.

Advertising on this website

We run Google Ads campaigns that link to secondserve.ai. Pages on this website load Google's global site tag (gtag.js) so that Google can tell us how many people who clicked an ad went on to download the app. It measures ad performance in aggregate — it is not connected to your SecondServe account, and it is not present in the iPhone or Android apps.

The tag lets Google set cookies and read your IP address, browser and the page you landed on. Google acts as an independent controller for that data; see policies.google.com/technologies/partner-sites. You can prevent it entirely with a tracker-blocking extension or your browser's tracking protection — nothing on this site depends on it, and blocking it does not affect the app.

Third parties

Resend (email delivery) — receives your email address and the one-time code body to deliver the message. See resend.com/legal/privacy-policy.
Expo Push Service (operated by Expo / 650 Industries) — receives your push token and the alert content (e.g. venue name and slot time) in order to deliver notifications, then relays them to Apple or Google. See expo.dev/privacy.
Apple Push Notification service (APNs, on iPhone) and Google Firebase Cloud Messaging (FCM, on Android) — deliver push notifications to your device. APNs handling is governed by Apple's privacy policy and FCM by Google's.
Hetzner (hosting) — provides the server infrastructure that runs SecondServe. They process data on our instructions.
Cloudflare(content delivery, TLS & security proxy) — our website and API are served through Cloudflare, which processes request metadata including your IP address to deliver content and protect against abuse. See cloudflare.com/privacypolicy.
Sentry(crash & error diagnostics) — receives de-identified crash and error reports (device, OS, app version, stack trace) so we can fix bugs. Configured to scrub personal data before it is sent. See sentry.io/privacy.
Google Ads (advertising measurement, this website only) — receives the fact of your visit to a secondserve.ai page, along with your IP address, browser and any Google advertising cookies, so we can measure which ads lead to app downloads. See policies.google.com/privacy.
Grafana Labs(operational logging & metrics) — receives server-side diagnostic logs and metrics from our infrastructure so we can keep the service healthy. They process data on our instructions. See grafana.com/legal/privacy-policy.

Account deletion

You can permanently delete your SecondServe account from inside the app (Profile → "Delete account"). Deletion is effective immediately:

Your watches, alerts, and saved courts are permanently removed.
All your signed-in sessions are revoked and your push tokens are removed.
Personal data (your email, display name) is scrubbed from your account row. The row itself is retained as a deletion marker so the same email is free to be re-used for a fresh sign-up.
Push notifications already in flight at the moment of deletion may complete delivery to your device; new notifications stop immediately.

No email or support contact is required to delete your account — the in-app flow is the canonical path.

Retention

We hold your account information for as long as your account is active. After deletion, the deletion marker described above is retained indefinitely; all other personal data is purged in the deletion transaction.

Your rights

Under UK GDPR you have the right to access, correct, and erase your personal information, and to lodge a complaint with the Information Commissioner's Office. To exercise these rights, email [email protected].

Contact

Questions about this policy? Email [email protected].