Last updated: 8 October 2026
This is a translation for your convenience. The German version is legally binding.
Daniel Woller
Stöckachstr. 60
97249 Eisingen
Germany
Email: kontakt@padelcademy.com
Padelcademy is offered by Daniel Woller as a sole trader. For any questions about data protection and to exercise your rights (section 16), contact us at this address or via the contact form. We have not appointed a data protection officer.
Padelcademy is deliberately built to collect as little data as possible. The app sets no cookies and embeds no third-party advertising or analytics services (e.g. no Google Analytics). Fonts and program code are loaded from our own server, not from third parties. We process:
What does not exist at the moment: purchases in the iOS or Android apps, push notifications and advertising links to retailers. Before any of these features starts, we will add to this policy.
The website and app are delivered by the hosting provider Netlify (Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA). When a page is requested, Netlify automatically processes technical information your browser sends, in particular the IP address, date and time of access, the requested address, browser type and version (user agent) and, where applicable, the address of the previously visited page (referrer). This is technically necessary to deliver the site and to fend off attacks.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable delivery and, for the visitor statistics, in understanding how the website is used and found; you can object to this under section 16). Visitor statistics. We also use Netlify's visitor statistics (Web Analytics). Netlify calculates them on its servers from the same access data; no cookies are set for this and no additional program is loaded in your browser. We only see aggregated figures: page views, the number of different visitors per day (counted by Netlify using the IP address), pages viewed, referring websites and countries — no individual IP addresses and no information about individual people. We use the statistics to see how many people visit the website and where they come from. In the administration interface these figures are visible to us for at most 30 days back. Beyond that, we do not forward logs to any further service. We do not combine these logs with other data and do not use them to build usage profiles. In Netlify's administration interface we can see at most the last seven days; this is not a deletion period. How long Netlify itself keeps log data is determined by Netlify; the provider does not state a binding period in its public documents. As soon as we know it, we will add it here. Netlify processes the data as a processor; according to Netlify, the corresponding agreement is part of its terms. On transfers to the USA see section 18.
As long as you do not register, your progress — solved scenarios, quiz and daily challenges, visit days, match entries, trainings, your saved session, Padel IQ tests, settings and any fitness values — is stored exclusively locally in your own browser's storage (local storage). Without an account, none of it leaves your device. If you clear your browser storage or switch devices, this progress is lost. The individual entries are listed in section 17.
Independently of this, the app counts individual usage events — also without an account; for this, requests go to our database service as soon as you open the site. What is transmitted and stored is described in section 6. Your content is not affected.
If you voluntarily register, you can sync your progress across devices. For this we store your email address, your password (not in plain text but as an encrypted check value), an internal account ID, the times of registration and sign-in, the language chosen at registration, and the data belonging to the features you use (sections 8 to 12). The legal basis is Art. 6(1)(b) GDPR (providing the account feature you requested). Our terms of use also apply to the account.
Database and sign-in. For account, sign-in and database we use the service Supabase (Supabase, Inc., USA) as a processor. Our project's database is located in a data centre in the EU (Ireland). According to Supabase, the data processing agreement is part of the provider's terms of service. On possible access from the USA see section 18.
Account emails. After registering you receive an email to confirm your address; if you forget your password, you can request a reset link. The sign-in service sends these emails via the email delivery service Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) with the sender noreply@auth.padelcademy.com. Resend receives your email address and the content of the email, processes the data in the USA and, according to its own information, keeps email and log data for 30 days. We do not send you advertising or a newsletter.
Staying signed in. To keep you signed in, the sign-in service stores a session token in your browser's storage (section 17). It is removed when you sign out.
Sign-in with Google. In the browser you can sign in with a Google account instead of email and password. If you choose this, you are redirected to Google (for users in the EU: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); Google processes your data under its own terms and on its own responsibility. We receive from Google the ID of your Google account, the email address and the name details Google transmits; the app only shows your first name in the account display. This sign-in method is voluntary — registration with email and password is available on equal terms.
From guest to account. If you practised without an account before registering, the app asks you once after signing in whether this learning progress should be transferred to your account. What is transferred is the learning progress: solved scenarios, viewed coaching topics, quiz status, points awarded, your visit days and daily challenge results. Your match entries are only included if you explicitly tick the box — it is not pre-selected — and even then without fitness values. Without the tick they remain on the device. Fitness values and Padel IQ tests always stay on the device and are not transferred.
Profile photo (voluntary). With an account you can show your own photo in your profile instead of your initials. The app checks the chosen image on your device (JPEG, PNG or WebP, at most 10 MB), you crop it to a square, and the app creates a new image of 512 × 512 pixels from it on your device. No metadata of the original file is carried over — such as location, camera data or preview images. Only this new image is uploaded; the original file and its file name do not leave your device. We store the image in a non-public storage area at Supabase (see above) as well as your account ID, a version ID, format, size, the time of the last change and your visibility setting. On the device the app keeps the image only in working memory, not in browser storage. The photo is not analysed; in particular there is no facial recognition.
Who sees the photo. The default is "Only me". If you choose "Confirmed friends", people with whom you are confirmed friends via the friends feature also see it (section 8). There is no public sharing, no links to pass on and no search for photos; every retrieval is checked against your sign-in, and friends only see the current photo. If you delete your friend profile, the setting returns to "Only me". The photo is voluntary; the app works fully without it. The legal basis is Art. 6(1)(b) GDPR (the profile feature you requested, including display to friends if you choose it). If the photo shows other people, you generally need their consent (see terms of use).
Replacing and deleting. If you replace or delete the photo, the app removes the previous file immediately; if that fails, a daily clean-up run removes it. The same applies when you delete your account. Aborted uploads are removed after 24 hours at the latest.
If you create a friend profile, it and your friendships also belong to the account (see section 8). How to get rid of data again — reset, withdraw consent or delete the whole account — is described in section 13.
To see whether individual features of the app are used, the app counts simple events in the background — e.g. "a page was opened", "a shared link was opened", "the daily challenge result was shared" or "a training was completed". For each event we store only the type of event, a short additional value and the time.
The additional value is not free text. It comes from a fixed list of keywords and identifiers and is at most 160 characters long. The app does not send other values; an additional check in the database service that rejects other values has been prepared but is not yet in operation. It includes: which page or area of the app was opened; the identifier of a quiz, rule or referee item when sharing or opening a shared link (only if that item exists in the app, otherwise "unbekannt", i.e. unknown); the language chosen on the home page; whether an answer in the home-page quiz or the daily challenge was correct and which answer was chosen; the overall score of a completed Padel IQ test; settings chosen in the profile (role, playing hand, court side) and that progress was reset or an account deleted; steps in the match diary, match planning and tactics board (e.g. "entry saved", "template opened"); the starting point of a completed training; opening and sharing a Match Card; that consent for fitness values was given, refused or withdrawn and how an import of fitness values went (without measured values); for a referral link, its source (for friend invitations without the personal code, see section 7).
What is not stored: For these events we store no account, device or session ID, no IP address and no cookie. Even when you are signed in, no sign-in information is transmitted with the count. The table has no column that would allow two events to be linked to the same person, and we do not attempt to do so. Health and fitness values are never counted.
What is technically transmitted: As with any request on the internet, each counting request delivers your IP address, the browser identifier (user agent), the browser's language setting and the address of our website to the Supabase service (database in the EU, see section 5). We do not evaluate this information; whether and how long Supabase keeps it in its own operational logs is determined by the provider.
This count also runs without an account and starts when the site is opened. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in developing the app sensibly based on actual use). You can object to it under section 16.
Retention: We intend to keep each event for 14 months after it was recorded and then delete it with an automatic job. This deletion has been prepared but is not yet in operation: until then, the events remain stored. Once it runs, it will also remove all previously stored events that are older than 14 months. This period applies only to the usage count — not to your matches, your progress, your training plans or any other data. Resetting your progress or deleting your account does not remove the events early, because they are not linked to any account and cannot be linked to one (see section 13). Earlier versions of the app counted the value from the address bar unchecked as the additional value when a shared link was opened. We will replace such previously stored additional values that do not fit today's fixed list with "unbekannt" (unknown) when the deletion is put into operation; until then they are still stored.
A link to Padelcademy may contain a referral code (for example of a coach or club) or a friend's personal invitation code. We do not store any code from a link in your browser and do not attribute it to your account, a registration or a purchase. A partner code for a discount is something you enter yourself, deliberately, at purchase — once Padelcademy Pro can be purchased.
When such a link is opened, the app only counts that a link with this source was opened (section 6), without an identifier and without a cookie. A referral code names a source. A friend invitation code, by contrast, is personal: it belongs to the friend profile of the person who shared it (see section 8). For friend invitations, therefore, the code is not counted, only the fact that the visit came via an invitation.
So that the app can suggest the inviting person after you sign in, it keeps the invitation code only in the working memory of the open page; the invitation code is not stored in your browser. For the suggestion it is sent to the server and looked up there, but not stored. If you reload the page without the link, it is gone. Earlier versions of the app kept codes from links in the browser for a while; such an entry is deleted the next time Padelcademy is opened.
With an account you can voluntarily create a friend profile to connect with other players. Without a friend profile your account is not visible, not searchable and cannot receive requests; all other features of the app remain fully usable without a friend profile.
What is stored: a handle you choose and a freely chosen display name (it does not have to be your real name), whether you want to be findable in search, a personal invitation code assigned by the server, and the times the profile was created and changed. Your email address is not used by the friends feature and is not shown to anyone.
Findable in search — off by default. A new friend profile does not appear in search. Anyone who wants to be found switches this on deliberately and can switch it off again at any time. Search is only available to signed-in users with their own friend profile, needs at least three characters and shows at most ten results.
What others see: In search (only if you are findable) and via your invitation link (even if you are not findable), signed-in users see your handle, your display name and whether a friendship or request already exists between you. Friends and people with whom a request is open also see the status (friend, request sent, request received) and a time — for friends since when, for requests when they were made. If you have chosen "Confirmed friends" for your profile photo, confirmed friends also see this photo (section 5).
Sharing with friends — individual, voluntary, off by default. In addition, you can explicitly share certain details with confirmed friends. There are exactly three switches, and all three are off from the start:
These details are visible only to confirmed friends. If you switch a share off again, the corresponding values are not just hidden but deleted; nobody can retrieve them afterwards. Never shared and technically not retrievable are: your email address, your match entries and notes, your fitness and health values, your Padel IQ answers and area scores, and your other settings.
Requests and their status: For each pair we store who made the request, the status of the relationship (open, accepted, declined, withdrawn, removed, blocked), the times of request, response and acceptance, and how often requests were made and declined. This serves the feature itself and protects against repeated requests: after a decline no new request is possible for 30 days, after three declines none at all (unless the other person sends one), and after a withdrawal not for one day. In addition, we count per account how often someone searched, sent requests or resolved an invitation code, to limit misuse; each counter refers to a short time window and is then reset — the entry itself remains until your account is deleted.
Invitation link: You can share your personal link. Anyone who opens it sees your handle and display name after signing in; the code is not stored in the invited person's browser (section 7). A friendship is not created automatically, only when a request is made and accepted.
Deleting your friend profile: You can delete your friend profile in the app at any time (Profile → Friends → Edit). All open friendships and requests are ended and all shares from section 8 are deleted; afterwards you are no longer findable, your invitation link no longer works and nobody can send you new requests. Your account and your other data remain. A profile created later gets a new invitation code; earlier friendships do not return.
Ended relationships: After removing, declining or withdrawing — also after deleting the friend profile — an entry with status, times and counters remains stored for the pair, without names once no profile exists any more. It is not visible to anyone in the app and serves only to protect against repeated requests and to enforce blocks. These entries are deleted together with your account (see section 13).
The friends feature also runs on Supabase, with the same database in the EU (Ireland) as the account.
With a friend profile you can record a match together. Whoever creates a shared match places up to three confirmed friends in the positions; everyone involved then sees it in their app and can confirm or decline it. This is the only place where match data goes to other accounts — and only because someone explicitly creates it.
What those involved see of each other: the date, the time, the type of match, the sets, who won, the line-up (which position, which team) and the handle and display name of those involved. Plus the confirmation status: whether a position has confirmed the current version or is still open. A decline is only visible to the person who created the match — it is not shown to the other participants. If there is a block between you and a participant, that person's handle and display name are not shown to you.
What is not included: your email address, your notes, your rating and your focus from the match diary, your fitness and health values and your Padel IQ. A shared match carries only the key facts listed above — your own diary entry for the same match stays separate and private.
Whoever created a shared match can change and delete it. If the result changes, the participants must confirm the new version again. Anyone who does not want to take part declines; the match then remains for the others. Shared matches can be added retrospectively for up to one year back; this is a rule of the feature, not a deletion period.
After an account is deleted: A shared match does not disappear when one participant deletes their account — it was created together and remains for the other participants. The deleted person's position and the link to their account are removed; handle and display name are no longer shown there. If the deleted person created the match, this role passes to one of the remaining people so that the match can still be changed.
In the match diary you record your own matches. We store what you enter yourself: date, start time, place and club, duration, whether it was played and completed, result and sets, the type of match, your rating, your focus and whether you achieved it, what went well and what did not, a free note, a link to a training and the names you type in for your partner and opponents.
Please bear in mind: these names and your notes are information about other people that you record yourself. Only enter what you really need — a first name or nickname is enough. If another person wants their name removed from your entries, you can change this in your diary yourself; we cannot do this for you in other people's diaries, because those are other users' own entries.
Without an account these entries stay on your device. With an account they are synced with your account so that they are the same on your devices. They are visible only to you — not to friends and not to the other players of a shared match (see section 9). If you delete an entry, a technical deletion marker remains in its place so that the deletion reaches all your devices and the entry does not return from another device; it carries only the entry's ID, the times and the fact of deletion — no content, no name and no fitness values.
Match Cards and photos. The app creates a Match Card (image) on your device. If you choose a photo for it, the photo is processed only on your device and is not uploaded to us. If the photo shows other people, you generally need their consent before you share the image; only share photos you hold the rights to (see the terms of use).
Exports and sharing. The app also creates a training sheet (PDF) on your device; nothing is sent to our server. Only when you share the result yourself does it go to the service you choose (e.g. a messenger) — under that service's terms.
The Padel IQ is a self-test in the app. For each test we store start and completion, the result (overall score, player profile, area scores, assessment and recommendation), the language used and a rough device category (e.g. "smartphone") and, for each task answered, which task it was, whether it was answered correctly, how long the answer took and its difficulty.
This data serves your own evaluation and the selection of suitable tasks. It is private. Friends see none of it unless you switch on the "Padel IQ" share — then confirmed friends see exactly three details: overall score, player profile and test date (see section 8). The result is an assessment for practice; it has no legal or similarly significant effect on you.
On your device the app keeps the last 50 tests. In your account, however, tests and answers are only added and never deleted by the app — not even when the local list gets shorter. They are deleted when you reset your progress or delete your account (see section 13).
You can record fitness values for a match. This is entirely voluntary and free of charge; the match diary works just as well without them.
Which values: active minutes, active calories, average heart rate, maximum heart rate, distance and steps. Exactly these six — nothing more.
Where they come from. Today you enter the values manually. An import from the phone's health store — Apple Health (HealthKit) on the iPhone, Health Connect on Android — is prepared for the apps, which are not yet available in the app stores, and is intended to become part of Padelcademy Pro there; it is not possible in the browser and not yet available. Once it is available, the following applies:
On the device or in the account as well — that is a separate decision. Fitness values stay on your device unless you say otherwise. For them to be stored in your account as well, and thus visible on your other devices, the app asks you explicitly and separately for your consent. Nothing is pre-selected; without this consent no fitness value leaves your device, even if everything else is synced. The legal basis for storage in the account is your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR). A record of the consent given is stored: purpose, version, time of consent, time of withdrawal where applicable and the place in the app where it was given — no IP address and no device ID.
What we use the values for: We show them to you next to your match result and in your own evaluation. We do not pass them on, do not sell them, do not use them for advertising and do not evaluate them beyond your account. They are not included in the usage count (section 6). They are not visible to anyone else: not to friends, not to participants of a shared match.
Withdrawal. You can withdraw your consent in the app at any time (Record match → Fitness data → "Stop storing in my account"). A withdrawal takes effect immediately: from that moment the app no longer transfers any fitness value to your account, and the automatic import also ends. At the next sync the app removes the fitness values of the matches your device knows from your account. On the device itself your values remain until you delete them there. The lawfulness of storage until the withdrawal remains unaffected.
What this does not yet do — and how you can still remove everything. A complete server-side clean-up that also covers older entries beyond those used most recently is prepared but not yet in operation. Until it is, fitness values of very old entries may still be in your account after a withdrawal. If you want them removed completely, write to us at the address above — or delete your account (section 13), and they go along with everything else. The record of giving and withdrawing consent remains as long as your account exists; it proves that you withdrew.
There are three different ways, and they do different things:
You can delete your account yourself in the app (Profile → Account) or ask us to do so by email to the address above.
What deleting an account cannot achieve: Shared matches remain with the other participants (section 9). The usage count from section 6 is not linked to any account and therefore cannot be deleted per account; its automatic deletion after 14 months has been prepared but is not yet in operation (section 6). Data stored in your browser without an account (guest data, language, design) remains there until you delete it. And names that other users typed into their own match diary are in their entries — that is other people's own content, which we do not change on their behalf.
Email. If you write to kontakt@padelcademy.com, we process your email address, your name (if given), the content of your message and the technical details of the email in order to handle your request. The mailbox is hosted by IONOS SE (Elgendorfer Straße 57, 56410 Montabaur, Germany), which operates it for us as a technical service provider.
Contact form. In the contact form we only ask for what we need to reply: your email address and your message; a name is optional. There is no consent to advertising and no newsletter. The form sends your details to a function of our database service Supabase (section 5), which forwards them as an email via Resend (section 5) to kontakt@padelcademy.com. This function runs in Supabase data centres and may also be executed outside the EU; Resend processes the email in the USA and, according to its own information, keeps email and log data for 30 days (section 18). Your message is not stored in our database.
Protection against misuse. To prevent the form from being misused for spam, it contains a field that is invisible to humans, and the function limits how many messages per hour can be sent from the same IP address, to the same reply address and in total. For this the database stores only counters under check values calculated with a secret key from the IP address or email address and the hour — not the addresses themselves. These counters are deleted after 48 hours. We do not send a confirmation to the address given; you will receive our reply directly.
The legal basis is Art. 6(1)(b) GDPR if your request concerns a contract or its preparation, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering requests and in protection against misuse). We keep your message as long as necessary to handle it and delete it afterwards unless statutory retention obligations apply.
We only list periods that actually exist.
For the other data in your account — progress, match diary, Padel IQ tests and answers, settings, friend profile, shares, friendships and shared matches — no fixed retention period is set. They remain stored as long as your account exists and are deleted when you delete them yourself, reset your progress or delete your account (section 13). We keep messages to us as long as necessary to handle your request (section 14).
Under the GDPR you have in particular the following rights regarding your personal data:
For all such requests, simply contact the email address above or use the contact form.
Complaint to a supervisory authority. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example where you live. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
Padelcademy does not set cookies. In your browser's storage (local storage) the app keeps the following entries:
These entries serve only the features you use yourself. Codes from referral or invitation links are not stored (section 7). So that the app loads quickly and also works offline, your browser also keeps our program files, fonts and some pages in a cache (service worker and cache). It contains no information about you.
You can delete all these entries at any time by removing the site data of padelcademy.com in your browser. Any progress that has not been synced is then lost.
We do not sell data and do not pass it on for advertising purposes. The only recipients are:
Netlify, Supabase and Resend process the data as processors on our behalf; IONOS operates the mailbox as a technical service provider. Netlify, Supabase and Resend are based in the USA; processing there or access from there (for example by support staff or by order of authorities) cannot be ruled out, and Resend processes the data in the USA. The basis for this is: for Netlify and Resend, their certification under the EU-US Data Privacy Framework (adequacy decision of the European Commission) and, in addition, the European Commission's standard contractual clauses; for Supabase, the European Commission's standard contractual clauses, which are part of the data processing agreement. For Stripe, according to Stripe, it is its certification under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
You do not have to give us any data: Padelcademy can be used without an account. An account requires an email address and a password or a Google account; all other details are voluntary. No automated decision-making within the meaning of Art. 22 GDPR takes place. If the app's features change, we update this policy; the version with the date stated above applies.
When you buy Pro on the web, we process:
Payment service provider Stripe. You enter your payment details and billing address in Stripe's embedded payment field (Stripe Payments Europe, Limited, Ireland); they go directly to Stripe. From us, Stripe receives your internal account ID, the order ID, the product and the email address of your account; Stripe sends the invoice and payment receipt for each payment to that address on our behalf. Invoices and receipts are also stored at Stripe. Stripe processes the data on our behalf for payment processing and, according to Stripe, for certain purposes such as fraud prevention and its own legal obligations under its own responsibility; data may be transferred to the USA in the process (section 18). More information: stripe.com/privacy. If you pay with a wallet payment method of your device or browser provider (for example from Apple or Google), that provider also processes data under its own terms.
Stripe's payment field in the browser and fraud detection. The payment field loads the Stripe.js library from Stripe's servers (js.stripe.com) — only when you choose “Continue to order summary” during purchase, not when the app starts and not on other pages. According to Stripe, Stripe.js only uses cookies that Stripe classifies as necessary (for the payment field to work and for fraud prevention). We have also switched on Stripe's extended fraud detection (“Advanced Fraud Signals”): for this, Stripe.js sends characteristics of your device and browser and signals from the payment process, such as how the payment field is used, to Stripe so that Stripe can detect fraudulent payments; Stripe may load a CAPTCHA (hCaptcha) in the process. For storing and reading information on your device we rely on section 25(2) no. 2 TDDDG (necessary for the payment you requested), for the processing on Art. 6(1)(b) GDPR and, insofar as it serves to prevent payment fraud, on Art. 6(1)(f) GDPR (legitimate interest in secure payments). Which cookies Stripe sets in detail: stripe.com/cookies-policy/legal.
Emails about the contract. We send the contract confirmation with the Pro terms and the withdrawal information, the acknowledgements of receipt for cancellation and withdrawal and notices about refunds via Resend (section 18) to your account's email address or the address you provided. The sender is “Padelcademy <noreply@auth.padelcademy.com>”; if you reply, your reply goes to kontakt@padelcademy.com (section 14).
No health data. Fitness and health values are not included in orders, payment details, the information sent to Stripe, emails about the contract, the usage count or partner reports.
Legal basis is the performance of the contract and steps prior to it (Art. 6(1)(b) GDPR) and our legal obligations, for example to retain records and to confirm cancellations and withdrawals (Art. 6(1)(c) GDPR).
Retention. We store order, payment and contract details for the term of the contract and afterwards as far as German tax law requires (section 147 AO, section 14b UStG): currently eight years for invoices and accounting vouchers and six years for business letters received and sent, each from the end of the calendar year. This also applies after an account is deleted; the details are then no longer linked to an account. Before an account is deleted, we end a running monthly subscription so that no further payment is incurred. So that you can still assert statutory claims from the contract (such as withdrawal or rights in case of defects) after deleting your account, your email address remains stored with the order for two years after the deletion and is then deleted automatically; the details to be kept for tax purposes remain without the email address. When Pro ends, we do not delete any of your other data.
You enter a code yourself in the ordering process or when redeeming it. No code from a link is stored or assigned (section 7).
What partners learn: only aggregated figures per month, such as the number and total of assigned payments and the commission. They do not receive names, email addresses, account IDs or individual purchases; the report only shows details from five payments in a period upwards, below that only the total. Health and training data are not included.
Legal basis: Art. 6(1)(b) GDPR (discount or Pro period from the code), Art. 6(1)(f) GDPR (settlement with partners and protection against misuse) and Art. 6(1)(c) GDPR (retention of settlement records, retention period as in section 21).