Tennis Life Privacy Policy

1. Who we are

Tennis Life is operated by GUGA USA LLC, a florida limited liability company. GUGA USA LLC is the controller responsible for the information described here.

2. Scope

This Policy covers the Tennis Life app, website, and related services. Health and biometric information has an additional, separate notice — our Consumer Health Data Privacy Policy — which you should read together with this one.

3. Information we collect

We collect information you provide, information generated as you use the Service, information from optional integrations you connect, and information derived by our AI. The sections below name the specific data and why we hold it.

4. Information you provide

• Account details: your email address and, for web billing, a payment-processor customer reference (source: profiles.email, stripe_customer_id) — used to create and operate your account.
• Username / handle (source: profiles.username) — your public label to teammates, replacing email.
• Sign-in identities: password, or Sign in with Apple / Google (source: user_auth_providers, provider + subject id) — used to authenticate you.
• Your role and team membership (source: profile_members.role, profiles.account_type) — used to present the right experience; a role by itself grants no access to others' data.

5. Athlete information

• Date of birth and gender (source: tennis_profiles.dob, gender) — used to tailor coaching to age and to apply youth protections.
• Structured athlete facts — hand, backhand, height, playing style, strengths/weaknesses, serve/return/movement, mental tendencies, development priorities (source: tennis_profiles) — used to personalize guidance; these are user-entered.
• Ratings — UTR / WTN / USTA and per-match snapshots (source: tennis_profiles.rating_*, player_rating_*) — used to track level over time.
• Equipment and goals (source: player_memory.kind in gear/goal; athlete_observations equipment/goals) — used for relevant recommendations.

6. Match and tournament information

• Match records and notes — score, surface, conditions, coach/parent/player notes (source: matches) — used to build your match history and reports.
• Opponent entries, which may include an opponent's date of birth or approximate age (source: opponents.dob, approx_age) — used for scouting; opponents are third parties, so we minimize this data.
• Screenshot imports staged for AI extraction, promoted only on your confirmation (source: match_import_batches, match-screenshots bucket) — used to save you manual entry.
• Tournaments, private and team-shared (source: user_tournaments, profile_tournaments) — used to plan and track your calendar.

7. Training information

Your schedule, sessions, drills, and session conditions (source: schedule_items, session_conditions) are used to plan training and to relate performance to context. Some session conditions are wellness signals and are treated as health data (see below).

8. Health and recovery information

Recovery, HRV, resting heart rate, sleep, strain, and related wellness metrics (source: health_metrics, health_workouts, session_conditions, whoop_daily, bodyclock_checkins, champion_days) are used to inform training readiness. This category is sensitive and is governed by our separate Consumer Health Data Privacy Policy, including how consent is withdrawn and how health data is deleted.

9. AI and Mentor data

Your Mentor conversations (source: your private Mentor thread store) are personal to you and are not automatically visible to a coach, parent, or manager. We keep a metadata-only usage log of AI calls — model, provider, token counts, and cost — which does not store your prompt or response text (source: ai_usage).

10. Uploaded content

Files you upload — journal attachments, chat media, private video, and personal-knowledge materials (source: private buckets team-files, personal-knowledge, library-books, train-content, match-screenshots) — are stored in private storage accessible only to you and users you authorize. Your profile avatar (source: avatars bucket) is served publicly by design.

11. Device and technical information

• AI usage records — tokens, model, provider, cost (source: ai_usage) — used to operate the AI economy and prevent abuse.
• Access and permission-change logs (source: profile_audit) — used for security and to record who changed access.
• Push notification device tokens (Apple Push Notification service) — used to deliver notifications you have enabled.
• We do not embed analytics, crash-reporting, ad-attribution, or session-replay SDKs; first-party telemetry is limited to the records above.

12. Location and weather

Location is off by default. Where you enable a venue or weather feature, venue coordinates may be sent to a weather provider to retrieve conditions (source: venues, WeatherKit lookups). We do not collect a general location history.

13. Information from Coaches, Parents, and Managers

People on your team may add information about you — for example coach or parent notes on a match (source: matches.coach_notes/parent_notes) and observations (source: athlete_observations, source = coach/parent). For a minor, a parent or guardian may provide information on the child's behalf.

14. Information from integrations

• WHOOP — recovery, sleep, cycle, and workout data via OAuth; access/refresh tokens are stored encrypted (source: whoop_connections, whoop_daily, whoop_workouts).
• Apple Health — read-only samples you choose to share (source: /api/health/samples → health_metrics/health_workouts).
• Rating provider (UTR) — your rating and member profile via OAuth (source: utr_* tables).
• Sign in with Apple / Google — a subject identifier and email (source: user_auth_providers).

15. Derived Athlete Intelligence

Our AI derives observations and long-term memory about your game (source: athlete_observations with confidence, player_memory, player_snapshots, player_insights). This derived information is also your data: it is covered by your rights in this Policy, including access and deletion.

16. How we use information

• To provide the Service: your account, training, matches, and the AI Mentor personalized to you (uses account, athlete, match, training data above).
• To operate subscriptions and the AI economy (uses subscriptions, ai_usage, mentor wallet).
• To keep the Service safe and secure (uses profile_audit, authentication data).
• To improve coaching quality using data minimized or de-identified where practical — never to build a general advertising profile.

17. Legal bases (where applicable)

Where the GDPR or similar law applies, we rely on: performance of our contract with you (operating the Service); your consent (for example health integrations and, for children, parental consent); our legitimate interests (security, service improvement) balanced against your rights; and compliance with legal obligations.

18. Sharing and service providers

We share information with the service providers that operate the Service — for hosting and databases, AI processing, payments, email, video calls, and the integrations you connect. Each receives only what its function requires. Our current subprocessors are listed on our Subprocessors page.

19. No sale of your data

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. This is especially true for minors. If this ever changed, we would first provide the required opt-outs, honor Global Privacy Control, obtain any required opt-in, and update this Policy.

20. Advertising

We do not show third-party ads in the Service and we do not run targeted-advertising or ad-attribution SDKs.

21. Children's information

Tennis Life is used by junior athletes. A minor's account is controlled by a parent or guardian, and sensitive areas are protected by default. Our Children's Privacy Notice explains this in full, including a version written for young athletes. Because opponent entries may include a minor's age, we minimize and restrict that third-party data.

22. International transfers

GUGA USA LLC is based in the United States, and our providers may process information in other countries. Where required, transfers rely on appropriate safeguards. Exact processing locations for each provider are listed, as far as confirmed, on the Subprocessors page.

23. Retention

• We keep most information for as long as your account is active, and delete it when you delete your account, except where we must retain it by law.
• Some data is pruned on a schedule: Mentor conversation history (about 30 days / recent messages) and chat attachments (about 30 days).
• Our AI usage log is de-identified on account deletion (user reference set to null).
• Encrypted disaster-recovery backups keep a rolling 14-day window. After you delete your account, copies of the deleted data can persist in those backups for up to 14 days before they roll off. If backups ever stop being produced, we keep the last few copies until new ones exist, and we monitor for anything older than the window. Our hosting provider also keeps its own short-term database backups.

24. Security

We protect information in transit and at rest, restrict access with row-level database policies, keep uploads in private storage served through signed URLs, and encrypt sensitive credentials such as WHOOP tokens. No system is perfectly secure, but access to sensitive areas requires explicit permission, not merely a connection.

25. Your rights

You can access and export your data (Download My Data), correct it, and delete it. You can exercise these rights inside the app under Settings → Privacy & Legal, or through our public privacy-request route. Email is not the only way to delete your account or make a request. For children under the age of digital consent, the data export is delivered to the verified parent or guardian by email with a secure link, rather than downloaded on the child's device; teens and adults download it directly.

26. California and other U.S. state rights

Depending on your state, you may have the right to know, access, correct, and delete your personal information, and to opt out of sale or sharing. We do not sell or share for cross-context advertising, and we honor Global Privacy Control where applicable. We do not discriminate against you for exercising these rights.

27. European and UK rights

If the GDPR or UK GDPR applies to you, you may request access, rectification, erasure, restriction, portability, and object to certain processing, and you may withdraw consent at any time without affecting prior processing. You may also complain to your local supervisory authority.

28. Account deletion

Deleting your account removes your account and the server-stored data linked to it, other than data we must keep by law. If you connected WHOOP, deleting your account removes our stored tokens; you can also revoke access directly in your WHOOP account.

29. Changes to this Policy

We may update this Policy. For material changes we will provide notice within the Service, and previous versions are retained rather than silently overwritten.

30. Contact

GUGA USA LLC · Tennis Life · 22675 NE Alder Crest #204, Redmond, WA 98053, United States · Email: support@tennislife.life