Privacy Policy

• We collect what you give us (profile, matches, messages) and a little we derive (rankings, stats).
• The AI coach sends your tennis data to a third-party model provider to answer you. That is the most significant sharing we do.
• Your scouting notes are private to you — not visible to the player they are about.
• We do not sell your data. We run no advertising trackers.
• You can export everything or delete your account permanently, at any time, yourself.

You give us: your email address and password (stored hashed, never in plain text); your display name, handle, photo, bio, city and postal code; your playing details — rating, handedness, backhand, play style, home court, equipment, height and weight if you enter them; your availability and scheduling preferences; match results and scores; messages you send; notes you write, including private scouting notes about opponents; tournament and group participation; and any feedback you submit.

We derive: your Trophy Tour ranking and rank movement, Elo ratings, badges, head-to-head records, and match statistics.

We collect automatically: authentication session cookies, approximate location from the postal code you enter (to find nearby courts and opponents — not device GPS unless you use a location feature that asks), and technical error reports when something breaks.

Trophy’s coach is powered by large language models accessed through Vercel AI Gateway, which routes requests to model providers including Anthropic and others we may add.

To answer you usefully, the coach is given context about your tennis: your profile, your recent and upcoming matches, your scores and rankings, your scheduling preferences, your conversation history with it, and your own private scouting notes about opponents you are about to play. That context leaves our systems and is processed by the model provider.

Scouting notes are only ever sent in the context of the author who wrote them. A note you write about another player is never shown to that player and never enters their coach’s context.

We use providers under terms that prohibit training their models on our customers’ data. Providers may retain content briefly for abuse monitoring. We keep your coach conversation history so the coach has continuity; you can delete it by deleting your account.

We log the cost and volume of AI usage per account so we can operate within budget and detect abuse.

To run the service: authenticate you, show your matches, compute rankings, deliver messages and notifications, match you with opponents, and answer you through the coach.

To communicate: transactional email about your matches, scores, invitations and account. You control which of these you receive, per category, in Settings.

To keep it working and safe: error monitoring, abuse and rate-limit enforcement, and billing where you have a paid membership.

Our legal bases, where the GDPR applies, are: performance of a contract (running the service you signed up for), legitimate interests (security, abuse prevention, service improvement), consent (optional integrations such as Google Calendar), and legal obligation (financial records).

Your display name, handle, photo, general location, rating and match history are visible to other Trophy members. Your ranking appears on leaderboards.

You control the rest in Settings → Privacy: profile, history, stats and badge visibility, and who may challenge, message, friend, or invite you to tournaments.

Never visible to other players: your email address, your password, your private scouting notes, your private match notes, and your coach conversations.

We use these processors, and only for the purposes listed:

• Supabase — database, authentication and file storage.
• Vercel — hosting, and AI Gateway routing to model providers.
• AI model providers (including Anthropic) — generating coach responses, scouting reports and match analysis.
• Resend — transactional email delivery.
• Stripe — payment processing, if you take a paid membership. Card details go to Stripe, never to us.
• Google — Maps and Places for court search; Calendar only if you connect it.
• WeatherAPI — forecasts for scheduled matches.
• Sentry — error monitoring. We scrub message content, notes and coach transcripts from error reports.

We do not sell your personal data, and we do not share it for advertising. We may disclose data if legally compelled, or to protect the safety of our users.

Some of these providers operate in the United States. Where data moves from the UK or EEA, it is transferred under Standard Contractual Clauses or an equivalent safeguard.

Trophy sets cookies that are strictly necessary to run the service: your authentication session, and your light/dark theme preference. We run no advertising cookies, no cross-site tracking, and no analytics profiling — which is why you are not being shown a cookie banner.

We keep your data while your account is open. When you delete your account it is removed immediately and permanently.

Two exceptions. Payment and tax records are retained for the period the law requires. And match results already recorded against other players’ rankings are retained in anonymised form, so that their competitive history remains accurate — your name and profile are removed from them.

You have the right to access, correct, export, delete, and restrict processing of your personal data, and to object to processing based on legitimate interests. Two of these are built in and need no request:

• Export everything — Settings → Account gives you a complete machine-readable copy of your data on demand.
• Delete everything — Settings → Account permanently deletes your account and data. There is no waiting period and no recovery, so export first if you want a copy.

For anything else — correction, restriction, objection, or a complaint — email hello@neuthereum.com. We respond within 30 days. If you are in the UK or EEA you may also complain to your local data protection authority.

If you are a California resident: we do not sell or share personal information as those terms are defined by the CCPA, and we will not discriminate against you for exercising your rights.

Data is encrypted in transit and at rest. Access is enforced at the database level by row-level security, not only in application code — so a bug in a page cannot expose another player’s private data. Passwords are hashed. Card details never touch our servers.

No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and the relevant regulator as required by law.

Trophy is not intended for children under 16. We do not knowingly collect their data. If you believe a child has an account, contact us and we will remove it.

We will update this policy as Trophy changes. If a change materially affects how we handle your data, we will tell you by email or in the app before it takes effect. See also our Terms of Service.