1. Who we are
AirchyWebOS (“Airchy”, “we”, “us”) is the badminton club operating system built by Airchy Limited. It runs at airchywebos.airchy.com and inside the Airchy mobile app.
For any privacy question — to access your data, correct it, or delete it — email support@airchy.com. A human will reply, usually within a few working days.
2. What data we collect
We collect what you give us, what the app generates while you use it, and a small amount of device/usage telemetry. Specifically:
Account & profile
- Email address (used to sign you in and reach you about your account)
- Display name (
full_name) and a public handle (username) - Avatar URL (if you upload one)
- Role (player, club owner, admin) — set by the system, not by you
- Date of birth (optional, used for age-gated features like coaching)
- Preferred currency and a small set of community fields (skill rating, playing frequency)
Clubs, sessions, and matches
- Clubs you create or join, including the court location you give them
- Session attendance, queue order, scores, and match results
- Your ELO rating history — derived from your match results, kept indefinitely so old opponents still resolve correctly
- Posts, comments, and reactions inside the social feed
Location
- When you use the club directory or session discovery with the “use my current location” button, your browser sends your coordinates (
lat/lng) so we can sort results by distance. The coordinates are not stored against your profile; they live in the URL of that search request only. - The parent portal reverse-geocodes a billing postcode to show nearby session times. We use the public Nominatim and
postcodes.io endpoints for that; no Airchy-side record is kept.
Photos and uploads
- Club logos, sponsorship creatives, social post images, drill photos, and finance-receipt proofs you upload to the app
- Uploads are stored against the resource they belong to (your club, your post, your finance entry). Removing the resource deletes the file.
Push notifications
- If you opt in, your browser registers a Web Push endpoint with us. We send notifications for session reminders, join-request updates, and replies on your posts. You can revoke this at any time from your browser’s site settings.
Payments
- We do not store card numbers, CVVs, or bank credentials. All card data is handled by Stripe. We receive only the metadata we need to fulfil the transaction (amount, currency, last-four digits of the card, brand, the Stripe customer / payment-intent IDs).
- Club-side prepaid credits and player wallet balances are stored as ledger entries in our database — they are not card data.
Telemetry
- PostHog — product analytics. Pageviews, clicks, and session recordings. We use
person_profiles: 'identified_only', so anonymous visitors are not profiled. - Sentry — error tracking at 20% of traces. JavaScript and server-side exceptions, with the request URL and a stack trace.
3. How we use it
- To run the service — sessions, queues, match history, ELO, club finance
- To send transactional emails (invites, billing receipts) and, with your permission, push notifications
- To investigate bugs and improve the product (Sentry + PostHog)
- To comply with law and respond to lawful requests — Stripe handles payment regulation, not us
4. Minors and the Parent Portal
Airchy includes a Parent Portal at /parent-portal/[token] for the parents and guardians of coached minors. It exposes:
- The student’s display name (from their profile)
- The billing contact’s name and language preference (from
student_billing_contacts) - Outstanding and historical coaching invoices (amounts, descriptions, due dates, status)
- Skill-tier progress and recent coaching sessions
Portal access is gated by a single-use secure token sent by the coach to the billing contact email. Tokens expire automatically. Every Airchy coach is DBS-checked before they can invite a minor; the DBS-expiry cron (app/api/cron/dbs-expiry-check) revokes access when a check lapses.
Coaches must have a verifiable parent/guardian relationship on file before sending a portal link. If you believe a portal link has been sent in error, email support@airchy.com and we will revoke it.
5. Sub-processors
- Supabase — database, authentication, file storage
- Stripe — payments, including Connect accounts for clubs and coaches
- Resend — transactional email delivery (invites, receipts)
- PostHog — product analytics (US region)
- Sentry — error tracking
- Web Push — browser push notification delivery (the browser vendor handles transport)
- Nominatim / postcodes.io — reverse-geocoding for the parent portal postcode lookups; no Airchy-side record
6. Retention
Account data is kept while your account is active. Match history, ELO history, and ledger entries are kept even after you delete your account, because other members’ records depend on them (a game still credits the players who took part in it). The account-deletion flow in Settings anonymises your profile and revokes your session; you can also ask us to anonymise specific ledger entries by emailing support.
7. Your rights
- Access — request a copy of your data via support@airchy.com
- Correction — edit your profile at any time in Settings
- Deletion — use the Delete account flow in Settings. Per Apple’s App Review guideline 5.1.1(v), you do not need to email us to delete your account.
- Opt out of telemetry — block PostHog/Sentry via your browser’s tracker-blocking, or email support to opt out at the account level
- Complain — to the ICO if you are in the UK, or your local data-protection authority
8. Changes to this policy
We will update this page and the “last updated” date above when the policy changes. For material changes (anything that broadens what we collect or changes who we share it with), we will email active accounts before the change takes effect.
