Privacy Policy

• Mobile phone number (used for OTP verification via SMS). When you join a facility membership on the website, you add your mobile number and confirm it with a code we text you; if you already joined on the website, we may ask you to add one. Your email address stays the main way we contact you, and the confirmed number lets you sign in to the app. If that number already belongs to another LocalRec account, confirming the code signs you in to that account instead; no information moves between the two, and they are never merged. When a number is added to your account, we email your confirmed email address.
• Email address (optional, if you choose to link an email to your account for alternative sign-in)
• Display name (chosen by you during onboarding)
• Profile information you choose to add (skill level, preferred position, bio, and profile photo)
• Names of friends you book spots for

• Device type, operating system, and app version
• IP address and general location (city/region level)
• Usage data such as pages viewed, games browsed, and features used
• Crash reports and performance data
• To stop repeated or automated sign-in attempts, we count attempts against your phone number, email address or account and against the network address they come from. Network counts are kept for up to a day; a requirement to reset your password after suspicious attempts is kept for up to a year. We also store the device name you sign in from with each signed-in session.
• On the website, a session cookie so a signed-in facility staff member stays signed in

We do not store your full payment card details. Payment transactions are processed by Stripe, Inc., a PCI-DSS compliant payment processor. Stripe may collect and store your payment information subject to their own privacy policy, available at stripe.com/privacy. We retain only a tokenized reference to your payment method and transaction records.

If you host paid games and set up payouts, Stripe collects your identity and banking information directly to verify you and pay you, under Stripe's privacy policy. LocalRec does not receive or store your bank account or debit card number.

When you pay a facility by card on its LocalRec booking page, the facility is the merchant. Your payment goes to the facility's own Stripe account, and LocalRec never holds the money. Stripe and the facility keep the card and billing details of that payment under their own policies, so deleting your LocalRec account does not remove them.

When a facility subscribes to LocalRec, the payment details for its subscription are processed by Stripe. Of those details, LocalRec stores only the card brand, the last 4 digits and Stripe object ids.

• Messages you send to our support team
• Text messages sent by Twilio, Inc.: one-time codes, and for a facility membership, join links and links to your notices
• Emails sent through Twilio SendGrid: one-time codes, booking confirmations, signing links, signed copies, and membership agreements and notices
• Push notifications to the app, delivered through Expo

When you book time at a facility, we hold the booking and the contact details it was made with — your name, email address and phone number — in that facility's customer record for you. We also record the internet address the booking was made from.

You do not always type those details yourself. If you book by telephone, a staff member types your name and contact details into the facility's system on your behalf, and we hold what they entered. Staff may also add notes about you to the facility's record, record whether you arrived or did not turn up and why, note how a bill was settled, and give a reason when they cancel or move your booking.

If you start a checkout on a facility's booking page, we hold the email address you typed and the internet address you typed it from against the time slot we held for you while you finished.

A facility may ask you to sign its own documents, such as a liability waiver or a rental agreement. You sign by typing your full name and ticking a box to agree. With each signature we record:

• The name you typed
• The date and time you signed
• The internet address you signed from, and whether that address was reported by our website or taken from the connection itself
• Your browser's user-agent string
• A fingerprint (a SHA-256 hash) of the exact version of the document you were shown, so the signature can always be tied to that text
• Whether you signed from your own link or, if the facility collected the signature on its own device, that it was signed at the desk and which staff member witnessed it

We record the internet address and browser string because they are the evidence that the signature was made, and by whom. We also generate a PDF of the document with a signature page, email it to you, and keep a copy the facility can open later.

If you work at a facility, the facility's owner invites you by email. We hold your email address, the name the owner typed when they invited you (if they did), the password you set, your role at that facility, and a record of the actions you take in the facility's system — which booking you created, whose bill you marked paid, whose data you erased, and the reason you gave where one is required.

When you join a facility's membership, we hold the membership for the facility: the plan, its price, your start and billing dates, how you found it (a plan link, a poster, the facility page, Discover, a suggestion, a link from staff, or a move from another system), your signed membership agreement, and each cancellation, pause and notice we send you.

• Your agreement. We make a PDF of your signed agreement and email it to you as an attachment. If we have no email address for you, or the email cannot be delivered, we text you a link to it instead; that link works for 30 days. We record when the agreement reached you.
• Payment details. You enter your card or bank details into Stripe's form, on the facility's own Stripe account. For a bank debit, Stripe holds your bank account and your pre-authorized debit agreement. We store only the kind of payment method, the card brand or bank name with its last 4 digits, and Stripe object ids.
• Your photo. The facility may ask for a photo when you join, taken with your phone's front camera, or its staff may take one at the desk. It is used only so staff can recognise you at check-in. We do not use face recognition. Before we store it, we remove its location, device and time details.
• Check-ins. Each time you check in, we record when, how (the facility's door QR code, a staff scan or search, or the web), whether you were let in and why not, which staff member checked you in, and, if a staff member let you in anyway, who did and the note they typed.
• A note for staff. Any staff member at the facility can add a short note to your record. Staff see it when you check in. You do not see it.
• Documents for a cancellation. If you cancel for a reason the law sets out, you or the facility's managers or owner may upload a document, such as a doctor's note, as a PDF or a photo. We store it privately. Before we store a photo of a document, we remove its location, device and time details; a PDF is stored as uploaded. The facility's managers and owner, and LocalRec support, can open it; other staff see only whether a document was received. If you cancel because a member has died, we also record the name of the person giving notice.
• Details a facility brings from another system. A facility moving to LocalRec from another system uploads an export of its members and customers. We keep only the columns the facility chooses, such as your name, contact details, birth date, emergency contact, a note for its staff, the date you became a customer, your account balance, your membership price and dates, the card brand and last 4 digits you paid with, your ids in the old system, and marketing consents with where they came from. Full card and bank numbers, and every column the facility does not choose, are dropped as the file is read, and the file itself is never stored. Each uploaded value is encrypted and deleted on the schedule in Section 4.3. The customer and membership records made from them are the facility's records. We do not send you marketing on an imported consent alone.
• Membership suggestions. If you book, join games or check in at a facility at least 3 times in 30 days, we may suggest its membership in the app, using only your own activity there in those 30 days. We never suggest one by push notification or email. We record when we showed you a suggestion, show it again no sooner than 30 days later, and hide it for 90 days if you tap Not now. A facility can turn these suggestions off for its plans.
• Analytics. We count membership events, such as a plan viewed, a join, a cancellation, a pause or a check-in, in PostHog under the facility, not under you. Each carries the facility, the plan, how the member found it and, where it applies, the kind of cancellation and its reason, or how a check-in was made and whether it was let in. They never carry your name, contact details, photo or payment details. When something fails in the app during a membership step, such as a photo upload, the app reports the error to PostHog under your app profile, as it does for the rest of the app.

We share information with trusted third-party service providers who help us operate the Platform:

• Stripe, Inc.: payment processing, including facility memberships on each facility's own Stripe account (stripe.com/privacy)
• Twilio, Inc.: text messages: one-time codes, membership notices and join links, and, through its SendGrid service, the emails we send (twilio.com/legal/privacy)
• Amazon Web Services (AWS): file storage in Amazon S3 for profile photos, membership photos, membership agreements, documents uploaded for a cancellation, facility documents and signed copies, and Amazon Rekognition to check profile photos before they are shown (aws.amazon.com/privacy)
• Render Services, Inc.: hosting our servers, our database and our cache (render.com/privacy)
• Vercel Inc.: hosting our website, and Vercel Web Analytics for counting page visits on it (vercel.com/legal/privacy-policy)
• PostHog, Inc.: product analytics: usage events and screen views, which may include your display name as a user identifier. Membership events are the exception: they are counted under the facility and not linked to you (Section 1.8) (posthog.com/privacy)
• 650 Industries, Inc. (Expo): delivering push notifications to the app, through Apple and Google (expo.dev/privacy)
• Google LLC: the Google Maps SDK on Android, which shows venue locations from coordinates LocalRec provides without reading your device location, and Google Cloud Vision to check profile photos before they are shown (policies.google.com/privacy)

Your first name and profile initial are visible to other players in the same game session (e.g., in the Who's Playing roster). We do not display your phone number or full contact details to other users.

A facility sees its own customer record for you: your name, email address and phone number, your bookings and bills at that facility, any notes its staff have added, and which of its documents you have signed, when, and the copy of each signature.

Which staff member sees what depends on the role the facility's owner gave them:

• Every staff member — owner, manager and front-desk staff alike — can search customers, open a customer record, create and cancel bookings, record attendance, mark a bill paid, and merge two records that turn out to be the same person.
• Managers and the owner can also change what the facility sells and upload or publish the facility's documents.
• Only the owner can invite or remove staff, cancel bookings in bulk, and erase a customer's personal data.

We do not give a facility your LocalRec account, your profile, or your bookings at any other facility.

A facility's customer record is linked to your LocalRec account only on an identifier you have proved is yours — an email address or phone number you confirmed with a one-time code. We never link on a contact detail that was merely typed. Once linked, the facility sees your bookings and signatures at that facility as one customer rather than several.

A facility can end up with two records for the same person — one taken over the phone, one created online. A staff member can combine them, after a preview that shows both records side by side, and the combination is recorded with who did it. Nothing is combined automatically.

Two records that are linked to two different LocalRec accounts are never combined.

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction. We will notify you via the Platform before your information is subject to a different privacy policy.

Every staff member at the facility can see your membership's status and dates, your photo, your check-ins and the staff note on your record, and can check you in. Managers and the owner can also see your price, your payments and refunds, the card brand or bank name with its last 4 digits, and your agreement, and can download a list of members with their email addresses and phone numbers. As the merchant, the facility also sees your payments in its own Stripe account.

Staff get notifications inside the facility's system that name you when you join, give notice, pause, miss a payment, or cancel for a reason the law sets out, and when your photo is retaken. A notice that could not reach you is shown to them too.

Your photo is shown only to you and to that facility's staff, and only through a private link that expires within 5 minutes. Only managers and the owner can open a document uploaded for a cancellation, through a single-use link that expires within 2 minutes. Staff do not see your birth date, your emergency contact, or the note typed when someone was let in anyway.

LocalRec support can also open your agreement and any document uploaded for a cancellation, and see your membership.

A facility keeps its own customer record for you for as long as you are its customer. Its owner can erase that record on request; Section 6.1 sets out exactly what an erasure removes and what it leaves.

A signed waiver is the evidence a facility would need if someone were injured, so it is the one record an erasure cannot take at once. When a facility erases its record of you, each of your signatures is instead marked to be erased two years later, and a daily job then erases the name you typed, the internet address, the browser string and the signed PDF we stored.

We chose two years because a personal-injury claim can arrive long after the session it concerns, and a waiver destroyed before then is destroyed exactly when it would first be needed.

What remains after those two years does not identify you: which version of the document was signed, the fingerprint of that version, the date it was signed, whether it was signed at the facility's desk, and which staff member witnessed it. The facility can still answer "was there a signed waiver" without holding anything that names you.

The signed copy we emailed you is in your own inbox. It is yours, and we cannot and do not recall it.

• Your photo is kept while you hold any membership at that facility. It is deleted 90 days after your last membership there ends, at once if you leave your first join there unfinished, and when the facility erases its record of you.
• Each check-in is deleted two years after it happened.
• A document uploaded for a cancellation is deleted 2 years after your membership ends, or sooner if the facility erases its record of you. A document uploaded but never sent is deleted within about a day.
• Each value a facility uploaded from another system is deleted 30 days after the upload, or at once if the facility undoes the import or replaces it with a new upload before using it. A member who could not be added as a customer, because the file had no email address or phone number for them, is kept until 30 days after the last day the old system billed them for. The customer and membership records made from those rows stay, as the next item describes.
• Your membership, its agreement, payments, cancellations and the notices we sent are the facility's records. We keep them for 7 years after your membership ends, including after an erasure. Then we delete the agreement and the notices, and remove the notes, reasons, references, payment labels and invoice links that name you. The dates and amounts stay as the facility's records.
• The record of when we showed you a membership suggestion is deleted when you delete your LocalRec account.

Ask the facility. Only that facility's owner can erase its record of you, and the erasure cannot be undone. A facility cannot erase your LocalRec account: your account is yours, and you delete it yourself from the app.

An erasure at a facility removes:

• Your name, email address, phone number and any staff notes on that facility's customer record, and the link between that record and your LocalRec account
• The name, email address and phone number on any contact record the facility itself created for you
• The contact details, the internet address and the cancellation links stored on each of your bookings at that facility
• The reasons staff typed when they cancelled a booking of yours, marked you as not having turned up, or booked or moved your booking outside normal availability
• The notes staff typed when they marked one of your bills paid or unpaid
• The reasons recorded about you in the facility's activity log
• Any unused link we had emailed you to sign a document, which stops working

Erasure also removes the email address, internet address and checkout token from expired or completed checkout holds associated with your record at that facility.

An erasure keeps:

• The booking itself — when it was, which space, its status and its money — which the facility needs for its accounts
• The facility's activity log of who did what and when, with the reasons about you removed
• Your signatures, for two years, and then only the non-identifying part of them (Section 4.2)
• Your LocalRec account and everything in it

A facility must first cancel any upcoming booking, finish or release an active checkout, and resolve any pending schedule change before erasing your record. The staff member who made an availability exception remains recorded; their free-text reason is removed.

You cannot delete your LocalRec account while you hold a membership that has not ended. Cancel it first. Deleting your account does not delete the facility's records of your membership, and a facility customer record you confirmed as yours stays linked to the closed account.

If you ask a facility to erase its record of you, your membership there ends at once and the unused days you paid for are refunded, or every payment within the cooling-off period. The erasure then deletes:

• your photo and your check-ins
• the details brought from another system, including the staff note, birth date and emergency contact
• any document uploaded for a cancellation, and the name of a representative who gave notice
• the reasons and notes recorded with your cancellations
• the payment method label and the payment page link stored with your membership
• the contact details on any join link sent to you, and the text-message links to your notices

Notices not yet sent are stopped. Your agreement, payments and cancellations stay as the facility's records, naming you only. Any amount you still owe stays owed to the facility.