What Thwok holds about you, why, for how long, and how to get it back or get rid of it. Written to be read, not to be survived.
Who we are
Thwok is operated by the company below, which is the data controller for everything described on this page.
- Controller: SIMPLIFY HCS LIMITED
We are completing our registered company details and a dedicated privacy address for this page. Until they are published, reach us through the contact link in the site footer and we will answer on the same timescales.
What we hold
Only what the service needs to work. There is no analytics SDK, no advertising pixel and no third-party embed in either the website or the app — a test fails the build if one is added.
| What | Why we have it |
|---|---|
| Your name and email | So a booking, a club roster and a game have a person on them |
| Your account | Firebase Authentication holds your sign-in. You can play as a guest |
| Playing profile | Level, the area you play in, what you are looking for, availability — this is what matches you to games |
| Bookings | Court, time and price. We take no payment, so there is no payment record |
| Club membership and money | Your club rows, check-ins, statements, settlements and disputes |
| Games and club nights | Who organised, who played, scores and standings |
| Ratings | An Elo score and a win/loss record, so matchmaking is fair |
| Notifications | The feed in the app, capped at the most recent 30 |
What we deliberately do not hold: no home address or postcode, no date of birth, no card number and no payment token — we do not take card payments at all, so there is nothing of the kind to hold — no location history, and no health data. Check-in by location, when you turn it on, is decided on your phone — no coordinates ever leave it.
Our lawful bases
Decided per activity and written down, rather than claimed after the fact.
| Activity | Basis |
|---|---|
| Account, bookings, games, club membership | Performance of a contract |
| Club ledgers, statements and settlements | Contract, and a legal obligation — it is other members' money |
| Ratings and matchmaking | Legitimate interests: fair games. You can opt out |
| Public share cards for games and club nights | Legitimate interests: the way people find a game |
| Security, abuse prevention and audit | Legitimate interests |
| Marketing email or push | Consent, asked for separately. Nothing runs on this today |
How long we keep it
| What | How long |
|---|---|
| Your account and profile | While the account exists |
| Bookings, games and club nights | 24 months, then stripped of who you are |
| Ratings | 24 months after your last match |
| Club ledgers, statements and settlements | 6 full years plus the current year — required for tax records, and the club's books have to balance |
| Notifications | The most recent 30 |
| Email we send you | 30 days |
| Server logs | 30 days |
| Backups | 7 days point-in-time, 30 days scheduled |
Club money is the one thing deleting your account does not erase. We remove your name from it, but the amounts stay: they are part of a record other people are entitled to and that the law requires us to keep.
Storage on your device
There is no cookie banner because there is nothing to consent to. We store one thing on your device: the session token that keeps you signed in, which is strictly necessary for a service you asked for. No analytics cookie, no advertising cookie, no tracker.
Who else touches it
| Who | What for |
|---|---|
| Google Cloud / Firebase | Hosting, database, sign-in and server functions |
| Google Sign-In | If you choose to sign in with Google |
| Our email provider | Sending booking confirmations |
Your data is stored in London (europe-west2). Google is a global company, so some processing — support access — happens outside the UK under their standard data protection terms. We would rather say that than pretend otherwise.
Your rights
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, object to the ratings processing, or ask us to restrict what we do with it. We answer within one month.
Self-service export and deletion are being built into the app. Until they land, ask us and we will do it by hand — the answer and the timescale are the same either way.
If you think we have got it wrong you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first.
Age
You need to be 13 or over to have an account. We ask you to confirm it; we do not ask for your date of birth, because we do not need it. A junior playing at a club appears on a roster through their club, not through an account of their own.
Changes
This page is versioned in the same repository as the app. If we change something that matters we will tell you in the app rather than swap the text quietly.
Also worth reading: our terms