Privacy
What Kicksmash keeps about you, who helps us run it, and how to make it all go away.
Who we are
Kicksmash, Phuket, Thailand. We run this app and decide what happens to your data. To reach us, use the feedback form: a person reads every note.
What we keep
• The name you play under. • Your email, only if you give it. • If an organiser saves a seat for you: the name, email or phone number they typed. We email you the invite, and the organiser sees those details again when they invite people to their next match. • If you played a match with an organiser in the last 60 days and we have no way to tell you about a free place (an email counts only while you let us email you about changes to your matches): while their match has a place open, that organiser can see your first name and that we cannot reach you, so they can send you the link themselves. • Your phone number, only if you write to our WhatsApp number: that is how WhatsApp knows you. • Your Telegram id and username, and your Discord or LINE id and name, only when you link that account. • Your level, and how it changed over time. • Your matches, your seats, the scores, and a photo if a player adds one to a match. • When and where you want to play, if you tell us. • The devices you turned notifications on for. • If you let a phone remember you: a passkey's public key, the phone and the browser that saved it, the day you saved it and the day you last used it. Never your face, your fingerprint or a password: Face ID and your fingerprint stay on your phone. • Your inbox on My matches: the notices we send you or keep for you, which kinds you switched off, and your quiet hours. • If you coach: your coach page, your students and your lessons. • The notes you send us through the feedback form. • If you ask us never to email you again, or an email to you bounces: that address, only so we stop sending to it.
Cookies
Only the cookies the app needs to work. No tracking, no ads, no cookies from anybody else. • km_player: who you are, signed so nobody can fake it. One year. • km_has_id: tells the page that you have an identity. One year. • km_by_name: only after you came in by your name alone ("That's me" beside your name, or "I'm in" on an invitation to a place kept for you); until you prove who you are with an email code or a chat account, your personal link stays hidden. One year. • km_passkey: only while Face ID or your fingerprint checks who you are; it goes after one use. Five minutes. • NEXT_LOCALE: your language. One year. • km_manage_ plus a match code: lets the organiser manage that one match. One year. • ks_src and ks_csrc: the link that brought you here, so we can count it. One day. • ks_notmine: the names you said are not you, on My matches. One year. • km_text: bigger text, only if you switch it on. One year. Your browser also keeps a copy of who you are in its own storage, so a lost cookie does not lose your matches.
Your IP address
We never write it into our database. To slow down scripts that hammer the app, we keep a key made from it with a secret (a keyed hash), so the address itself is not stored. Those rows go after 2 days. Our host sees your address to deliver each page, as every host does.
Who helps us run it
• Vercel hosts the app in Singapore, and counts page visits without cookies. • Supabase keeps the database in Singapore. • Resend sends our emails. • Telegram, Discord, LINE and WhatsApp (Meta) carry our messages, only if you use them with us. • Telegram also brings us each note from the feedback form, with the name on it. • Your browser's push service (Apple, Google or Mozilla) carries the notifications you turned on. • Google, only if a coach connects a Google Calendar: their lessons, with the student's name, go into it. • Anthropic reads the notes from the feedback form and the messages in our own Discord server, to help us sort them and draft replies. It also reads a booking screenshot that you add on the first page, once, to fill in the match form. We keep neither the picture nor the answer. • GitHub keeps our private nightly backup of the database. Tavily searches the public web for padel clubs and padel talk for us. It never gets your data.
How long we keep it
• Your data: while you use Kicksmash, until you delete your account. • A name with no match, no way to reach it and nothing else behind it: a daily clean-up removes it after 14 days. • The rate-limit keys made from IP addresses: 2 days. • Backups: every night a copy of the database goes to a private GitHub repository, and only we can open it. Each night we also rebuild the repository's history, so it holds about the last 60 days. Older copies then leave its history. GitHub deletes them later, and it does not say when. Until then, we can still open them, and nobody else can. • Your inbox: each notice for 90 days.
When you delete your account
Delete it at the bottom of My matches. At once, we remove your name, email and phone (also the copies an organiser typed for your seat), your personal link, linked chat accounts, public page, notification devices, the phones that remember you, the times you wanted to play, your inbox, and your coach page with its lessons. Your upcoming spots are released, and the matches you organise are cancelled. Your old scores and level stay under “Deleted player”, so your partners' history still adds up. The notes you sent through the feedback form stay, with the name and contact on them, because they are about the app: ask us and we delete them too. Your first name leaves the page of ideas that became the app. Copies made before you deleted leave our private backup repository after about 60 days. After that, older copies are no longer in its history, and GitHub removes them later. Until then, only we can open them.
Your rights
See and change your name, email and notices on My matches. Download everything we hold about you as one file from My matches → Passport. Delete it all from the bottom of My matches. For anything else, a question, a correction or a complaint, write to us through the feedback form.
The law
Thailand's Personal Data Protection Act (PDPA) applies. We use your data to run the app you came to use, and for nothing else: we never sell it, never show ads, and never build a profile of you for anybody else.
Last updated 16 October 2026.