noelle

Privacy Policy

Last updated 2026-06-17 · Version 1.1 (Beta — not yet independently legally reviewed)

This Privacy Policy explains how the noelle service collects, uses, and shares personal data of users of the noelle mobile application and website (noelle.basketball, the Service).

German residents: a German-language version is available at noelle.basketball/privacy/de. In case of conflict, the German version prevails for users resident in Germany.

0. Operator and nature of the Service

The Service is currently operated as a private, non-commercial project by:

Alexander Hurley
noelle basketball
c/o flexdienst – #21344
Kurt-Schumacher-Straße 76
67663 Kaiserslautern
Deutschland

Contact: hello@noelle.basketball (general), privacy@noelle.basketball (privacy matters), delete@noelle.basketball (data-deletion requests).

noelle is not a registered business at this time. We do not charge for the Service, do not run advertising, and do not earn revenue from your use of it. If this ever changes (see §12 Future commercial operation), we will tell you in advance and require separate, explicit opt-in to any paid feature — you will never be billed simply because you continued to use the free Service.

The operator is the data controller within the meaning of Art. 4(7) GDPR / DSGVO and the German Federal Data Protection Act (BDSG).

1. Data we collect

1.1 Data you provide

1.2 Data collected automatically

1.3 OAuth (Google, Apple)

If you sign in with Google or Apple, we receive your email address, a provider-issued opaque user ID (sub), and your full name (only the first time you sign in with Apple). We do not receive your Google or Apple password. The OAuth ID is stored only to recognize you on subsequent logins.

1.4 Web hosting and server log data

When you visit noelle.basketball or any API endpoint, our edge server (Caddy, running on Hetzner) necessarily receives request metadata in order to deliver the response:

• IP address (truncated where feasible),
• requested URL and HTTP method,
• HTTP status code, response size,
• request timestamp,
• user-agent string,
• referrer (if your browser sends one).

This data is processed on the legal basis of Art. 6(1)(f) GDPR (legitimate interest) in operating the Service securely. It is used only to deliver content, detect attacks, and diagnose operational problems. Access logs are not used for marketing or profiling. Application access logs are kept for at most 7 days and then rotated out; security-relevant log entries (auth events) follow the retention rules in §1.2 and §5.

1.5 Inquiries via our contact addresses

When you write to one of our published contact addresses (hello@, privacy@, delete@, ops@ at noelle.basketball), we process the contents of your message and your email address.

• Purpose: to read, classify, route, and answer your inquiry, and to keep a record of how it was handled.
• Legal basis: Art. 6(1)(b) GDPR (pre-contractual / contractual measures, where the inquiry concerns your use of the Service); otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to operator inquiries).
• Recipients: processed by the operator. Email transit and storage is provided by our email forwarding / hosting provider (see §3).
• Retention: inquiries are retained as long as needed to handle the matter and any reasonable follow-up — typically up to 3 years after the last related correspondence, in line with the general limitation period under § 195 BGB. You may request earlier deletion under §5 unless statutory retention obligations (e.g. tax records, dispute defence) prevent this.

1.6 Mailing list / newsletter

If you submit your email through a signup form on noelle.basketball or inside the app:

• We collect your email address and the timestamp of your signup. If you used a referral link we also store the referral code.
• Legal basis: Art. 6(1)(a) GDPR — your explicit consent.
• Process: we use double opt-in. After you sign up you receive a confirmation email; only after you click the confirmation link does your email go onto the active list. The confirmation email contains no marketing content.
• Use: product-launch announcements, beta invitations, and occasional updates about the Service. We do not sell, rent, or share the list with third parties.
• Unsubscribe: every email contains a one-click unsubscribe link. Unsubscribing is immediate and free. You may also email privacy@noelle.basketball.
• Retention: confirmed addresses are retained until you unsubscribe or delete your account. Unconfirmed addresses are deleted after 30 days.

The mailing list is operated through our email-service provider (see §3 Sharing with third parties).

2. How we use your data

• Authenticate you and keep your account secure.
• Compute and display rankings (ELO, court leaderboards, event leaderboards).
• Show events, courts, and players nearby.
• Send push notifications you've subscribed to (challenge invitations, event updates, achievement awards) — disable in Settings at any time.
• Detect abuse, enforce sportsmanship rules, prevent fraud.
• Comply with legal obligations (court orders, law-enforcement requests where mandatory).

We do not sell your personal data. We do not show third-party advertising. We do not use behavioural-tracking SDKs. If any of this changes we will update this policy and notify you at least 30 days in advance.

3. Sharing with third parties

We share the minimum personal data necessary with the following processors (Auftragsverarbeiter). A Data Processing Agreement (DPA) under Art. 28 GDPR will be / is in place with each:

US-based processors are covered by the EU-U.S. Data Privacy Framework (adequacy decision, July 2023) and by Standard Contractual Clauses (SCCs) where applicable.

A note on the unavoidable terminal hop. Mobile push notifications must terminate at either Apple's APNs (for iPhones / iPads) or Google's FCM (for Android devices). There is no technical path for any app to deliver a notification to an iOS or Android device that bypasses these services — they are operated exclusively by Apple and Google respectively. We use Expo's relay only to batch and route notifications to the correct terminal service; the relay itself does not change the fact that the final delivery hop is operated by a US-headquartered company. If you do not want push notification metadata to traverse Apple or Google infrastructure, you can disable notifications at the operating-system level — we will fall back to email (Brevo, France) and in-app banners (served from our own Hetzner servers) for any important messages, including legal notices and security alerts.

Sensitive content does not traverse the push channel. For the "legal — security incident" classification, we replace the push body with a generic prompt ("Important security update — open the app for details") so that the substance of any breach notification reaches you only via email and in-app banner, never via the US-based push relays.

We do not transfer personal data to any other third party except when required by law, with your explicit consent, or to the operator's legal counsel in the event of a legal dispute concerning the Service.

4. Retention

When you delete your account (see §5), we hard-delete your profile and all directly linked records (matches, rankings, badges, push tokens, refresh tokens, event participations, ratings). Authored content that benefits other users (e.g. courts you registered, events you hosted) is preserved in anonymized form — your name is removed and replaced with a generic placeholder.

If the Service ever transitions to commercial operation (§12), payment records will be retained for 10 years as required by German tax law (AO §147). This only applies to records created after you have opted into paid features.

5. Your rights (GDPR Art. 15–22)

You have the right to:

• Access the personal data we hold about you (Art. 15) — request a copy via Settings → Export, or by emailing privacy@noelle.basketball.
• Rectification — correct inaccurate or incomplete data (Art. 16). Most fields are editable in Settings → Edit Profile.
• Erasure ("right to be forgotten", Art. 17). You may delete your account in either of two ways:
  • In-app: Settings → Delete Account. Hard-delete is immediate.
  • Email: send a request to delete@noelle.basketball including your username and the email address registered to the account. Both fields are required so we can verify the request and avoid deleting the wrong account. We will confirm by replying to that email, then complete the deletion within 30 days.
• Restriction of processing (Art. 18) — email privacy@noelle.basketball to pause processing while we resolve a dispute.
• Portability (Art. 20) — request a JSON export of your data via the in-app export feature or by email. We aim to respond within 30 days.
• Objection (Art. 21) — opt out of processing based on legitimate interest at any time.
• Withdraw consent (Art. 7(3)) — for processing based on consent (location, push tokens, newsletter), withdrawal is instant and free.
• Complain to a supervisory authority — for German users, the competent authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (datenschutz-berlin.de).

6. Security

• Passwords are stored only as bcrypt hashes (cost factor 10).
• All traffic between the app and our servers uses TLS 1.2+.
• Refresh tokens rotate on every use; a stolen token is invalidated as soon as the legitimate user refreshes.
• Authentication routes are rate-limited to deter brute-force attacks.
• Database backups are encrypted at rest in EU data centres (Hetzner).
• Access to production systems is restricted to a small list of named individuals and audited.
• Row-Level Security policies are enabled on tables containing user-specific data as a defence-in-depth layer.

We will notify affected users and the responsible supervisory authority within 72 hours of becoming aware of a personal-data breach (Art. 33–34 GDPR).

7. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from children under 16 without parental consent (Art. 8 GDPR). Parents who believe their child has registered may contact privacy@noelle.basketball for account deletion.

8. Cookies and tracking

The mobile app does not use cookies. The website (noelle.basketball) uses only strictly necessary cookies (session, CSRF) where required. We do not use Google Analytics, Meta Pixel, or any third-party behavioural-tracking SDK. We do not run advertising networks.

9. International users

The Service is operated from Germany. Users outside the EU/EEA should be aware that data is stored on servers located in Germany / EU member states under EU privacy law, which is generally stricter than equivalent regimes elsewhere. By using the Service you consent to processing in the EU.

If you are a California resident, you have additional rights under the CCPA — contact privacy@noelle.basketball to exercise them. If you are a Brazilian resident, you have additional rights under the LGPD — contact the same address.

10. Events, prizes, and third-party organizers

The Service allows users (and the operator) to host events, leagues, and tournaments. When you participate in an event:

• Public event metadata (participant list, scores, ranking outcomes) is visible to other participants and, where the event is public, to any user of the Service.
• If the event has prizes, sponsors, or third-party organizers, the event description sets out the relevant terms. Prizes may involve disclosure of additional personal data to the prize provider (e.g. shipping address). Such disclosure happens only with your further consent at the moment a prize is awarded.
• noelle is not the organizer of events created by other users and does not warrant prize fulfillment for third-party-sponsored prizes. See the Terms of Service §5 and §7.

11. Changes to this Policy

We will update this Privacy Policy from time to time. Material changes will be announced by an in-app banner the next time you open the app, a push notification (if you have notifications enabled), and an email to your registered address. We will give at least 30 days notice before any material change takes effect.

12. Future commercial operation

The Service is currently free and non-commercial. We reserve the right to introduce paid features (e.g. tournament hosting fees, premium analytics) in the future. If we do:

• We will give you at least 30 days advance notice in-app and by email.
• Use of any paid feature will require separate, explicit opt-in (e.g. a checkbox and confirmation step at the point of payment).
• The existing free Service will continue to be available without fees, except where a specific feature has been explicitly moved behind a paywall — in which case you will be informed before the feature is restricted.
• You will never be billed simply for continuing to use the Service.

13. Social media presence

We maintain a presence on Instagram as @noelle.bball for community updates and announcements. Instagram is operated by Meta Platforms Ireland Ltd. (4 Grand Canal Square, Dublin 2, Ireland).

• When you visit or interact with our Instagram profile, Meta processes your personal data as an independent controller under its own privacy policy (instagram.com/legal/privacy). We have no influence over the data Meta collects, the cookies Meta sets, the profile data Meta combines, or where Meta stores the data.
• For interactions you initiate on our profile (follows, comments, direct messages), we and Meta may be joint controllers within the meaning of Art. 26 GDPR. The legal basis for our part is Art. 6(1)(f) GDPR — our legitimate interest in community outreach.
• For analytics that Meta exposes to us at an aggregate level ("Insights"), the joint-controller relationship is described by Meta in its Page Insights addendum.
• The noelle.basketball website itself does not embed Instagram feeds, pixels, share buttons, or any other Meta resource. The only Instagram touchpoint from the website is an outbound link in the footer — your data is transferred to Meta only when you actively click it.
• If you want noelle community engagement without giving data to Meta, prefer the in-app channels (Settings → Notifications) rather than Instagram.

You can object to processing for legitimate-interest grounds at any time under Art. 21 GDPR — contact privacy@noelle.basketball.

14. Contact

The {OPERATOR_NAME} / {OPERATOR_*} placeholders in §0 are filled in on the production server before this page is reached by visitors. This draft is the operator's source-of-truth statement and does not constitute legal advice. A German IT-Recht / Datenschutz attorney should review before commercial launch.