PickleBack is a free app with no account system. There is no email address, no password, and no name tied to any real-world identity. The only data stored on our server is what is necessary to record and verify pickleball match results and to authenticate your device.
| Data | Retention | Why |
|---|---|---|
| Display name | Indefinite | A username you choose at first launch. Shown to other players in lobbies and match records. Does not need to be your real name. Snapshotted into completed match records — renaming yourself does not alter past matches. |
| Public key (RSA 2048) | Indefinite | Your permanent pseudonymous identity. Used to verify that match submissions are signed by your device. The private key never leaves your device. |
| Server-generated identifier | Indefinite | A UUID created by our server (not derived from your hardware) that links your public key, display name, and match records together. |
| Registration timestamp | Indefinite | The date and time your device first registered with the relay. |
| Match records | Indefinite | Session details, team assignments, player names (snapshotted at session start), scores, and timestamps for confirmed and disputed matches. |
| Authentication token hash | 30 days | A SHA-256 hash of your session bearer token, stored to authenticate API requests. The raw token is never stored. Expires automatically after 30 days. |
| Auth challenges & lobby data | Ephemeral | Single-use sign-in challenges (deleted within 24 hours of expiry) and lobby state while players are gathering (discarded after the session starts or expires). Neither is retained after it is used. |
We do not collect: email addresses, phone numbers, location data, contacts, payment information, or any biometric data. The biometric sensor (Face ID / Touch ID) is used only to unlock the private key on your device — no biometric data is transmitted to our servers.
Your RSA private key is generated on your device and stored in the iOS Keychain protected by biometric access control. It never leaves your device. Our servers never receive, store, or process your private key.
Your identity is your device. If you lose your phone or delete the app, your identity cannot be recovered. This is by design — it means no account recovery system is needed and no identity verification is stored. Your match history remains on our servers but cannot be accessed without the original private key.
We do not sell, rent, or share your data with any third party for any purpose. PickleBack is a free app and your data is not used commercially in any way.
Match records are retained indefinitely so your history is durable. If you would like your data deleted, contact us at the support email below and we will remove all records associated with your public key.
PickleBack is not directed at children under 13. We do not knowingly collect data from children under 13.
We may update this policy. We will update the "Last updated" date at the top of this page. Continued use of the app after a change constitutes acceptance.
Questions about this privacy policy: picklebackapp@gmail.com