Privacy Policy

For the purposes of the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and India’s Digital Personal Data Protection Act, 2023 (DPDP Act), NIXE Labs (sole proprietor: Harish Sivaram) is the data controller responsible for your personal data.

• CONTACTnixe.cxt@gmail.com
• BUNDLE IDnixelabs.Courtsy

We collect only the information needed to operate Courtsy. We do not sell your personal data, and we do not use it for advertising.

2.1 Information you provide

Courtsy does not process real-money payments. Expense and settlement amounts are records of money owed between you and your friends — Courtsy does not transfer funds, store card details, or facilitate payment processing.

2.2 Information collected automatically

We do not collect: precise or coarse location, contacts, photos library, microphone audio, health data, calendar data, advertising identifiers (IDFA), or device fingerprints.

2.3 Information we do NOT collect

• Real-money payment information (no Stripe, Apple Pay, or in-app purchases)
• Third-party social-media profile data
• Behavioral tracking data for advertising purposes
• Cross-app or cross-website tracking

We use your information for the following purposes (with the GDPR legal basis noted in brackets):

1. To provide and operate the Service — running your account, syncing your data, calculating expense splits and statistics. [Performance of contract]
2. To send notifications — match invitations, RSVP reminders, expense approvals, settlement notifications via APNs. [Performance of contract / your consent at the OS prompt]
3. To enable group collaboration — Realtime updates so members of your group see new memberships, friendships, and game sessions immediately. [Performance of contract]
4. To protect security — auditing sign-in events, rate-limiting failed login attempts, detecting abuse. [Legitimate interests / legal obligation]
5. To respond to your requests — answering support emails, fulfilling deletion requests. [Legitimate interests / legal obligation]
6. To comply with law — responding to lawful requests from authorities. [Legal obligation]

We will not use your data for automated decision-making that produces legal or similarly significant effects.

Courtsy is a closed-group, invitation-based app. Other people who use Courtsy may see your information as follows:

• Anyone in a group with you can see: your display name, avatar, match history within that group, expenses you create or are a participant in, settlements involving you, and game sessions in that group.
• Your friends can see: your display name, avatar, and that you are friends with them.
• People you invite can see: your display name and the invite code you sent them.
• Group owners can see and remove members of groups they own.

Information you put into a free-text field (such as expense notes, match notes, or session location) will be visible to everyone in the relevant group. Do not put sensitive personal information in these fields.

We share data with the following third-party processors strictly to operate the Service:

We do not use third-party analytics SDKs (no Google Analytics, Firebase Analytics, Mixpanel, Amplitude, Sentry, or similar) and we do not share data with advertising networks.

If you are located in the EU/UK, your data may be transferred to and processed in countries outside the European Economic Area (such as the United States). Where this happens, we rely on lawful transfer mechanisms such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

Depending on where you live, you have the following rights over your personal data:

7.1 Everyone

• Access — Request a copy of the personal data we hold about you.
• Correction — Update inaccurate information (you can edit most of it yourself in the App).
• Deletion — Request that we delete your account and personal data (see Section 8).
• Withdraw consent — Where we rely on your consent (e.g., push notifications), you can withdraw it via iOS Settings.

7.2 EU/UK additional rights

• Right to data portability (receive your data in a machine-readable format)
• Right to restrict or object to certain processing
• Right to lodge a complaint with your local supervisory authority (e.g., the UK ICO, the Irish DPC, or your national DPA)

7.3 California (CCPA/CPRA) additional rights

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to non-discrimination for exercising your rights
• We do not “sell” or “share” personal information as those terms are defined under the CCPA

7.4 India (DPDP Act, 2023) additional rights

• Right to access, correction, and erasure of your personal data
• Right to grievance redressal — contact us at nixe.cxt@gmail.com
• Right to nominate another individual to exercise your rights in the event of your death or incapacity

To exercise any of these rights, email nixe.cxt@gmail.com. We will verify your identity (typically by confirming you control the email on the account) and respond within 30 days.

We do not yet provide an in-app account deletion button. To delete your account and associated personal data:

1. Email nixe.cxt@gmail.com from the email address registered to your Courtsy account.
2. Include the subject line “Delete my Courtsy account”.
3. We will verify your identity and delete your account within 30 days of your request.

When you delete your account:

• Your profile, friendships, group memberships, push tokens, and security logs are permanently deleted.
• Your matches, expenses, and settlements that involve other group members will be anonymisedrather than deleted, because deleting them would alter records (e.g., who-owes-whom) for other users who relied on them. Anonymised records will show “Deleted user” in place of your name.
• Backups containing your data are overwritten on a rolling basis (within 30 days).

Apple App Store policy requires us to offer this deletion path; we honour it.

Courtsy is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact nixe.cxt@gmail.com and we will delete it.

If you are between 13 and 18 (or the age of majority where you live), please use Courtsy only with the involvement of a parent or guardian.

We protect your data using:

• Encryption in transit — All connections to the App and backend use HTTPS/TLS. Connections that are not HTTPS are rejected by the App.
• Encryption at rest — Data stored in Supabase is encrypted at rest.
• Authentication — Industry-standard JWT tokens stored in the iOS Keychain.
• Row-Level Security — Database-level access controls so users can only read/write their own data and data shared with their groups.
• Rate limiting — Repeated failed login attempts trigger a temporary lockout.
• Audit logs — Sign-in and security events are logged for monitoring.

No system is 100% secure. If we become aware of a data breach affecting your personal data, we will notify you and the relevant authorities as required by law.

We send push notifications via APNs for events such as group invites, RSVP responses, expense approvals, and settlement updates. You can disable push notifications at any time via iOS Settings → Notifications → Courtsy. Doing so will not affect your ability to use the rest of the App.

The Courtsy iOS app does not use cookies or web tracking technologies. We do not use the iOS Advertising Identifier (IDFA) and we have not implemented Apple’s App Tracking Transparency (ATT) prompt because we do not track you across other apps or websites.

We may update this Privacy Policy from time to time. When we do, we will:

• Update the “Last updated” date at the top of this page.
• For material changes (e.g., new categories of data collection, new third-party processors), notify you via the App or by email.

Continued use of Courtsy after the effective date of an updated policy constitutes your acceptance of the changes.

If you have questions, complaints, or requests relating to your privacy or this policy:

We aim to respond within 7 days for general queries and within 30 days for formal rights requests.