Privacy Policy

Version 1.2, effective 8 October 2026

This policy explains what personal data Blastt (the website blastt.cz and the Blastt apps for Android and iOS) processes, why, for how long, who receives it and what your rights are. The Czech version is binding; this English one is a translation for your convenience.

1. Who is responsible

The controller of your personal data is HARMANEC s.r.o., ID No. 21328218, with its registered office at Příčná 1892/4, Nové Město (Praha 1), 110 00 Praha. Contact for anything about your data: info@blastt.cz.

2. In short

• You can look for free courts without an account. We then process no personal data about you beyond what is technically needed to deliver the pages (see section 3.8).
• An account holds what you need to play with others: your name, e-mail, the matches you play and the messages you write.
• We have no analytics, no advertising and no tracking — not on the web, not in the apps.
• You can download all your data (Settings → Download my data) and delete your account (Settings → Delete account) at any time.

3. What we process, why, and for how long

3.1 Your account

• Data: your e-mail address, display name and the identifier of your sign-in (from Google, Apple or e-mail link, through Google Firebase); your profile picture if you add one; your preferred language; your favourite sports; your answers to the onboarding questionnaire and the level that comes from them; when you created the account and when you last used it; which versions of the Terms of Service and this policy you accepted and when.
• Why: to create and run your account and the features you use.
• Legal basis: performance of the contract — the Terms of Service (Art. 6(1)(b) GDPR).
• How long: until you delete your account.

3.2 Playing with others

• Data: matches you create and join, join requests, results, your levels and their history, what you said about your opponents' level and what they said about yours, chat messages, recurring series and competition entries.
• Why: so that you can find players, arrange matches and keep track of your results.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• How long: until you delete your account. See section 5 for what happens then.

3.3 Safety: reports and blocks

• Data: reports you make or that are made about you (who, what, why, the reported message) and blocks you make. Reports are sent to us by e-mail.
• Why: to protect players from abuse and to deal with breaches of the Terms of Service.
• Legal basis: our legitimate interest in a safe service (Art. 6(1)(f) GDPR).
• How long: reports for 2 years; blocks until the account of either player is deleted.

3.4 Places and location

• Data: places you save (Home, Work and your own: a name and coordinates). They are stored on our server so they are on all your devices.
• Your device's location is used only on the device, to show distances. It is never sent to us, except as a rounded starting point of a search, which we do not store. The one exception is a watch you set around your location: it stores that rounded point (accurate to about 10 m) until the watch ends or you delete it.
• When you search for an address, the text you type goes through our server to Photon by komoot. Your IP address is not passed on.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• How long: saved places until you remove them or delete your account; a watch's point until its last day has passed or you delete the watch.

3.5 Notifications

• Data: the push token of each device where you allow notifications (for Google Firebase Cloud Messaging, which also delivers to Apple devices and browsers), your notification settings, your watches (alerts for a free court or a new match, with the place they watch around, see 3.4) and the notifications in the app.
• E-mail notifications: we may e-mail you about what happens in your matches and you have not seen in the app, at the address of your sign-in. We keep a record of which e-mails we sent you and when, and whether an e-mail to your address bounced (we then send no more until you sign in with a different address). You can turn every group of notifications and the Monday summary off in the notification settings, and every such e-mail has a one-click unsubscribe link.
• Legal basis: push notifications need your consent, which you give in your device's or browser's permission dialog and can withdraw at any time there or in Blastt's settings (Art. 6(1)(a) GDPR). The in-app notifications, the e-mail notifications and watches are part of the service: the e-mails are about your own matches (performance of the contract, Art. 6(1)(b) GDPR).
• How long: notifications in the app and the record of the e-mails sent for 90 days; that an address bounced until you sign in with a different one or delete your account; a push token until you sign out on that device, until Firebase tells us it is no longer valid, or after 1 year in which the app has not used it; watches until their last day has passed or you delete them.

3.6 Venue lists

• Data: your favourite venues and the venues you opened recently, synchronised between your devices while you are signed in.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• How long: until you change them or delete your account.

3.7 Data on your device

The apps and the web keep some data only on your device, for example your favourites while signed out, unsent changes and which tips you dismissed. We never receive it. On the web, the cookies and browser storage are described in the Cookie Policy.

3.8 Technical data

Our servers record technical data about requests (time, the address requested, your IP address) in their logs to keep the service secure and to find faults. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). The logs are kept only as long as needed for that and are then overwritten.

4. Who receives your data

Other players see your name, profile picture, level, the matches you are in, and the messages you write in a match's chat. They never see your e-mail address or your saved places.

We use these processors and services:

The machine that reads the venues' reservation systems processes no personal data.

Apple and Google run the App Store and Google Play under their own terms and privacy policies, as separate controllers.

We do not sell your data and do not share it with advertisers.

Transfers outside the EU

Google and Vercel may process data in the USA. Both are certified under the EU–US Data Privacy Framework, and their contracts with us include the European Commission's Standard Contractual Clauses.

5. When you delete your account

When you delete your account (Settings → Delete account; you confirm it with a link we e-mail you or, if we have no e-mail address for you, by having signed in within the last few minutes), at that moment:

• your e-mail, sign-in identifier, profile picture, levels, saved places, venue lists, watches, notifications, notification settings, the record of the e-mails we sent you and push tokens are deleted;
• your chat messages are deleted;
• you leave every future match and series; the future matches you created are cancelled;
• in past matches, which are part of other players' history, you appear as "Deleted player". Confirmed results and the level changes they caused stay, without your name.

Your sign-in user at Google Firebase is deleted right after. Until then, and for one hour more, while a sign-in from before the deletion could still be used, we keep a one-way hash of your sign-in identifier and the time of the deletion, so that such a sign-in cannot open a new account by mistake. If Google cannot delete the user at once, we also keep the sign-in identifier itself and try again every day, until it is deleted or you sign in with it again, which makes it your new account's.

A message you wrote that is the subject of a report is kept as evidence until the report is deleted (at most 2 years). Signing in again with the same Google, Apple or e-mail account creates a new, empty account.

6. Your rights

You have the right to:

• access your data and get a copy — Settings → Download my data gives you a file with everything that belongs to you, including your e-mail notification settings and the record of the e-mails we sent you;
• data portability — the same file is in the machine-readable JSON format;
• rectification — you can change your name, picture, language and sports in the app; for anything else, write to us;
• erasure — Settings → Delete account;
• restriction of processing and to object to processing based on our legitimate interest — write to us;
• withdraw consent to push notifications at any time — in your device's or browser's settings, or in Blastt's notification settings;
• lodge a complaint with the supervisory authority: the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz.

Write to info@blastt.cz. We answer within one month. We may ask you to confirm your identity, for example by writing from the e-mail address of your account.

7. Automated assessment

Your level is calculated automatically from your questionnaire answers and recorded results, and it is used to suggest matches that suit you. It has no legal or similarly significant effect on you.

8. Minimum age

Blastt is for people aged 16 and over. We do not knowingly process data of younger children; if we learn of such an account, we delete it.

9. Security

Data travels encrypted (HTTPS). Access to the servers and the database is limited to the people who run Blastt. We do not store passwords: sign-in is handled by Google Firebase.

10. Changes to this policy

When this policy changes, it gets a new version number and effective date, and the app shows you what changed before you continue.