Privacy Policy

Last updated: October 15, 2026

SpikePunk: Volleyball Courts (formerly Rule the Sand) and rulethesand.com are operated by SpikePunk Athletics ("we," "us," "our"). This policy explains what information we collect, how we use it, and the choices you have.

Information We Collect

Account information. We use Clerk to manage authentication. In the mobile app, you can sign in with email and password, Google, or Apple on iPhone. Account and profile information can include your display name, email address, and profile image.

Information you submit. We store contact details and content that you submit in corrections, group and court submissions, claims, social links, support requests, and moderation reports. Depending on the form, this can include a name, email address, phone number, social handle, location details, and free-text content.

Guest RSVPs. If you RSVP to a group session without an account, we collect the name and email address you enter, the session and date you selected, and a one-way hash of your IP address for abuse prevention. The organizer can see the guest name and email for that occurrence; the public sees only aggregate RSVP and guest counts.

Location information. Location coordinates may be used by location-based features to find nearby courts, groups, and events.

Mobile app location and weather. The app can ask to use your device's location while you are using the app, with Balanced accuracy. This is optional and you can turn it off in the app or your device settings. The app uses your location to show nearby courts, groups, and events, and sends your coordinates to our servers for those requests. If you turn on nearby-activity notifications, the app also sends your coordinates to our servers to power those notifications. If you turn on the IP location fallback and agree, the app asks ipwho.is for an approximate location based on your device's IP address. Your device's IP address is sent to ipwho.is, and ipwho.is can see it. This happens only after you consent. For current weather, the app asks Open-Meteo using a court's or trip stop's coordinates, not your own position. The mobile app uses Google Maps; Google may collect data under its own privacy policy.

Player, group, and event activity. Depending on the features you use, we store player profile and eligibility details, registration entries and answers, waiver acknowledgements, attendance and check-in records, group memberships, messages, feed posts, announcements, reports, preferences, and account-linked push tokens.

Group feeds and direct messages. When a group's feed is enabled, its posts are visible only to active members of that group and linked guardians. Group feed posts are not public, and organizers can hide posts. Admins and moderators can view feed content that has been reported. Direct messages can be read only by the two people in the thread; staff do not browse direct messages. If a message is reported, the reported message and up to ten nearby messages are saved for moderators and administrators to review. This report evidence is kept as long as needed to review the report and for safety and legal purposes.

Blocking. Blocking stops direct messages between the two people and hides each other's feed posts and comments from the blocker and the blocked person. Blocking does not remove anyone from a group.

Images. Group owners can upload a group logo and cover image. Court owners or court submitters can upload a court photo. These images are shown according to the group's or court's public visibility. Uploaded images are stored so they can be shown in the app and on the website. Group images can be reported. Profile pictures come from the sign-in provider. Earlier versions of uploaded group and court images are kept for administrator review. Deleting an account does not remove group or court images that the account uploaded, and their links may keep working.

Younger people. Parents or guardians can register a child through a guardian-managed profile. Member rosters are not shown for youth groups. Direct messages are not available between a minor, a guardian-managed profile, and other members. Youth groups cannot turn on the group feed.

Automatically collected information. Request IP addresses are used for rate-limiting and abuse prevention. Guest RSVP abuse-prevention records include a one-way hash of an IP address. Google Analytics and Google Tag Manager are used on the website's pages.

Cookies. Clerk sets session cookies to keep you signed in. The website also stores your analytics cookie preference and uses Google Analytics cookies only when analytics consent is accepted; the analytics consent control keeps advertising storage, ad user data, and ad personalization denied.

The mobile app has no advertising or tracking.

How We Use Information

• To operate the courts, groups, events, account, messaging, registration, and moderation features
• To find nearby courts, groups, and events from location coordinates
• To record session RSVPs and show attendance information to organizers
• To review reports and submissions
• To send transactional, support, and requested notification email
• If you allow notifications, we store a push token and your device platform, linked to your account, so we can send notifications you asked for. We delete these when you delete your account.

Third-Party Services

We use the following processors, each with their own privacy practices:

• Clerk handles authentication and account identity.
• Cloudflare hosts the website and server, stores application data in D1 and images in object storage, delivers content, and provides Turnstile abuse prevention.
• Resend sends transactional and support email.
• Expo Push delivers push notifications using registered device push tokens and notification content.
• Stripe processes website group-plan checkout and billing. Payment details are handled by Stripe.
• Google Analytics and Google Tag Manager support website analytics. Analytics storage is configured from your analytics cookie choice.

Data Retention and Deletion

To delete an account, follow the in-app steps in Settings and choose Delete account, or email privacy@rulethesand.com from the email address on the account. See our Account Deletion page for details.

Registration and waiver records that we keep for legal reasons are kept for seven years after the event. After that period, they are eligible for removal. Guest RSVP records for events are removed 30 days after the event date. Rate-limit records for guest RSVPs are removed after one day. Direct messages and feed posts you wrote stay in the group or thread with your name removed and the text replaced by "[deleted]". Check-ins and vouches are deleted. Report evidence is kept as long as needed to review the report and for safety and legal purposes. Earlier versions of uploaded group and court images are kept for administrator review. Deleting an account does not remove group or court images that the account uploaded, and their links may keep working.

Deleting your account deletes your sign-in account. If deletion cannot be completed, the app shows an error and you can try again.

Your Rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to certain processing. To exercise these rights, contact us at privacy@rulethesand.com.

Age

Our Terms require users who create accounts to be at least 13 years old.

International Users

SpikePunk: Volleyball Courts is used by visitors and organizations outside the United States, including in the European Union. Where applicable data protection law (such as GDPR) grants you additional rights, those rights apply to your data as described above.

Changes to This Policy

We may update this policy from time to time. We will update the "Last updated" date above when we do.

Contact

Privacy requests: privacy@rulethesand.com. Support and moderation: support@spikepunk.com.