PRIVACY NOTICE

Last updated August 6, 2026

This privacy notice for Finn Devs LLC ("Company," "we," "us," or "our") describes how and why we might collect, store, use, and/or share ("process") your information when you use our services ("Services"), such as when you:

• Visit our website at https://yapbt.com, or any website of ours that links to this privacy notice
• Register for, organize, or participate in a pickleball league, tournament, or open play session through the Services
• Engage with us in other related ways — including any sales, marketing, or events

Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at support@yapbt.com.

SUMMARY OF KEY POINTS

What personal information do we process? When you register for or use the Services, we process your name, email address, date of birth, and sex. We also process your match results, event registrations, and the venues where you play.

Do we process any sensitive personal information? We process date of birth and sex, which are treated as protected classification characteristics under California and federal law. We collect these because divisions in pickleball events are commonly organized by age bracket and by gender, and we cannot place you in the correct division without them. We do not process health data, biometric data, precise geolocation, racial or ethnic origin, religious beliefs, or information about sexual orientation.

Do you receive any information from third parties? No. We do not purchase or receive personal information from data brokers, marketing partners, or social media platforms. Some information may be entered about you by a tournament or league organizer who registers you for an event.

How do we process your information? To operate the Services — creating your account, registering you for events, seeding brackets, recording scores, and displaying standings — as well as for security, and to comply with law.

In what situations and with which types of parties do we share personal information? Almost never. We run our own servers and database, so your information is not handed to a hosting or email vendor. We do not sell or share your personal information for advertising, and we use no ad networks, retargeting platforms, or third-party trackers.

How do we keep your information safe? We use appropriate technical and organizational measures to protect your information, including encryption in transit and industry-standard protection for stored credentials. However, no electronic transmission or storage technology can be guaranteed to be 100% secure.

What are your rights? Depending on where you are located, you may have rights to access, correct, delete, or obtain a copy of your personal information.

How do I exercise my rights? Email us at support@yapbt.com. We will consider and act upon any request in accordance with applicable data protection laws.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
5. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?
6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
8. HOW LONG DO WE KEEP YOUR INFORMATION?
9. HOW DO WE KEEP YOUR INFORMATION SAFE?
10. DO WE COLLECT INFORMATION FROM MINORS?
11. WHAT ARE YOUR PRIVACY RIGHTS?
12. CONTROLS FOR DO-NOT-TRACK FEATURES
13. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
14. DO RESIDENTS OF OTHER US STATES HAVE SPECIFIC PRIVACY RIGHTS?
15. DO WE MAKE UPDATES TO THIS NOTICE?
16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
17. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide when you register on the Services, register for an event, submit a match score, or contact us.

Personal Information Provided by You. The personal information we collect includes:

• Name — displayed to other participants on rosters, brackets, standings, and leaderboards
• Email address — used to sign in, to identify your account, and to contact you about your account or an event you entered
• Password — stored only in an irreversible, hashed form; we never store or have access to your actual password
• Date of birth — used to determine eligibility for age-bracketed divisions
• Sex — used to determine eligibility for men's, women's, and mixed divisions
• Event and match data — the divisions you register for, your partner in doubles events, your match results and scores, the venues at which you play, and the organizations and leagues you belong to

Sensitive Information. We process date of birth and sex, which California and federal law treat as protected classification characteristics. We process these solely to place you in the correct competitive division, which is a core function of the Services and cannot be performed without them.

Payment Data. We do not process payments and do not collect or store payment card information.

Social Media Login Data. We do not offer social media login. We do not receive information from Facebook, Google, Apple, or any other social platform.

Mobile Applications. We do not currently offer a mobile application. The Services are a website that works in your phone's browser. We do not request access to your device's location, camera, contacts, calendar, or Bluetooth, and we do not send push notifications.

All personal information you provide must be true, complete, and accurate, and you must notify us of any changes.

Information automatically collected

In Short: Some information — such as your IP address and browser characteristics — is collected automatically when you visit our Services.

• Log and Usage Data. Our servers record standard request logs, which may include your IP address, browser type, the pages you request, and timestamps. This is needed to operate and secure the Services and to diagnose problems.
• Analytics Data. We use Umami, a privacy-focused analytics tool that we host ourselves on our own infrastructure. It records page views and aggregate usage patterns. It does not use cookies, does not track you across other websites, and does not send your data to any third party. Because we host it, this data never leaves our systems.
• Device Data. We do not collect device identifiers, advertising IDs, or hardware fingerprints.
• Location Data. We do not collect your device's geolocation. We store the address and coordinates of venues — pickleball facilities — which is information about places, not about you. Recording that you played a match at a given venue does reveal where you have played.

Third-party requests. Pages we serve make no requests to third-party domains. Fonts, scripts, and styles are all served from our own servers, so browsing the Services does not disclose your IP address to any outside company.

Information collected from other sources

In Short: A tournament or league organizer may register you for an event.

We do not purchase personal information or obtain it from data brokers, public databases, or marketing partners. However, a tournament director or league organizer may create a participant record containing your name — and, where needed for division eligibility, your age or sex — in order to enter you into an event. Where this happens, you can claim that record and take control of it by registering an account.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security, and to comply with law.

• To create and manage your account, including authentication and password reset.
• To deliver the Services — registering you for divisions, assigning you to pools and brackets, scheduling matches to courts, recording scores, and publishing standings.
• To display public event information. Rosters, brackets, court assignments, results, and leaderboards are visible to other participants and, for public events, to spectators.
• To respond to your inquiries and provide support.
• To contact you about your account or an event you entered — for example, a schedule change or a change to our terms. We do not send marketing or promotional email.
• To protect the Services, including preventing fraud and abuse and investigating security incidents.
• To identify usage trends so we can understand how the Services are used and improve them.
• To comply with legal obligations.

We do not use your information for targeted advertising, we do not build advertising profiles, and we do not sell your information.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?

In Short: We only process your personal information when we have a valid legal reason to do so.

If you are located in the EU or UK, the GDPR and UK GDPR require us to explain our legal bases:

• Performance of a Contract. Most processing is necessary to provide the Services you signed up for — we cannot run an event you registered for without processing your registration, results, and division eligibility.
• Legitimate Interests. We rely on legitimate interests to secure the Services, prevent fraud and abuse, and understand aggregate usage so we can improve the product.
• Consent. Where we rely on your consent, you may withdraw it at any time.
• Legal Obligations. Where processing is necessary to comply with law or to establish, exercise, or defend legal claims.

Note that date of birth and sex are "special category" data under the GDPR only in limited circumstances; we process them to determine competitive eligibility, which is necessary for the contract you have entered into with us.

We are generally the data controller for account information. Where a tournament organizer uses the Services to run their own event, that organizer may be a joint controller with respect to the event data they enter and manage.

If you are located in Canada, we process your information with your express or implied consent, which you can withdraw at any time, and in the limited circumstances permitted by applicable law without consent.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We share very little, and we never sell your information.

Service providers. We operate our own servers and our own database, and we do not use a third-party hosting, cloud, or database provider. The Services do not currently send email, so we use no email delivery provider.

If we engage a service provider in future, we will do so under a written contract requiring them to protect your information and to use it only to perform services on our behalf, and we will update this notice.

We do not use ad networks, affiliate programs, retargeting platforms, data brokers, social networks, or third-party analytics services.

Other users. The Services are inherently public in part. Your name, division, match results, and standings are visible to other participants and, for public events, to anyone who views the event page. Do not use the Services if you do not want your name and results associated with the events you play in.

Organizers. If you register for an event, the organization running it can see your name, the division you entered, your partner, your results, and the contact email associated with your registration.

Business transfers. We may share or transfer your information in connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business.

Legal requirements. We may disclose your information where required to do so by law, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?

In Short: We are not responsible for the safety of information you share with third parties we link to.

The Services may link to third-party websites. We do not guarantee the safety or privacy practices of any third party, and this privacy notice does not cover any data they collect. You should review their policies and contact them directly with questions.

6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We use one cookie, and it exists only to keep you signed in.

We set a single session cookie when you sign in. It contains only an opaque identifier for your session — it holds no personal information — and is configured with standard browser protections that restrict how and where it can be sent.

This cookie is strictly necessary to operate the Services; without it we cannot keep you logged in. We do not use advertising cookies, tracking pixels, web beacons, or third-party trackers. Our analytics tool is self-hosted and does not set cookies.

If you clear or block this cookie you will be signed out and will need to sign in again.

7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: Our servers are located in the United States.

We are based in the United States and our servers are located in the United States. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States.

If you are a resident of the European Economic Area or United Kingdom, the United States may not have data protection laws as comprehensive as those in your country. Where we transfer personal information out of the EEA or UK, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses. We will take all necessary measures to protect your personal information in accordance with this notice and applicable law.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as your account is active.

We keep your personal information for as long as you maintain an account with us, unless a longer retention period is required by law.

Competitive results are retained after account deletion in anonymized form. Match results and standings are part of the historical record of an event, and removing one player's results would corrupt the results of everyone they played. When you delete your account, we anonymize your player record — your name, email, and date of birth are removed, and your results remain attached to an anonymous identifier. The results can no longer be linked back to you.

When we have no ongoing legitimate business need to process your personal information, we will delete or anonymize it, or, where that is not possible (for example because it exists in backup archives), securely store it and isolate it from further processing until deletion is possible.

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We use appropriate technical and organizational security measures.

Our measures include:

• Encryption in transit for all traffic between your device and the Services.
• Irreversible hashing of passwords, so we cannot recover or view your password.
• Session protections designed to limit the risk of a session being intercepted or reused.
• Access controls restricting which users can view or modify organization, event, and participant data.
• Ongoing review of our systems and dependencies.

We deliberately do not publish the specific algorithms, configurations, or products we use to secure the Services.

However, despite our safeguards, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that unauthorized third parties will never defeat our security. Transmission of personal information to and from our Services is at your own risk.

10. DO WE COLLECT INFORMATION FROM MINORS?

We do not knowingly solicit data from or market to children under 18 years of age. By registering for an account, you represent that you are at least 18 years old.

An event organizer may create a participant record for a minor in order to enter them into an age-appropriate division. Where that happens, the organizer is responsible for obtaining any consent required from the minor's parent or legal guardian. A parent or guardian may review, correct, or request deletion of their child's information at any time by contacting support@yapbt.com.

If we learn that a person under 18 has registered an account, we will deactivate it and take reasonable measures to promptly delete the associated data from our records.

11. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: You may review, change, or delete your account at any time.

In some regions (like the EEA, UK, and Canada), you have rights under applicable data protection law. These may include the right to:

• request access to and obtain a copy of your personal information
• request rectification of inaccurate information or erasure of your information
• restrict or object to the processing of your personal information
• data portability
• withdraw consent, where we rely on consent

To make a request, contact us at support@yapbt.com.

If you are located in the EEA or UK and believe we are unlawfully processing your personal information, you have the right to complain to your local supervisory authority — contact details at https://edpb.europa.eu/about-edpb/about-edpb/members_en. If you are in Switzerland: https://www.edoeb.admin.ch/edoeb/en/home.html.

Withdrawing your consent. Where we rely on consent, you may withdraw it at any time by contacting us. This will not affect the lawfulness of processing before withdrawal.

Marketing communications. We do not send marketing or promotional email. If we ever begin to, it will be optional, every message will carry an unsubscribe link, and we will update this notice first. Messages necessary to administer your account or an event you have entered are not marketing and are sent regardless.

Account Information. To review or change your information, sign in and update your profile. To delete your account, contact us at support@yapbt.com. On deletion we anonymize your player record as described in Section 8; we may retain limited information to prevent fraud, resolve disputes, and comply with legal requirements.

12. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers include a Do-Not-Track ("DNT") feature. No uniform technology standard for recognizing DNT signals has been finalized, and we do not currently respond to DNT browser signals. This is of limited practical consequence for our Services, since we do not track you across websites and use no third-party advertising or analytics. If a standard is adopted that we must follow, we will inform you in a revised version of this notice.

13. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Yes.

California Civil Code Section 1798.83 ("Shine The Light") permits California residents to request, once a year and free of charge, information about categories of personal information we disclosed to third parties for direct marketing purposes. We do not disclose personal information to third parties for direct marketing purposes.

If you are under 18, reside in California, and have a registered account, you may request removal of unwanted data that you publicly posted on the Services by contacting us.

CCPA / CPRA Privacy Notice

What categories of personal information do we collect?

Retention. We retain Categories A, B, C, and L for as long as your account is active, then anonymize as described in Section 8. Category F (server logs and aggregate analytics) is retained for 30 days.

Sensitive personal information. The only sensitive personal information as defined by the CPRA that we process is your account login credentials, which we use solely to authenticate you. We do not use or disclose it for inferring characteristics about you, so the right to limit its use does not apply. (Sex and date of birth are "protected classification characteristics" under Category C rather than CPRA "sensitive personal information.")

How do we use and share your personal information?

We do not use targeting or marketing cookies, social media cookies, beacons, pixels, tags, click redirects, or social media plugins.

Finn Devs LLC has not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months, and does not do so. We have disclosed Categories A and B to our hosting and email service providers, under written contract, solely so they can perform services on our behalf.

Your rights

• Right to request deletion. You may ask us to delete your personal information, subject to legal exceptions. See Section 8 for how competitive results are handled.
• Right to know. You may request the categories and specific pieces of personal information we have collected about you.
• Right to correct. You may request correction of inaccurate personal information.
• Right to non-discrimination. We will not discriminate against you for exercising your privacy rights.

Verification. On receiving a request, we will verify your identity by matching the information you provide against what we hold, or by contacting you at the email address on your account. We will use information provided for verification only for that purpose and will delete it afterward.

To exercise these rights, email support@yapbt.com.

14. DO RESIDENTS OF OTHER US STATES HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Yes — several states now grant comparable rights.

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws may have rights including:

• the right to know whether we process your personal data
• the right to access your personal data
• the right to correct inaccuracies
• the right to request deletion
• the right to obtain a copy of the personal data you previously provided
• the right to opt out of processing for targeted advertising, the sale of personal data, or profiling with legal or similarly significant effects

Finn Devs LLC does not sell personal data, does not process personal data for targeted advertising, and does not engage in profiling that produces legal or similarly significant effects. The opt-out right therefore has nothing to apply to, but the access, correction, and deletion rights are fully available.

To exercise these rights, email support@yapbt.com. We will respond without undue delay and within 45 days of receipt, extendable once by a further 45 days where reasonably necessary, in which case we will tell you why.

Right to appeal. If we decline to act on your request, we will tell you why. To appeal, email support@yapbt.com with "Privacy Appeal" in the subject. We will respond in writing within 60 days. If your appeal is denied, you may contact your state Attorney General to submit a complaint.

15. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Last updated" date and will be effective as soon as it is accessible. If we make material changes, we will notify you either by prominently posting a notice or by contacting you directly.

16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, or wish to exercise any of the rights described above, you may contact us by email at support@yapbt.com.

Finn Devs LLC is a company registered in the United States and operates the Services exclusively online.

17. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You may have the right to request access to the personal information we collect from you, to change it, or to delete it. To make a request, sign in and update your profile, or email us at support@yapbt.com.