Privacy policy

Effective October 14, 2026. Heads is operated by Aman Mehmood. Contact support@headsapp.co about privacy, support or deletion.

What we collect and why

Heads helps adults coordinate pickup basketball. Supabase processes your email, authentication sessions, private nickname and adult attestation, plans and joined runs with anonymous guest counts, notification preferences and safety reports. Public activity is venue-level counts without participant identities. We do not publish your GPS or a personal movement history.

Browsing works without location permission. Explicit Locate me (and one startup sample after prior permission) centers the searched area. No attendance verification or background location is collected; raw positioning samples are not stored in application tables. No background tracking is used. Supabase and the court provider may process searched areas; viewport queries can reveal vicinity.

Processors and external services

Supabase provides authentication, database and backend processing. LocationIQ/OpenStreetMap supply searched court/place information. Apple Maps or Google Maps process map/directions requests under their own policies. Expo processes optional push tokens only when alerts are enabled. Loading optional park photos sends an image request to Wikimedia Commons; photo credits link to the source and reuse license. Opening external links shares requests with those sites. Hosting, email delivery, processor logs and backups are subject to the operator's configured provider policies; contact us for details.

Your optional choice

Help improve Heads is off by default. Enabling it sends anonymous first-party usage events to Supabase. Sentry diagnostics are disabled for this beta. Diagnostics contain only a fixed error category, redacted stack frame line numbers, environment and app version. Native crash capture, replay, screenshots, view hierarchy, default PII and tracing are disabled. No emails, tokens, headers, URL queries, searches, GPS, safety content or user-entered fields are sent.

Usage events contain only an allowlisted action, server time, a random per-launch session ID, platform, version, discovery source and bucketed result count. They contain no account identity or advertising ID. Turning the choice off immediately stops new events and aborts pending application requests. Previously received anonymous events cannot be linked to an account for individual deletion. No advertising, sale of data or cross-app tracking is introduced.

Retention

Anonymous usage events expire at 30 days and are pruned hourly. No Sentry diagnostics are collected for this beta. Ended source plans and commitments stop contributing immediately and are deleted within 24 hours. Push registrations expire after 24 hours without renewal; notification jobs/delivery metadata expire within seven days. Mutation receipts have bounded retry windows (up to 48 hours for plans). Public facility metadata may persist; it is not personal GPS history.

Restricted safety evidence remains through resolution and 90 days afterward, then is pruned hourly. Account deletion removes reporter/target identity references without resetting that deadline. Safety text can include details supplied by a reporter. Backups and processor logs age out under configured retention; we do not promise immediate erasure from all backups.

Access, consent and deletion

You can edit your private profile, withdraw plans/commitments, update guest counts, and turn off optional diagnostics in the app. Delete your account from Account settings or the web deletion portal, with email OTP confirmation. Account-owned records are removed; shared runs remain without creator identity. For questions or applicable access, correction or deletion rights, contact the address above. Heads' pilot is for people 18 and older; the age statement is self-attestation, not verified age.