← Back to Pepper

Pepper

Pepper — Privacy Policy

Effective: 2026-10-23 · Contact: hello@trypepper.ing

This page covers the Pepper mobile app and the website at trypepper.ing. Pepper is operated by 1547851 B.C. Ltd., doing business as Metacube Digital ("Pepper," "we," or "us").

What we collect

  • Account: name, email, profile photo (from your sign-in provider via Supabase Auth, or a photo you choose from your library)
  • Account eligibility: the exact 18+ confirmation you agreed to, its version, and when you confirmed it. We do not collect your date of birth.
  • Profile: self-reported skill level, play areas, positions, availability notes
  • Matching: posters and sub requests you post, interest/claim actions, match status
  • Chat: coordination messages between matched captain and player
  • Events: saved/remind-me preferences; community event submissions
  • Device: Expo push token and platform (iOS/Android) for notifications
  • Approximate location (optional): if you use distance-based discovery, the app rounds your coordinates to roughly a kilometre before sending them, along with the travel distance you pick, so we can show games near you. Our server can accept and store coordinates at any precision. Other users never see your coordinates; the play areas you choose appear on your player card. Pepper works without location access.
  • Venue search: when you search for a venue while creating a poster, what you type is sent to Google Places to return matching venues. We send your search text, not your location.
  • Share links: when you share a poster or sub request, we mint a short link (trypepper.ing/s/...). We log anonymous view/open events (timestamp, link token, user agent) for basic attribution. We do not sell this data.
  • Diagnostics: crash and error reports are sent to Sentry, a third-party service. Reports may include your internal user ID and default SDK breadcrumbs such as request URLs. Performance tracing is disabled and the SDK is configured not to collect default personal information. Our event filters remove request bodies and authorization/cookie headers when they run; native crashes may not pass through the mobile filter.
  • App analytics: we record product events such as posts created and player interests accepted, with event properties, platform, app version, and your account ID when available. These events are stored in our own database, not sent to an outside analytics provider.
  • Waitlist: if you join the list on trypepper.ing, your email address, which page sent it, and a record of your consent — the wording you agreed to, its version, and when. We store no IP address and no browser user agent with it. Every waitlist email has one-click unsubscribe.

Club sign-up pages

Some clubs recruit players through a sign-up page on trypepper.ing, such as trypepper.ing/clubs/volna. Pepper runs the page and its inbox for the club. A club sign-up is separate from the app: it does not create a Pepper account and is not stored in the app's database.

  • What you give us: your name, email, self-assessed level, and the formats you want to play (men's, women's, coed). Optionally: your height, a phone, WhatsApp or Telegram handle, an Instagram handle, spike touch, the level you want to play, positions, area, the days you can play, a note, and how you heard about us.
  • A record of your consent: your confirmation that you are 19 or older, the boxes you tick, the version of the wording you agreed to, the page language, and when you sent it.
  • Where it goes: we email your sign-up to that club's inbox, an address on trypepper.ing hosted on Google Workspace, where the club's organisers read it. We add your name and email to the club's mailing list, held by Resend, our email provider. We send you one confirmation email.
  • Messages from the club: only if you tick the box allowing it. You can unsubscribe at any time by emailing the address on the club's page.
  • Instagram and group chats: your Instagram handle is shared with the club so it can follow you back. If you tick the photo box, the club may post photos of you on its Instagram, where Instagram processes them under its own policy. If you tick the group-chat box, the club may add you to a WhatsApp or Telegram group, where other members can see your number.
  • The form runs the same Cloudflare Turnstile check as the waitlist, and we do not send Cloudflare your IP address. Your IP address is held briefly in memory to limit repeated submissions and is not stored with your sign-up.
  • The form sends no analytics events, and nothing you type into it goes to website analytics. Visiting the page is covered by Website analytics below, like the rest of trypepper.ing.
  • Club sign-up pages are for people 19 and older, the age of majority in British Columbia.

How we use data

To match volleyball players for roster spots and subs, show relevant events in Metro Vancouver, send notifications about your posts and chats, pass a club sign-up to that club's organisers, and keep the service secure. We do not sell personal data.

Website analytics

This page covers the Pepper mobile app and the website at trypepper.ing. The tools below run on the site, not in the app. We do not sell personal data.

  • trypepper.ing uses Vercel Analytics and Speed Insights for aggregate traffic and performance, and Google Analytics for the same plus search attribution. Together they measure aggregate usage and conversions: which pages are viewed, which sections people engage with, and whether a waitlist signup completed — used to improve the site and understand the signup funnel.
  • The waitlist form already records whether a signup was started, completed, or failed. The email address you enter is sent to Pepper's own servers to join the list, and is never included in analytics events.
  • Google Analytics sets cookies. Vercel Analytics and Speed Insights do not.
  • The waitlist form runs a Cloudflare Turnstile check to keep bots out. It loads when you reach that form, may set a Cloudflare cookie for the challenge, and returns a single-use token we verify and discard. We do not send Cloudflare your IP address with that check, and the token is not stored against your signup.
  • Google Search Console and Bing Webmaster Tools receive no visitor data — they report how the site appears in search results, not who visited.
  • Google Analytics loads when you visit the site. You can opt out with a browser Do Not Track setting, an ad-blocker, or Google's Analytics opt-out add-on. We do not use website analytics for advertising, remarketing, A/B testing, or tracking you across other sites.

Sharing

For the mobile app we use Supabase (auth and database), Fly.io (API hosting), Expo (push delivery), Google Maps (Android map tiles) and Google Places (venue search), and Sentry (crash and error reporting). For trypepper.ing we also use Vercel (hosting, Analytics, and Speed Insights), Google (Analytics), Cloudflare (Turnstile, the anti-bot check on the waitlist and club sign-up forms), Resend, which delivers waitlist and club sign-up email and stores waitlist contacts and club mailing lists, and Google Workspace, which hosts our email inboxes, including club inboxes. If you tick the boxes on a club sign-up page, the club may also post your photo on Instagram or add you to a WhatsApp or Telegram group. Your account data is stored in the United States (Supabase database; Fly.io API hosting). Google Analytics and Sentry also process data in the United States.

Retention

We do not currently have a routine that deletes old messages or other activity data, so they may remain stored while the service operates. You can request account deletion in Settings; it starts a 7-day grace period. After deletion, we remove your name, phone number, email, account push-token records, and share links. A device token copied into older poster-chat delivery records may remain, and records of notifications already delivered to you remain with your account ID and notification title. We remove your profile photo from your profile and delete its file from Pepper's avatar storage after account redaction. If storage removal fails, we retry up to three times and keep an unresolved failure record for follow-up. Messages you sent in poster game chats are replaced with ‘[Message removed]’. Direct messages and sub-request chat messages you sent remain; sub-request chats are closed. Your card and number, roster and sub-request history, reports, and reliability counters remain. We clear the location, bio, play areas, and any billing identifiers stored on your account. Club sign-ups stay in the club's inbox and mailing list until you ask the club, or us, to remove them. Contact us with questions.

Your choices

  • Deny push notifications — core features still work with manual refresh
  • Block users — hides them from your feeds and prevents interaction
  • Sign out — removes local tokens; push token deregistered on logout
  • Club sign-ups — the optional boxes can be left unticked, and you can unsubscribe or have your sign-up deleted by emailing the address on that club's page

Your rights, and who is accountable

One person is accountable for privacy at Pepper, acting as our Privacy Officer, and you reach them at hello@trypepper.ing. You can ask us what we hold about you, ask us to correct it, ask us to delete it, or ask how it is being used. We answer within 30 days. Account deletion does not need to go through us at all — it is in Settings, and it starts a 7-day grace period you can cancel. If you are not satisfied with how we handle a request, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, and you do not need our permission or involvement to do so.

If there is a data breach

If personal information under our control is lost or accessed by someone who should not have it, we assess what happened and who it affects. Where a breach creates a real risk of significant harm to you, we report it to the Office of the Privacy Commissioner of Canada and tell you directly, as soon as feasible, describing what was involved and what you can do about it. We keep a record of every breach we become aware of — including ones we judge not to be reportable — for at least 24 months, so the judgement can be reviewed rather than taken on trust.

Children

Pepper is for adults 18 and older. We don't knowingly collect data from anyone under 18; contact us and we'll delete it. Club sign-up pages are for people 19 and older.

Changes

We will post updates at this URL and note material changes in release notes.