Privacy Policy

PLOCK is an independent service based in Zamboanga City, Philippines. This policy explains how we handle personal data when you use PLOCK. We follow the Data Privacy Act of 2012 (RA 10173) and its implementing rules.

1. What we collect

Your identity, when you sign in

Your email address, name, profile picture URL and a Google account identifier. We receive these from Google when you choose to sign in with Google; we never see your Google password.

Your account

Which kind of account you hold (player or venue), your handle, and optionally your city and barangay so we can show you nearby courts.

Your bookings

Which courts you reserved, when, for how long, the amounts, the payment status, and any discount code applied.

Payment evidence you send us

If a venue collects payment on its own GCash or InstaPay details, you may upload a screenshot of your transfer and type the reference number. This is the most sensitive thing we hold, so: payment screenshots are never publicly reachable. They are stored privately, served only to you and to staff at that venue, and sent with headers that stop browsers and proxies caching them.

Your conduct record

No-shows recorded by a venue, and whether your reservations need confirming before they are accepted.

What you write and upload

Reviews, club posts, venue photos, and the courts you save.

Approximate location

Only if you allow it in your browser. It is used to sort courts by distance and is kept in your own browser; we do not build a history of where you have been.

Technical data

Your IP address and basic request information, through Cloudflare, which serves the site. We use it to keep the service up and to rate-limit abuse — for example, to stop somebody guessing discount codes. We do not use it to profile you.

We do not collect card or bank account numbers, because there is no card payment on this site. We do not ask for government ID from players.

2. Why we use it, and on what basis

• To perform our agreement with you — creating your account, placing holds, passing reservations to venues, sending booking confirmations, and calculating the booking fee.
• For our legitimate interests — keeping the service secure and available, preventing fraudulent payment references and fake reviews, and improving the product.
• With your consent — location, and any optional profile details you choose to add. You can withdraw consent at any time.
• To comply with law — keeping records we are required to keep, and responding to lawful requests.

We do not sell personal data. We do not run advertising on PLOCK, and we do not share your data with advertisers.

3. Who else sees it

Venues

A venue sees the reservations made at its own courts, including your name and contact details, so the desk knows who is arriving, and any payment evidence you submit for those bookings. A venue cannot see your bookings at other venues.

Within a venue, access depends on role. Someone signed in as counter staff is not sent the venue's takings at all — the money figures are absent from what their screen receives, rather than merely hidden on it.

Service providers

• Cloudflare — hosting, the database, image storage, email delivery, and network security.
• Google — only if you sign in with Google. They know you signed in to PLOCK; they do not receive your bookings.
• coins.ph — where PLOCK collects payment, to process and reconcile it.

These providers may process data outside the Philippines. Where they do, we rely on their contractual commitments to protect it to a comparable standard.

Other people using PLOCK

Your name, handle and profile picture are visible to others, as are reviews and club posts you publish. Your booking history, your no-show record and your email address are not public.

4. Cookies

We set one cookie: a signed sign-in cookie that keeps you logged in for 30 days. It cannot be read by scripts, and it is essential — the site cannot keep you signed in without it.

We currently run no analytics, advertising or tracking cookies at all. If that changes we will update this page and ask for your consent first, before any such cookie is set.

5. How long we keep it

• Account data — while your account is open, and for a short period afterwards so a booking dispute can still be resolved.
• Bookings — retained as a business record of the venue and of PLOCK, including for tax and accounting purposes.
• Payment screenshots and references — kept while the booking is open and for up to 12 months afterwards, so a payment can be traced if it is questioned. Ask us and we will delete them sooner where we no longer need them.
• Technical logs — kept briefly, on Cloudflare's own retention schedule, for security and debugging.

6. How we protect it

The site is served only over HTTPS. Your sign-in cookie is signed and cannot be read by page scripts. Payment screenshots sit behind an authenticated route that checks, per request, that you are either the person who booked or staff at that venue — and the folder they live in is refused outright by the public image route, so a leaked link is not enough. Access to the admin console is checked against the database on every single request rather than trusted from a cookie, so removing someone's access takes effect immediately.

No system is perfectly secure. If a breach affects your personal data and is likely to harm you, we will notify you and the National Privacy Commission as required by law.

7. Your rights

Under the Data Privacy Act you have the right to:

• be informed about how your data is used — this page;
• access a copy of the data we hold about you;
• have inaccurate data corrected;
• object to processing, and to withdraw consent where we relied on it;
• have data erased or blocked where it is unlawful, unnecessary, or no longer needed;
• obtain your data in a portable electronic format (data portability);
• be indemnified for damage caused by inaccurate or unlawful use.

To exercise any of these, email privacy@plockclub.app. A person handles these by hand — there is no self-service button yet — and we will respond within 15 days. We may need to confirm who you are first, so that somebody else cannot request your data.

Some data survives a deletion request: a completed booking is also the venue's business record, and we may need to keep the fact of it. We will tell you what we kept and why.

If you are unhappy with how we have handled your data, you can complain to the National Privacy Commission at privacy.gov.ph.

8. Children

PLOCK accounts are for people aged 18 and over. We do not knowingly collect data from children. A parent or guardian may reserve a court for a minor under their own account. If you believe a child has created an account, tell us and we will remove it.

9. Changes to this policy

We will update this page and change the date at the top when this policy changes. For a change that materially affects your rights, we will tell you by email or in the app before it takes effect.

10. Contact

For anything about privacy: privacy@plockclub.app. For everything else: support@plockclub.app. See also our Terms of Service.

This policy was last updated on 15 August 2026.