Skip to content

Privacy notice

Last updated 9 November 2026.

Who we are

Rails: Squash Club is run by Twentysix Labs LLC, a Delaware limited liability company at 8 The Green, Suite 7811, Dover, DE 19901. We decide how the data described here is used. This notice covers rails.club, app.rails.club, the Rails app and the emails we send.

What we collect

When you apply

  • Your full name, work email, firm, role and the city you want to play in.
  • Your level: a SquashLevels or US Squash rating and its id, the level you type in, or that you have no rating yet.
  • The times you can play, the membership and billing you choose, and your agreement to the Terms of membership and the Code of conduct.
  • A six-digit code we email to your work email, to confirm it is yours.

If you choose "Save and exit", your answers stay in your browser for 7 days. They reach us only when you submit.

When you write to us

Your name and email; your organisation, role and message if you give them; the page you wrote from; and what that form asks for: a package, your venue's name and number of courts, a city, a topic, or, for the juniors waitlist, an age group.

When you're a member

  • Your account: your email; Apple's relay or real address if you use Sign in with Apple; the sign-in codes we email you, each valid for 10 minutes; and your signed-in sessions (device or browser, platform, last active), each lasting 60 days and renewed while you use it.
  • Your profile: display name, role, industry, seniority and a photo if you add one, and which of these opponents may see.
  • Your play: availability and away dates, games, standby choices, scores, fit ratings, game credits and penalties, reports and incidents, and your level and its history.
  • Your payments: your tier, billing, invoices and payment status. Stripe holds your card; we never see the full number.
  • Your messages: your inbox, support tickets and notification choices.
  • People you name: a guest's name and email; for a hosted client game, the client's name, email and organisation.
  • Trips: the passport and travel details the trip's local operator needs, given by the balance due date.

In the app

  • A push token, the app installation's id and your phone's platform (iOS or Android), to send you notifications. We ask for notifications after you first confirm your week.
  • Calendar access, asked at your first game, used only to add your games to your calendar.
  • Photo access, asked only when you set a profile photo.
  • No location, ever, and no tracking across other companies' apps or sites, so the app never shows a tracking prompt.

How we use it

  • To run your membership: decide applications, set your level, match you, book courts, send your games, run standby, the ladder and the league, and bill you.
  • To answer you when you write to us.
  • To keep the club fair and safe: review reports, settle score disputes, and stop abuse with bot checks and rate limits.
  • To improve Rails, from counts, not from individuals.
  • Fit ratings are used only to tune pairings.

The Friday matching run pairs members by fixed rules, and the Rails team reviews each run before it is sent. People, never software alone, decide applications, reports and disputes.

We don't sell your personal information, share it for cross-context advertising or use it for advertising.

Who sees what

  • Your opponents: your display name and Rails level, plus your role, industry and photo only if you choose to show them. Never your email or phone.
  • Other members: the ladder and league show your name, Rails level and position.
  • Your firm, if it pays for your seat: your name, role, status, games played and the date you last played. Never your scores, opponents, fit ratings, availability, credits or penalties.
  • Venues: never who is playing. A booked court reads "Rails game", with its date, time and court only.
  • The Rails team: what it needs to run the club. Report details, dispute notes and fit ratings are seen by the team only.
  • SquashLevels: your results, only when both players in a game have agreed to share them.
  • A trip's local operator: the traveller details for that trip.
  • Anyone else: only when the law requires it.

Companies that work for us

These companies handle data only to do their job for us.

  • Railway: hosts our servers and database, in the United States.
  • Cloudflare: runs our domain and delivers the site, and checks forms for bots with Turnstile.
  • Stripe, through our billing provider Autumn: takes payments and keeps invoices. Your card details go to Stripe and never reach Rails.
  • Resend: sends our emails, from mail.rails.club.
  • Google Workspace: our mailbox, hello@twentysixlabs.com.
  • PostHog: product analytics, in its US region.
  • Expo: delivers the app's push notifications through Apple and Google.
  • Apple: Sign in with Apple, if you choose it.

Coming next, and listed here before each starts: SquashLevels, to look up ratings and, with consent, receive results once our partner access is in place (until then you type your level and we mark it unverified); Anthropic, whose Claude models will power our AI agents; and a voice provider for our phone line.

Cookies and analytics

We use PostHog to count page views and steps such as starting an application. The site sends it through our own address, rails.club/ingest. Exactly what that involves:

  • Two cookies on rails.club and its subdomains, named "ph_…_posthog" and "ph_…_posthog_cpm", each lasting up to 12 months, plus matching entries in your browser's storage. They hold a random identifier and session details, never your name or email.
  • No IP address. Our proxy passes PostHog the event and your browser type only; your cookies and IP address stay with us. Our PostHog project also discards IP addresses.
  • Clean addresses. Page addresses are recorded without their query strings, and private links, such as invitation links, are masked.
  • Ids and counts only. Events carry ids, step numbers and counts. Names, emails, firms, messages and anything typed into a form are refused before they are sent. Events from our server about your membership carry your Rails user id, never your name or email.
  • Off: session recording, click and keystroke capture, heatmaps, error capture and surveys. The app's analytics follow the same rules.

Turnstile, Cloudflare's bot check, runs on our forms. Signing in to app.rails.club sets a session cookie that keeps you signed in.

Your appearance choice (System, Club or Line) is kept in your browser only, as an entry named "rails.appearance". It is not a cookie and never reaches us.

There are no advertising cookies and no cross-site tracking. You can block or delete our cookies in your browser; the site works without them.

AI agents

Rails is adding AI agents: Ask Rails on the site, member support in the app, and a phone line. Each one:

  • says it is an AI acting for Rails before the first message, and names the person who takes over when you ask (Nnenna or Kira);
  • answers only from Rails' published facts, and can't change your membership, games or payments;
  • keeps conversation text out of logs and analytics, and lets you delete your conversation.

A conversation is kept with your record if you become an applicant, member, firm or venue; otherwise it is deleted 90 days after its last message. Calls keep a transcript; audio is never recorded.

How long we keep it

  • Your account and member data: until you delete your account. Then we erase it within 30 days, or within 30 days of any open dispute, incident or unpaid invoice being settled. Past games keep their score, with you shown as "Former member". Results already on SquashLevels stay there.
  • Payment records: 7 years, under an anonymous reference, for tax and accounting.
  • Applications we don't approve: declined and withdrawn applications 12 months after the decision; waitlisted ones while you are on the waitlist and 12 months after.
  • Enquiries: 24 months after our last exchange.
  • Inbox messages: 12 months.
  • A guest's name and email: 12 months after the guest's last game.
  • A hosted client's email: 30 days after the game.
  • Traveller details: 30 days after the trip ends or the booking ends.
  • AI conversations: as above.
  • An application saved in your browser: 7 days.

Your rights

Wherever you live, you can ask us to:

  • tell you what we hold about you and send you a copy;
  • send it as a file you can take elsewhere;
  • correct it;
  • delete it;
  • stop using it for a purpose, such as analytics;
  • tell you which companies we've shared it with.

In the app you can edit your profile, change your notification choices (games and standby offers always reach you by push or email), stop sending results to SquashLevels and delete your account. For anything else, write to hello@twentysixlabs.com or use Contact. We confirm it's you, usually with a code to your email, and answer within 30 days, free. Someone you authorise can ask for you.

If we can't do what you ask, we say why. Reply to appeal, and someone who didn't make the first decision answers within 30 days. Using these rights never changes how we treat you. You can also complain to your data protection authority or your state's attorney general.

Children

Rails is for adults: you must be 18 or older to apply or hold a seat. We don't knowingly collect data from children. Junior sessions aren't offered yet. The juniors waitlist takes a parent's or guardian's name and email and the child's age group, never the child's name.

Where your data is

We store and process your data in the United States. It travels encrypted, and only the Rails team can open member records.

Changes to this notice

Each version is dated at the top of this page. Before a change to how we use your data, we email members at least 30 days ahead.

Contact

Twentysix Labs LLC, 8 The Green, Suite 7811, Dover, DE 19901. Email hello@twentysixlabs.com or write through Contact.