Privacy Policies

About this policy

Last updated: October 13, 2026

Cotenos ("Cotenos", "we", "us" or "our") is owned and operated by Mohamad El Naboulsi, based in Tripoli, Lebanon. Mohamad El Naboulsi is responsible for the personal information described in this policy.

This Privacy Policy explains what personal information we collect when you use the Cotenos mobile app, the Cotenos website (cotenos.org) and the Cotenos business dashboard (together, the "Services"), how we use and share it, how long we keep it, and the choices and rights you have.

You can look at venues and coaches in the app without an account. We then collect only the information described under "Information collected automatically". You need an account to book.

By using the Services you acknowledge that you have read this policy. If you do not agree with it, please do not use the Services.

Information you give us: your account

• Account information: your name, email address, phone number and country code, and your password. We store only a one-way encrypted (hashed) version of your password, never the password itself.

• Profile information you choose to add: a profile photo, gender, date of birth, address and your preferred app language.

• Sign in with Apple or Google: if you sign in this way, we receive your name and email address from Apple or Google. With Sign in with Apple you can choose to hide your email address, in which case we receive a private relay address. We never receive your Apple or Google password.

• Sign in with Apple token: if you use Sign in with Apple, we may also store a sign-in token that Apple issues for your account. We store it in encrypted form and use it for one purpose only: to ask Apple to revoke the sign-in when you delete your Cotenos account. It is removed from our systems at the same time.

• Email verification: we send a link to your email address to confirm that it belongs to you, and we record whether your email address has been verified.

Information you give us: bookings and activity

• Bookings: the venue, date, time slots, coach (if any), any notes you add and the status of each booking.

• Bookings a venue makes for a customer: venue staff can record a booking for someone who calls or walks in, by entering that person's name and phone number. The venue enters this information and is responsible for it.

• Coach information, if you register as a coach: your bio, sports, hourly rate, availability and session and earnings records.

• Business information, if you own or manage a venue: details of your branches and venues (such as names, photos, prices and opening hours), the managers you add, your bookings and clients, and business records such as expenses that you enter.

• Reviews and ratings you post about coaches or venues.

• Reports: if you report a review, the reason you write, together with the review you reported.

• Blocked users: the list of users you choose to block, so that we can hide their reviews from you. We keep it until you unblock them or delete your account. The users you block are not told.

• Problem reports: if you use "Report a problem" in the app, the topic you choose and the message you write. Our team reads it together with your name, your contact details and the kind of account you have, so that we can answer you. Our answer is shown to you in the app and sent as a notification.

• AI features in the business dashboard, if you own a venue: the venue details you ask us to describe and the dashboard figures the AI insights feature summarizes (see "AI features" below). The mobile app has no AI assistant.

• Information you send us through forms on our website, including your name, business name, email address, phone number and message. A partner application is saved in our systems. A contact message is delivered to our email inbox.

• Business contacts: we keep contact details of sports venues, and of the people who represent them, that we are in touch with about joining Cotenos, such as a name, business name, phone number, email address and social media pages.

Information collected automatically

• Sign-in sessions: each time you sign in we create a session record with the time, your IP address and your device or browser information (user agent). We use it to keep you signed in, to let you sign out, and to keep your account secure.

• Sign-in protection: for a short time we count failed sign-in attempts for an email address and IP address, so that we can block attempts to guess a password.

• Live connection: while you are signed in, the app and the business dashboard keep a live connection to our servers, so that booking updates reach you at once. Cotenos administrators can see whether an account is connected at that moment.

• Push notification token: if you allow notifications, we store your device's push notification token so we can send you booking and account updates. It is removed when you sign out or delete your account.

• Device language: the app reads your device language to display the app in English or Arabic.

• Server logs: our servers keep technical logs (such as request times, IP addresses and errors) to operate, troubleshoot and secure the Services.

We do not use advertising identifiers, we do not track you across apps or websites owned by other companies, and we do not use third-party advertising or analytics tools. The app does not collect your location, and it does not use your camera or microphone.

Cookies

The business dashboard uses cookies that are needed to keep you signed in and to remember your language. The mobile app keeps your sign-in in your device's secure storage instead. We do not use advertising or analytics cookies on the website, the dashboard or the app. If spam protection is switched on for a form on our website, Cloudflare may set a cookie that is needed for that check.

Camera and photos

The app does not take photos or record video with your camera. If you choose to add a profile photo, the app asks for permission to open your photo library so that you can choose an existing photo, and we only receive the photo you select. Venue owners add photos of their venues in the business dashboard, by choosing files from their own device. You can change the photo permission at any time in your device settings.

How we use your information

• To create and manage your account and to sign you in.

• To show venues, availability, coaches and prices, and to let you make, manage and cancel bookings.

• To give venues, and coaches you book with, the details they need to manage your booking.

• To send you service messages by email or push notification, such as email verification, password resets, booking requests, confirmations and status changes.

• To provide the AI features of the business dashboard (AI-written venue descriptions and business insights for venue owners).

• To display reviews and ratings, to hide reviews by users you have blocked, and to review reports about reviews.

• To provide customer support, to read and answer the problem reports you send us, and to respond to your requests.

• To keep the Services and our users safe, prevent fraud and abuse, and enforce our Terms and Conditions.

• To maintain, troubleshoot and improve the Services.

• To comply with our legal obligations.

We do not sell your personal information, and we do not use it for advertising.

Legal bases

Where the law requires a legal basis for using personal information, we rely on:

• Performance of our contract with you: to provide the Services you ask for, such as your account and bookings.

• Our legitimate interests: to operate, secure and improve the Services and prevent misuse, in ways that do not override your rights.

• Your consent: for example for push notifications and access to your photo library. You can withdraw consent at any time in your device settings or by contacting us.

• Legal obligations: where we must keep or disclose information by law.

How we share information

• Venues and coaches: when you make a booking, the venue's owner and managers (and the coach, if you book one) can see your name, email address, phone number and booking details so they can manage your booking. Venues and coaches are independent businesses and are responsible for how they handle this information.

• Other users: your name and profile photo may appear with reviews you post. Coach profiles (name, photo, bio, sports, rates and ratings) are visible to all users.

• Service providers: companies that process information for us, listed in the next section.

• Legal reasons: when we believe in good faith that disclosure is required by law, court order or a government request, or is needed to protect the rights, property or safety of Cotenos, our users or others.

• Business transfers: if Cotenos is sold, merged or transferred, personal information may be transferred to the new owner, who must continue to protect it as described in this policy.

Service providers

We use the following service providers, which process personal information on our behalf and only to provide the Services:

• Render: application hosting and database (servers in Frankfurt, Germany)

• Vercel: website and business dashboard hosting, and storage of some older uploaded photos

• Cloudflare: network security for the connection between the Services and our servers (your requests pass through Cloudflare), storage and delivery of uploaded photos, and spam protection on our website forms when it is switched on

• Resend: sending emails, including delivering messages sent through the contact form on our website

• Expo: delivering push notifications, through Apple Push Notification service and Google Firebase Cloud Messaging

• Groq: generating text for the AI features of the business dashboard

• Apple and Google: Sign in with Apple and Google Sign-In

AI features

The Cotenos mobile app has no AI assistant, and nothing you do in the mobile app is sent to an AI provider.

AI features are part of the business dashboard only. Venue owners, and Cotenos administrators, can ask for an AI-written venue description: the venue name, sport, venue types and player capacity entered in the form are sent to our AI provider, Groq, which returns a draft text. Venue owners can also see AI business insights on their dashboard: summary figures from the dashboard (such as the month's revenue and the number of pending bookings, venues and clients), their recent AI insights messages, and limited account context (name, gender and role) are sent to Groq to generate a short summary.

We store AI insights requests and replies with the owner's account, so that later insights have context. We automatically delete these messages after 90 days, and all of them when the account is deleted. You can also ask us to delete them at any time by emailing info@cotenos.com. Please do not enter sensitive information, such as health or financial details, that you do not want processed in this way.

International transfers

Our main servers are in the European Union (Germany). Some of our service providers process information in other countries, including the United States. When personal information is transferred, we take steps to make sure it remains protected as described in this policy.

How long we keep information

• Your account information is kept for as long as your account is active.

• AI insights messages are deleted automatically after 90 days. Notifications are deleted automatically 30 days after you read them, or after 180 days if unread.

• Session records are deleted after they expire, and 30 days after you sign out. Your block list is kept until you unblock a user or delete your account. Reports you send about reviews are kept as part of our moderation records. Problem reports, with our answers, are kept until you delete your account.

• Partner applications, contact messages and business contacts are kept for as long as needed to respond and for our business records.

• We may keep limited information for longer where the law requires it, or where needed to resolve disputes, prevent fraud or enforce our Terms. Deleted information may remain in backups for a limited period until they are overwritten.

When you delete your account

• When you delete your account, we immediately erase or anonymize your personal information: your name, email address, phone number, photo and other profile details are erased, and your password, sessions, push token, saved address, block list, problem reports, AI messages and any fitness details saved with them, and notifications are deleted. Your reviews are removed and their text is erased.

• If you used Sign in with Apple, we remove the stored Apple sign-in token and ask Apple to revoke the sign-in, so Cotenos no longer appears among the apps that use your Apple ID.

• If you own venues, deleting your account closes them: the app asks you to confirm first, your venues are removed from the Cotenos listings, upcoming bookings there are cancelled, and the players and coaches concerned are notified.

• Records of past bookings are kept in anonymized form after you delete your account, because venues need them for their own records and accounting. They are no longer linked to your name or contact details. A note you wrote on a booking stays with that booking's record. Reports you sent about other people's reviews stay in our moderation records without your name.

Your choices and rights

• Access and correct: you can view and edit your profile in the app at any time.

• Delete your account: you can delete your account and personal information at any time in the app, from your profile settings (Delete Account), or by emailing us.

• Notifications and permissions: you can turn off push notifications, and photo library access, at any time in your device settings.

• Blocking and reporting: you can block a user, or report a review, from the review itself in the app, and unblock users from your settings.

• Report a problem: you can write to our team from Settings in the app ("Report a problem"), and read our answer in the same place.

• Other rights: depending on where you live, you may have the right to ask for access to, or a copy of, your personal information; to have it corrected or deleted; to object to or restrict certain uses; and to withdraw consent. To make a request, email info@cotenos.com. We will respond within 30 days and may need to verify your identity first. You may also have the right to complain to your local data protection authority.

Security

We use reasonable technical and organizational measures to protect your information, including encrypted connections (HTTPS), hashed passwords, and storing sign-in tokens in your device's secure storage. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your password confidential and contact us if you think your account has been compromised.

Children

Cotenos is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, please contact us and we will delete it. Users under 18 should use Cotenos only with the involvement of a parent or legal guardian.

Changes to this policy

We may update this policy from time to time. We will post the updated version in the app and on our website and change the "Last updated" date above. If the changes are significant, we will also let you know in the app or by email.

Contact us

If you have questions or requests about this policy or your personal information, contact:

Mohamad El Naboulsi (Cotenos) Tripoli, Lebanon Email: info@cotenos.com Phone: +961 3 421 402