What I do with your details

Who this is

This site is run by Michael Kuhlman, trading as Kuhlman Pickleball, in Santa Rosa, CA. It is a one-man coaching business. That is worth saying at the top, because it means there is no team, no data department and nobody else handling your details behind the scenes. If you want something changed or removed, you are asking me, and I am the person who does it.

The quickest way to reach me is 707-540-1336 or [email protected].

What I collect

When you book a lesson

Your first and last name, email address and phone number, plus the lesson you picked, the court, the date and time, how many are playing, whether you can be flexible on the time, and anything you typed into the box asking what I should know. Booking makes you an account with those details in it. No password is asked for and no payment is taken.

When you register or edit your profile

The same details, and optionally your rough skill level, what you want to work on, and an emergency contact name and number if you choose to add one. After a lesson I write session notes against your account: what we worked on, what is improving, drills to take away.

When you send a message

Your name, email address, phone number if you give one, the subject and the message itself.

When you send video for a review

The footage, and what you asked me to look at: the sort of play it is, your rough level, which hand you play with, and a short description of how to pick you out on court. The timestamped notes I write while watching are attached to that review, and so is any message either of us sends about it.

When a clip finishes uploading, my server reads its length and dimensions and takes a single still frame out of it to use as the thumbnail you see in your account. That happens here, on this machine. Your video is not sent to an analysis service, a transcription service or any other third party, and the still lives in the same private folder as the clip it came from.

Just from reading the site

Every page view is counted on the server. What gets stored is the page you asked for, whether you are on a phone or a desktop, any campaign tag on the link you followed - so I can tell whether the flyer on a court noticeboard is doing anything - and, if you arrived from another website, the full address of the page that linked you, not just the name of the site.

Your IP address is used to build a one-way hash, so that two visits in the same day count as one person rather than two. The address itself is never written down. That hash is rebuilt from scratch at midnight, so nothing derived from your address links one day to the next.

Stored next to it is a second hash, of your browser session rather than your address. That one lasts as long as the session does, so to be exact about it: if you leave a tab open past midnight, those visits are still recognisable as one sitting. Close the browser and the thread is cut.

Signing in, registering and booking

These write a line to an internal audit log: what happened, when, and the IP address it came from. That log does keep the address. It is there so that if an account is ever tampered with, there is a record of it. It is not used for anything else.

If the spam check turns a submission away, the page and the IP address it came from are written to a log file, so I can tell a broken form from somebody hammering it.

Cookies

This site sets one cookie of its own, and it is the ordinary PHP session cookie, PHPSESSID. It is set on every visit whether you are signed in or not, because it does three jobs: it keeps you signed in, it carries the token that stops one of my forms being submitted from somebody else's website, and it remembers where you had got to in the booking flow.

It is marked HttpOnly, so no script can read it; SameSite=Lax, so it does not travel to other sites; and Secure, so it only ever crosses an encrypted connection. It expires when you close your browser. There is no "remember me" cookie and nothing here sets a cookie to follow you around the web.

Other cookies will appear in your browser on this site, but they are set by the services in the next section rather than by me.

Who else sees it

Five services, run by three companies. What each one gets:

Cloudflare

Every request to this site goes through Cloudflare before it reaches my server. It is what keeps the site quick and fends off the bulk of the junk traffic, and it means Cloudflare sees every page you ask for and sets its own cookies to tell a browser from a bot.

Cloudflare Turnstile

The "confirm you are human" check on the contact, booking and registration forms. It sees your IP address and how your browser behaves. It is not reCAPTCHA: it sets no tracking cookie and feeds no advertising profile. It went on because three sales pitches dressed up as student enquiries arrived in two days.

Google Fonts

Two typefaces load from Google on every page, so Google sees your IP address and which page you are on. No cookie is set.

Google Analytics

Counts visits and tells me which pages and which adverts actually bring people in. The advertising half is turned off where the tag is set up: ad storage denied, ad personalisation off, Google Signals not asked for. One Google advertising beacon still tries to fire in spite of that, and this site's content security policy refuses it every time, so nothing reaches it. Your IP is anonymised. It does set its own cookie. If your browser sends a Global Privacy Control signal, the tag is not loaded at all.

Telegram

When you book, send a message or submit a video, the details arrive on my phone as a Telegram message so I see it in minutes rather than whenever I next open a laptop. That message carries your name, your number, your email and what you wrote.

There is no advertising or tracking pixel on this site. No Meta pixel, no TikTok, no LinkedIn, no remarketing tag of any kind. Nothing you type here is sold, rented, swapped or handed to a data broker, and there is no arrangement under which it could be.

How long I keep it

• Page-view records: 400 days, then deleted automatically overnight. Just over a year, so one season can be compared with the last.
• Your account, bookings and lesson notes: kept. A student who comes back after two years should not start from nothing, and the notes are the thing that makes the second block of lessons better than the first.
• Messages sent through the contact form: kept.
• Video and its review: kept until you or I delete it. While it is still a draft you can remove clips yourself, and deleting the draft takes the footage with it. After you send it, ask me and it goes. Nothing clears it out automatically.
• The audit log and the server's log files: kept.

Being straight about it: apart from the page-view pruning, there is no automatic deletion schedule here. The mechanism for getting your data removed is that you ask me and I remove it, which is the honest description of how a business this size works.

What I never do

• I never sell or rent your details. Not to a data broker, not to another coach, not to a club.
• The site never takes card details. No page here can charge a card and none asks for one. You pay me at the court, by card, Venmo or cash - a card tapped on a reader in my hand, never a number stored on this website.
• The site never emails or texts you. No newsletter, no automatic booking confirmation, no reminder. If you hear from me, it is because I typed it myself. The "email me occasionally" tick box on the registration form is stored on your account and currently decides nothing, because nothing is sent.
• I never publish your video. Footage is stored outside the public part of the server and handed over only after checking that the person asking is you or me. The example clip on the video page is my own, never a student's.
• I never put your name on a testimonial unless you have told me I can.

Your choices

California's privacy law gives residents rights over their personal information. I will honour all of them for anybody who asks, resident or not:

• A copy of what I hold about you.
• Correction of anything wrong. Most of it you can already edit yourself under My account.
• Deletion of your account, your bookings, your notes and your footage.
• Not to be treated any differently for asking. It changes nothing about what you pay or how you are taught.

Correcting your own details aside, none of this has a button. Call 707-540-1336 or email [email protected] and say what you want done. I will do it and tell you when it is finished. There is no charge and I will not ask you to justify it.

Two other things worth knowing. There is no password reset on this site, so if you are locked out of your account, call me and I will sort it. And if you would rather Google Analytics did not see you at all, a browser that sends Global Privacy Control keeps the tag from loading, and Google publishes an opt-out add-on that works across every site that uses it.

Children

I teach juniors from about age 8, so children are a real part of this business rather than an edge case. The site never asks anybody's age and cannot tell a child from an adult, so the rule is a simple one: if the student is under 18, a parent or guardian makes the booking, using their own name, email and phone number. They are the person this policy is about.

That rule means no child should be holding an account here at all. If you think one is, tell me and I will remove it.

If a video review contains footage of a junior, the same rules apply as for anyone else: only the account holder and I can open it. A parent or guardian can ask me to delete it at any time and I will do it that day.

Keeping it safe

The site is served only over HTTPS. Passwords are stored as one-way hashes and never in a form anybody could read back, mine included. The database account the website runs as can read and write rows but cannot alter the shape of the database. Video sits outside the public web root and is only ever handed out after a permission check. Forms carry a token that stops them being submitted from somewhere else.

No system is perfect and I am not going to pretend this one is. What I can tell you is that there is very little here worth stealing: no card numbers, no bank details, no passport or licence numbers, nothing but the details you would give a coach anyway.

Changes to this page

If what the site does changes, this page changes with it in the same breath, and the date at the top moves. There is no mailing list to announce it on, because the site sends no email. If a change is a significant one you will find it said plainly here rather than buried.