Legal
Privacy Policy
What we collect, why, how long we keep it, and what you can do about it.
Who is responsible for your data
The data controller is [to be confirmed: registered legal entity], at [to be confirmed: registered address]. Data-protection questions and complaints go to [to be confirmed: named grievance officer] at privacy@badmintontournament.club.
What we collect and why
We collect what is needed to run a tournament and nothing beyond it. There is no advertising, no profiling, and no selling of personal data.
| Data | Why | How long |
|---|---|---|
| Email address | Signing in, account recovery, and tournament notifications. | Until you delete your account. |
| Name | Shown on entry lists, draws, and results. | Until you delete your account. |
| Date of birth | Confirming you are 18 or over, and age-category eligibility. | Until you delete your account. |
| Password (hashed with Argon2id) | Signing in. The original password is never stored or recoverable. | Until changed or the account is deleted. |
| Google account link (optional) | Signing in with Google, if you choose to. | Until you unlink it or delete your account. |
| Profile details you choose to add — phone, gender, club, skill level, bio, city, avatar, Instagram and YouTube handles | Shown on your player profile, subject to the visibility you set. | Until you remove them or delete your account. |
| Tournament and match records — entries, draws, scores, results | Running the tournament and publishing its results. | Results stay part of the tournament record. Player references are anonymised after two years. |
| IP address and browser user-agent | Rate limiting and abuse prevention. Not used to profile you. | 30 days. |
| Push notification token (only if you enable notifications) | Sending match reminders to your device. | Until you disable notifications or delete your account. |
What is public
Tournaments are competitions held in public, so some information is visible to anyone: the tournament, its events, entry lists, draws, scores, and results, including the names of the people playing.
Your player profile is separate, and you control it. It can be public, visible only to signed-in users, or private. You can also hide your statistics. A private profile is not shown to anyone else, and is left out of the public results feed. A tournament that has not been published is not visible at all.
Your email address, phone number and date of birth are never shown publicly.
Cookies and tracking
There is no advertising or analytics tracking on this site, and no third-party tracking cookies. We store two things in your browser: a sign-in session cookie, which is what keeps you logged in, and your light or dark theme preference. Both are strictly necessary or set by you, which is why you are not asked to consent to a cookie banner.
If we ever add analytics, this section will change and we will ask for consent first.
Who else processes your data
We use a small number of service providers. They process data on our instructions only.
- Railway
- Hosting, database, and backups. Data is stored in Singapore.
- Cloudflare Turnstile
- Checking that sign-in and registration are not automated. It does not track you across sites.
- Resend
- Sending account and tournament email.
- Sentry
- Recording application errors so they can be fixed. Cookies, authorisation headers and passwords are stripped before an error is sent.
- Expo
- Delivering push notifications, only if you enable them.
Tournament organisers see the entry details of people who register for their tournaments — that is the point of registering. They act as controllers of that information for their own event.
Your rights
You can do the following from your account, without asking us:
- Get a copy of your data. Export everything we hold about you as a machine-readable file.
- Correct it. Edit your profile details at any time.
- Delete your account. This removes your personal details and signs you out everywhere.
- Control who sees your profile and whether your statistics are shown.
Results of tournaments you have already played stay in the tournament record after deletion, because other competitors' results depend on them. Your personal details are removed and the results are anonymised.
If you are in the EU or UK, you also have the right to object to processing, to restrict it, and to complain to your local supervisory authority. In India, you may raise a grievance with us first and then with the Data Protection Board.
Security
Passwords are hashed with Argon2id and are never stored in a readable form. Traffic is encrypted in transit, and the database connection requires TLS. Repeated failed sign-ins temporarily lock an account. Backups are taken daily and their restorability is checked weekly.
No system is perfectly secure. If we discover a breach affecting your data, we will notify you and the relevant authority as required by law.
Children
The service is for people aged 18 and over. We ask for your date of birth at registration and do not accept accounts below that age. Junior categories will require a verifiable parental-consent mechanism before they are offered.
Changes
If this policy changes materially we will tell registered users by email before the change takes effect.
Contact
privacy@badmintontournament.club for anything on this page.