Privacy
Last updated 8 September 2026
This page is not finished: the operator's name, address and contact address have not been filled in yet. Set LEGAL_NAME, LEGAL_ADDRESS and LEGAL_EMAIL.
Who is responsible
[LEGAL_NAME not set] [LEGAL_ADDRESS not set] [LEGAL_EMAIL not set] That is the controller within the meaning of article 4 of the GDPR and article 5 of the Swiss Data Protection Act (DSG). Write to the address above about anything on this page.
The short version
An email address and a password to sign in with. The names of the players in your tournaments — names only, nothing else. What was played and how it ended. No tracking, no advertising, no analytics, no third-party scripts of any kind. Everything is stored in Switzerland. You can download all of it or delete all of it from your account page, without asking anybody.
Your account
To sign in, we store your email address, an encrypted form of your password, when the account was created, and when it was last used. The password itself is never stored and cannot be read by anybody, including us. The legal basis is article 6(1)(b) of the GDPR — performing the contract you entered into by creating an account — and article 31(2)(a) of the DSG.
Clubs and players
A club has a name, a short address for its links, and a time zone. A player has a display name and nothing else. There is no field for an email address, a telephone number, an age or a photograph, because a tournament does not need them. If you type somebody's full name into the list of players, that name is what is stored and what appears on the screens. When you enter other people into your tournament, you are the one deciding to do so. The club is responsible for the names it enters, and we process them on the club's behalf.
Tournaments
What a tournament is made of: its name and address, the format, the field of players, every match and its result, which board it was played on, and when it started and finished. The times are kept because a tournament that cannot say when a match was played cannot be corrected afterwards, and because they are what the schedule and the statistics are built from.
What becomes public
A tournament is private until you publish it. Publishing it puts a page at /t/ followed by the address you chose, and that page can be read by anybody with the link, without an account. That page shows the players' names, the results, the standings and the final ranking. Board names appear only if you switched them on. Nothing else about anybody is on it — no email addresses, and nothing about who runs the club. Unpublishing takes the page down again.
Cookies
Two, and both are necessary. A session cookie, so that you stay signed in. It is set when you sign in and removed when you sign out. A language cookie, set only if you choose a language yourself rather than letting the browser decide. It holds two letters. Neither is used to recognise you anywhere else, and there is nothing else to consent to — which is why this site has no cookie banner.
What we do not do
There is no analytics, no advertising, no tracking pixel, no session recording, no A/B testing tool and no social media button. No script from any other company runs on these pages; the browser is instructed to refuse them, and the instruction is part of every page. We do not profile anybody, and nothing here makes an automated decision about a person.
The record of changes
Changes that matter — a result corrected, a player removed, a role changed, a club deleted — are written to a record with the time, the action and who did it. It exists so that a club can find out what happened to its own tournament, and it is the reason a corrected result is not a silent one. The legal basis is article 6(1)(f) of the GDPR: the legitimate interest of a club in the integrity of its own competition. When an account is deleted, its entries stay but stop naming anybody. We also count how often each account performs a write, over the last hour, to stop the service being overwhelmed. Those counts are deleted continuously as they age out.
Where it is stored
In Switzerland. The database, the accounts and the files are hosted in the Zurich region, and no copy of them is kept anywhere else in the ordinary course of running the service. Server logs record what an application did — an event name and identifiers — and are written so that they cannot contain passwords, tokens, session identifiers, email addresses or player names. That is enforced by the logging code itself rather than left to whoever writes a log line.
Who else touches it
Supabase, for the database, the accounts and the connection that keeps a screen live. They process the data on our instructions under a data processing agreement, in the Zurich region. The application itself runs on hosting infrastructure that receives the requests. Nothing else is involved: no email marketing tool, no support chat, no customer data platform. When billing exists, a payment provider will be added here and named before it is used.
How long
Your account, your clubs and their tournaments are kept as long as the account exists. There is no automatic deletion, because a club's history is the point of keeping it. Delete your account and it is gone at once, along with your membership of every club. What survives is the record of changes described above, without your name in it, and any club you handed over to somebody else — that club is now theirs. Delete a club and its tournaments, players, boards and templates go with it.
Your rights, and how to use them
You may ask what is held about you (article 15 GDPR, article 25 DSG), have it corrected (article 16), have it deleted (article 17, article 32 DSG), receive it in a machine-readable form (article 20), restrict or object to its processing (articles 18 and 21). Two of those do not need a request at all. Your account page has a button that downloads everything held about you as a JSON file, and a button that deletes your account. Neither of them asks us for permission or waits for anybody. For anything else, write to [LEGAL_EMAIL not set]. We answer within thirty days.
If you are not satisfied
You may complain to a supervisory authority. In Switzerland that is the Federal Data Protection and Information Commissioner (EDÖB), Feldeggweg 1, 3003 Bern. In the European Union it is the authority of the country you live or work in.
Children
An account is for the person running a tournament, and is not intended for children under sixteen. Players are a different matter: a junior competition is a normal thing for a club to run, and a player is a name on a list rather than a person with an account. The club decides which names to enter and is responsible for having the right to enter them.
Changes to this page
If what we store or why changes, this page changes with it and the date at the top changes too. A change that affects you materially will be told to you rather than left here to be found.