Privacy policy

Who is responsible?

Tournix is the data controller for personal data processed through the organizer dashboard, subscription flow, our website and our mobile app.

For questions about this policy or your privacy rights, contact us at info@tournix.app.

Who does this policy apply to?

This policy applies to:

• Organizers who create an account and manage tournaments in the dashboard
• Visitors of our marketing website
• Visitors of public live tournament pages that organizers choose to publish
• Users of the Tournix mobile app who search for tournaments, save favourites or follow teams (no account required)

What data do we process?

Depending on how you use the service, we may process the following categories of personal data:

• Account data: email address, password (stored in hashed form by our authentication provider), and the name you provide in your profile
• Subscription data: subscription status, trial period, billing period and Stripe customer/subscription identifiers when you subscribe (payment card details are processed directly by Stripe, not by us)
• Coupon redemptions: when you redeem an organizer coupon code, we store that you used the code and when
• Tournament data you enter as an organizer: tournament names, dates, locations, team and player names, referee names, match schedules, scores, uploaded logos and background images, and public visibility settings
• Live chat: messages you send via the Tawk.to chat widget on our website or dashboard (name, email if you provide it, and message content)
• Technical data: IP address, browser or app type, device information and server logs collected by our hosting provider for security and operation
• Cookies: authentication session cookies, a language preference cookie, an optional analytics opt-out preference cookie, and similar cookies required to run the service
• Mobile app data: see the section “Mobile app” below for push notifications, on-device storage and registration via the app

Public live pages

Organizers can optionally publish a tournament at a public URL (for example https://www.tournix.app/live/…). Data shown there is limited to what the organizer has entered and enabled for publication (such as team names, schedules, standings and results).

Visitors to live pages do not need an account. Some preferences (such as a starred team or referee login on a device) may be stored locally in the visitor’s browser via localStorage; that data is not sent to us unless the visitor performs an action that requires it.

The Tournix mobile app displays these live pages inside the app. The same data and local preferences apply; the app may also store favourites and language settings on your device separately from the browser.

If you are a participant and believe your name or other data should not appear on a live page, contact the tournament organizer first. You may also contact us if you need assistance.

Mobile app

The Tournix app lets supporters discover tournaments, save favourites and open published live pages. You do not need a Tournix account to use the app.

Data stored on your device (not on our servers unless stated below) may include: saved tournaments, starred teams, your language preference and a cached push notification token.

When you star a team and allow notifications, we process your device’s push token together with the tournament and team identifiers needed to send alerts to that device. We use Firebase Cloud Messaging (and on iOS, Apple’s push infrastructure) to deliver notifications. We do not link push subscriptions to a user account.

You may receive: match reminders before a starred team’s scheduled match (when the organizer has enabled this for the tournament) and result notifications when a final score is entered for a match involving that team.

You can turn off notifications in your device settings at any time. Removing a team star or uninstalling the app stops new push subscriptions for that team on that device.

If you register a team through the in-app registration form, the data you submit is processed as described in this policy and shared with the tournament organizer, in the same way as on the public live website.

Login security (Cloudflare Turnstile)

When you sign in, register or request a password reset on our website, we use Cloudflare Turnstile to help prevent automated abuse. This may process technical signals such as your IP address, browser type and interaction patterns to distinguish legitimate users from bots.

Cloudflare processes these signals as described in the Cloudflare Turnstile Privacy Addendum: https://www.cloudflare.com/en-gb/turnstile-privacy-policy/

Website analytics

We use Google Analytics 4 to understand in aggregate how visitors use our website, organizer dashboard and public live pages (including when those pages are shown inside the Tournix mobile app). Measurements are sent via our servers using Google’s Measurement Protocol. We do not load Google tracking scripts in your browser and we do not set analytics cookies such as _ga.

We have accepted Google’s data processing terms for Analytics. In our Google Analytics settings we have disabled Google Signals, advertising personalization and sharing of data with other Google services beyond providing the analytics service.

When a page view is recorded, we send the page path, your language preference, whether the page was viewed in a web browser or inside the mobile app, and an anonymous daily identifier derived on our server from technical connection data (hashed; not stored in your browser). We do not send your IP address, email address, account id, or team or tournament names to Google Analytics.

Legal basis: legitimate interest in improving and securing our service. You may object at any time by using the “Opt out of analytics” link in the site footer (which stores your preference in a cookie) or by emailing us at info@tournix.app.

Google may process data in the United States. Where required, appropriate safeguards such as Standard Contractual Clauses apply. More information: https://policies.google.com/privacy and https://support.google.com/analytics/answer/3379636

Why do we use your data?

We process personal data for the following purposes and legal bases under the GDPR:

• Providing and operating the service, including account management, tournament tools, public live pages and the mobile app (performance of a contract / steps prior to entering a contract)
• Processing subscriptions, trials and coupon access (performance of a contract)
• Sending push notifications you have requested by starring a team and granting permission on your device (consent; you can withdraw consent via device settings)
• Securing the platform, preventing abuse and troubleshooting (legitimate interest)
• Understanding aggregate website usage via server-side analytics (legitimate interest; you may object)
• Complying with legal obligations, such as tax or accounting rules where applicable (legal obligation)
• Responding to your questions via live chat or email (legitimate interest / contract)

Processors and sharing

We use trusted service providers who process data on our behalf:

• Supabase, authentication, database, file storage and realtime updates
• Stripe, subscription checkout, billing and customer portal
• Vercel, hosting and delivery of the website
• Google Firebase Cloud Messaging, delivering push notifications to the mobile app
• Apple Push Notification service, delivering push notifications on iOS where applicable
• Voetbal.nl / KNVB logo API, when an organizer enters a club code to fetch a logo, that code is sent to the external logo service
• Tawk.to, live chat widget on our website and organizer dashboard
• Cloudflare Turnstile, bot protection on login and registration
• Google Analytics 4, aggregate website usage via server-side Measurement Protocol

International transfers

Some of our processors may process data outside the European Economic Area (for example in the United States). Where required, appropriate safeguards such as Standard Contractual Clauses are used.

Retention

We keep personal data only as long as necessary for the purposes above:

• Account and tournament data: while your account is active and for a reasonable period afterwards so you can export or recover information, unless you request earlier deletion
• Subscription and billing records: as required by applicable law and for dispute handling
• Server logs: for a limited period for security and diagnostics
• Push notification subscriptions: managed via Firebase topic subscriptions; they end when you unsubscribe, remove the team star or when the token is no longer valid
• On-device app data (favourites, starred teams, language): until you clear app data or uninstall the app

Security

We apply appropriate technical and organizational measures, including access controls, encrypted connections (HTTPS) and row-level security in our database. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

Your rights

Under the GDPR you may have the right to access, rectify, erase, restrict or object to processing of your personal data, and to data portability where applicable. You may also withdraw consent where processing is based on consent, and lodge a complaint with your local supervisory authority.

To exercise your rights, email info@tournix.app. We may need to verify your identity before responding.

Children

The organizer dashboard is intended for adults organizing tournaments. Public live pages and the mobile app may display participant names entered by organizers. The app does not require an account and may be used by parents or guardians to follow a child’s team. We do not knowingly offer dashboard accounts to children under 16.

Changes

We may update this privacy policy from time to time. The date at the top of this page indicates when it was last revised. Material changes will be communicated where appropriate.