Privacy Policy

Privacy Policy

Last updated: July 2026

1. What We Collect

PongDesk collects only the information necessary to operate tournament management features:

  • Account data: email address and password, or profile information (email address, display name, and profile picture URL) if you sign in using Google Auth. All authentication is managed via Supabase.
  • Player data: name, birth year (for age-category eligibility), gender (for eligibility restrictions), and rating - provided by players during registration or entered by club managers on their behalf.
  • Tournament data: club names, event names, match results, and registration records.
  • Contact form: name, email address, and message content, if you use our Contact page to reach us.
  • Usage data: standard server logs (IP address, browser type, pages visited) retained briefly for security and debugging.

We do not collect full dates of birth, payment card numbers, government IDs, or any other sensitive personal data.

2. How We Use It

Data is used solely to operate PongDesk: authenticating users, storing tournament records, generating standings and brackets, and displaying results. We do not use your data for advertising, profiling, or any purpose unrelated to running the service.

Google User Data: Our use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell or share Google user data with third parties, nor do we use it for advertising.

3. Cookies & Local Storage

PongDesk uses only essential cookies and browser storage. We do not use advertising or cross-site tracking cookies.

  • Supabase session cookies (sb-*) - set when you sign in; keep your session active. Clearing them signs you out. These are strictly necessary; the app does not function without them.
  • Cloudflare security cookies (__cf_bm, Turnstile challenge tokens) - set by Cloudflare to distinguish human visitors from bots and protect sign-in and registration forms from automated abuse. These are security-functional and cannot be disabled without breaking bot protection.
  • Theme preference (localStorage.theme) - stores your light/dark mode preference locally in the browser. This is not a cookie and is never transmitted to any server.

No advertising networks, social media pixels, or cross-site tracking scripts are loaded. We use Vercel Web Analytics for aggregate, cookieless page-view statistics - no personal data or device fingerprints are collected or shared with third parties.

4. Third-Party Processors

We rely on the following sub-processors, each governed by their own privacy policy:

  • Supabase - database hosting and authentication. Data is stored in Supabase-managed PostgreSQL instances.
  • Vercel - application hosting, edge delivery, and aggregate Web Analytics (cookieless, no personal identifiers).
  • Cloudflare - DNS, domain proxy, and Turnstile bot-protection on auth, registration, and contact forms. Cloudflare processes request metadata (IP address, browser fingerprint) to distinguish human visitors from automated traffic.
  • Sentry - error monitoring. When an unhandled error occurs in the application, an error report (stack trace, page URL, browser type) is sent to Sentry. No personally identifiable information is intentionally included in these reports.
  • Resend - transactional email delivery (registration confirmations, payment reminders, notification emails, contact form submissions). Your email address and the content of each notification are transmitted to Resend for delivery. Resend may embed a standard open-tracking pixel in emails; you can disable tracking by turning off remote image loading in your email client.

When an event has an entry fee, the organizer may provide a payment link (e.g. PayPal, Venmo, Zelle). Following that link takes you to a third-party service governed by its own privacy policy. PongDesk does not process payments or store payment card details.

We are not responsible for the privacy practices of these third parties. Review their policies before use.

5. Data Sharing

We do not sell, rent, or share your personal data with any third party except the sub-processors listed above, or when required by law.

Tournament results (names, ratings, match scores) are visible to anyone viewing that tournament's public page - not limited to members of the same club - unless the tournament is hidden by its manager.

Every player who has competed in a tournament also has a public career profile, aggregating their match history across every club and tournament they've played in: overall record, a head-to-head breakdown against named opponents, and any achievement badges earned. Career profiles require no login to view. They are excluded from search-engine indexing but remain accessible via direct link. Contact us if you'd like a profile removed or a specific tournament hidden.

6. Data Retention

We retain account and tournament data for as long as resources allow. To keep the service free, we may purge old tournament data when storage limits are approached - we will make reasonable efforts to notify affected clubs in advance. Club administrators may also request deletion of their data at any time by contacting us.

We strongly recommend exporting your tournament data after each event. Once a tournament is finalized, PongDesk lets you download it as a structured JSON backup or a ZIP of CSV spreadsheets. Exported archives are your safeguard against data loss.

7. Security

We implement reasonable technical measures (row-level security, encrypted transport, access controls) to protect stored data. However, no system is perfectly secure. We cannot guarantee that data will never be accessed, disclosed, altered, or destroyed by a breach. Use the service at your own risk.

8. Children's Privacy

Tournaments often include junior players, so participant records may describe minors. For players we store only a birth year (never a full date of birth) to determine age-category eligibility. When a manager enters a player's data, the manager is responsible for having any consent required from the player or their parent or guardian. Accounts are intended for adults; if you believe a child has created an account or that we hold a child's data inappropriately, contact us and we will remove it.

9. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, or delete personal data we hold about you. Club managers can update or remove player records directly within the app. For account deletion or other data requests, contact your club administrator or reach out through our Contact page.

10. No Guarantees

This policy describes our current practices. We reserve the right to update it at any time. Continued use of PongDesk after changes are posted constitutes acceptance of the revised policy. See our Terms of Service for the full liability disclaimer.