TournamentPilot

Privacy statement

Last updated: October 23, 2026

1. Introduction

This privacy statement explains how TournamentPilot processes personal data, in line with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

2. Controller

The controller for the processing described here is Raphael Polig, 8135 Langnau am Albis, Switzerland, raphael@tournamentpilot.app.

3. Who is responsible for which data

We are the controller for data about organisers: accounts, admin links and the email addresses given for them, acceptance of the terms and privacy statement, news consent, analytics and server logs.

For tournament data that organisers enter or collect (participants, persons, teams, registrations, contact data and results), the organiser is the controller, and we process it on their behalf under the data processing clause of our terms. Please address questions about this data, and requests for access or deletion, to the organiser of the tournament; we forward requests that reach us.

4. What data we process

  • Organisers without an account: email address, preferred language and the tournament data they enter.
  • Organisers with an account: name, email address, password (stored only as a hash) or, when signing in with Google, an ID of the Google account, preferred language, and sign-in sessions with IP address and browser type.
  • Consent: acceptance of the terms and privacy statement and the news opt-in, each with document version, time and source.
  • Tournaments: name, description, dates, sites, venues, schedules, results, logos and sponsor information.
  • Participants and persons, as entered by the organiser: names, teams and clubs, and optionally start number, year of birth, gender and golf handicap index.
  • Registrations: contact name, verified email address, optionally a phone number, and the answers to the form fields the organiser switches on.
  • Score entry: every change to a result is logged together with the link it was entered with, so that corrections stay traceable.
  • Server logs: IP address, time, requested page and browser type.

5. Security

Data is transmitted encrypted (TLS). Admin links, scorekeeper links and the links in confirmation and recovery emails are stored only as a hash, never in plain text; we can neither look them up nor resend them. Passwords are also stored only as a hash.

6. Hosting and database

TournamentPilot and its PostgreSQL database run on servers in Switzerland operated by Infomaniak Network SA, Geneva. Logos are stored in the same database. Apart from emails (see below), your data stays in Switzerland.

The database is backed up once a day to storage of Infomaniak in Switzerland. The last 5 daily backups are kept; older ones are deleted.

7. Emails (Brevo)

We send emails through Brevo (Sendinblue SAS, Paris, France), with whom we have a data processing agreement. France is part of the EU, whose level of data protection Switzerland recognises as adequate.

Service emails: the admin link and confirmation when a tournament is created, recovery emails, account confirmation and password reset, and emails to registrants about their registration. For these, the recipient's email address, the language and the content of the email are transmitted to Brevo.

Contacts at Brevo: Brevo keeps the address of everyone it sends an email to as a contact in our Brevo account, together with a record of the emails sent and whether they were delivered. This includes organisers, registrants, team contacts and scorekeepers who receive an email from TournamentPilot. We use these contacts only to send the emails described here. Announcements about changes to the terms or this privacy statement go only to organisers who have accepted them, and news only to those who signed up for it; we take these recipients from our own database. Participants, registrants, team contacts and scorekeepers never receive them.

8. Signing in with Google

You can register and sign in with your Google account instead of a password. Google (Google Ireland Limited, Dublin, Ireland) then sends us your name, your email address, whether Google has verified it, and an ID of your Google account. We don't receive your Google password and don't store your profile picture. Google learns that you sign in to TournamentPilot; Google's privacy policy applies to that. Ireland is part of the EU, whose level of data protection Switzerland recognises as adequate. If an account with the same verified email address already exists, Google is added to it as a second way to sign in.

9. News

When you create a tournament or an account, you can sign up for news about TournamentPilot with a separate checkbox that is not ticked in advance. We then occasionally send you news about TournamentPilot. Signing up is voluntary and not needed to use the service. You can withdraw your consent at any time with effect for the future: via the unsubscribe link in every news email, in your account settings, or by email to raphael@tournamentpilot.app. Unsubscribing only stops the news; service emails about your tournaments are still sent.

10. Analytics (Umami)

We use Umami, a privacy-friendly analytics tool that we host ourselves in Switzerland. Umami works without cookies and stores no personal data.

11. Cookies and storage in your browser

TournamentPilot uses no marketing or tracking cookies and passes no personal data to advertising networks or data brokers. We only use storage that is technically necessary:

  • a session cookie while you are signed in to an account, and during a sign-in with Google a short-lived cookie that ties the return from Google to your browser;
  • a cookie that remembers your language;
  • on devices used for score entry, entries are kept in the browser (IndexedDB) until they have reached the server, so that score entry also works offline;
  • on tournament pages, the browser can remember the team you follow; this stays on your device;
  • the browser remembers that you have seen the cookie notice, and display settings such as the colour theme; this stays on your device.

12. Public tournament pages

Published tournaments can be opened via public links and QR codes and can therefore be viewed worldwide, including schedules, results, standings, participant names, logos and sponsor information. The organiser decides whether a tournament is public, unlisted or private, and whether names are shown in full, as first name and initial, or as team name only.

Years of birth, handicap indexes, email addresses, contact data and registrations are never shown publicly; at most, categories derived from them are. Participants who registered themselves appear publicly only once the organiser has confirmed them.

13. Logos

Uploaded logos are scaled down on our server and converted to WebP. Metadata such as EXIF data is removed in the process. Logos are public together with the tournament page.

14. Legal basis

We process personal data to perform our contract with organisers (Art. 6(1)(b) GDPR, Art. 31(2)(a) FADP), on the basis of our legitimate interest in providing the service securely and in being able to prove consent (Art. 6(1)(f) GDPR, Art. 31(1) FADP) and, for news, on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. For tournament data, the organiser determines the legal basis.

15. How long we keep data

  • Tournament data, registrations (contact data and answers) included, is kept until the organiser deletes it or the tournament.
  • A tournament that its organiser hasn't used for 90 days is deleted with all its data 7 days after a reminder to its admin email, which is repeated 48 and 24 hours before the deletion, unless the organiser keeps it.
  • Accounts are kept until you delete them.
  • Consent records are kept as long as we need them to prove consent; the news subscription lasts until you unsubscribe.
  • Server logs are kept for a limited time for security reasons.
  • Deleted data stays in the backups until they expire, at most 5 days.

16. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object. You can also lodge a complaint with a supervisory authority; in Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), and in the EU the authority of your country. For tournament data, please contact the organiser of the tournament first.

17. Changes

We may update this privacy statement. We announce changes by email to everyone who has accepted it. The current version is always available on this page.

18. Contact

If you have any questions about data protection, please write to raphael@tournamentpilot.app.