Privacy Policy

1. Overview

Tournament Goose ("we", "us", "our") operates the Tournament Goose platform. This Privacy Policy explains what personal data we collect, how we use it, and your rights regarding that data. By using the Service, you agree to the practices described here.

2. Information we collect

We collect the following categories of information:

• Account data — name, email address, and password (stored as a secure hash) when you register.
• Usage data — pages visited, features used, and interactions within the app, collected via PostHog analytics.
• Content you create — leagues, teams, tournaments, scores, and any other data you enter into the Service.
• Device and log data — IP address, browser type, operating system, and error reports collected automatically when you use the Service.
• Push notification tokens — if you opt in to browser push notifications, we store a device token via Firebase Cloud Messaging.

3. How we use your information

We use the information we collect to:

• Provide, operate, and improve the Service
• Authenticate your account and maintain security
• Send transactional emails (e.g. password resets, notifications you've opted into)
• Monitor errors and diagnose technical issues via Sentry
• Understand how the Service is used to inform product decisions

We do not use your data for advertising. We do not sell your data to any third party.

4. Third-party services

We use the following third-party services to operate the platform. Each has its own privacy policy governing its use of data:

• MongoDB Atlas — database hosting (data storage)
• PostHog — product analytics
• Sentry — error monitoring
• Firebase Cloud Messaging — push notifications

We do not share your personal data with these providers beyond what is necessary to deliver the Service.

5. Cookies and tracking

We use session cookies for authentication. We also use PostHog, which may set cookies or use local storage to track usage across sessions. You can disable cookies in your browser settings, though this may affect your ability to use certain features. We do not use third-party advertising cookies.

6. Data retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it by law or for legitimate business purposes (e.g. fraud prevention). Anonymized or aggregated data may be retained indefinitely.

7. Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict certain processing
• Export your data in a portable format
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

8. California residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect and how it is used, the right to delete your personal information, and the right to opt out of the sale of your personal information. We do not sell personal information. To submit a request, contact us at [email protected].

9. EU/EEA residents (GDPR)

If you are located in the EU or EEA, our legal basis for processing your personal data is the performance of our contract with you (providing the Service) and our legitimate interests in operating and improving it. Where we rely on consent (e.g. push notifications), you may withdraw it at any time. You have the right to lodge a complaint with your local supervisory authority.

10. Data security

We implement reasonable technical and organizational measures to protect your data, including encryption in transit (TLS) and at rest. No system is completely secure, and we cannot guarantee absolute security. In the event of a data breach that affects your personal data, we will notify you as required by applicable law.

11. Children's privacy

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, contact us and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice in the app. The updated policy will include a revised effective date. Continued use of the Service after changes take effect constitutes acceptance.

13. Contact

Questions or concerns about this Privacy Policy may be directed to [email protected].