Privacy policy
Bracketa (braketa.top) is a free service for organizing tennis, padel and football tournaments. This policy explains what personal data we process, why, and what rights you have under the EU General Data Protection Regulation (GDPR).
Who is responsible
The service is run by Dmitrij Panasiuk, a private individual in Lithuania. Contact for any privacy question or request: tennis.tournamets@gmail.com.
There are two roles:
- Organizers create tournaments and decide who takes part. For the registration data of their participants, the organizer is the controller and Bracketa processes it on their behalf to run the tournament.
- Bracketa is the controller for organizer accounts, the website itself, service emails, security and analytics.
What data we process
Organizers
- Google account data used to sign in: email address, name and profile photo.
- Tournaments you create: name, venue and its address, dates and schedule, rules, registration settings, results. Optionally a contact phone and email, which are published only if you turn on "show contact".
- Co-organizers: when you add someone by email, we store only a link to their existing account.
- Sponsorship: requests to enable sponsors (your message and the decision), sponsor names, links, captions and images you upload.
- AI features (when the platform has switched them on): text or a file you send to an AI feature yourself (a tournament description, a participant list, a phrase with a score) goes to the DeepSeek service to be turned into settings, a list or a score. We keep only the fact of the request: which feature, when and how many tokens, without the text itself. A voice recording (the “Dictate” button) goes to the Groq service to become text; we do not keep it, the log holds only its length in seconds. Pictures and files are read in the browser, only their text is sent.
Participants
- Registration form: player names (one or two for a pair), optional team name, phone number and email address.
- Language of the page you registered from, so emails reach you in that language.
- Registration status: pending, approved, waitlisted or rejected.
- Tournament data: draw position, matches, scores and standings.
Participants do not need an account.
Everyone
- Password-protected tournaments: to limit password guessing we store a one-way hash (SHA-256) of your IP address and of a random browser identifier, and a 12-hour access token after a correct password.
- Server logs: our hosting providers record technical data (IP address, browser, time of request) to deliver the site and protect it.
- Analytics: we count page views and product events (for example "tournament created") with Umami, without cookies and without names, emails or phone numbers.
What is public
- Names of approved participants, the draw, schedule, results and standings are visible to anyone who opens the tournament page. Tournaments set to "Public" are also listed in search engines; "By link" tournaments are not indexed; "Private" and password tournaments are hidden.
- Participant phone numbers and emails are never public. Only the organizers of that tournament can see them.
- The venue address, the organizer contact (if published) and sponsor materials are shown on the tournament page.
Why we process it (legal basis)
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Accounts, tournaments, registration, draws and results | Performance of the service you asked for, art. 6(1)(b) |
| Emails to participants: registration received, approved, rejected, waitlisted, match starting soon | Performance of the service, art. 6(1)(b), and the organizer's legitimate interest in running the tournament, art. 6(1)(f) |
| A short line "create your own tournament" in those emails | Our legitimate interest in growing the service, art. 6(1)(f); you can object at any time |
| Security: password lockout, abuse prevention, logs | Legitimate interest, art. 6(1)(f) |
| Cookie-free statistics | Legitimate interest in improving the service, art. 6(1)(f) |
| AI features: reading text the organizer sent themselves | Performance of the service requested by the organizer, art. 6(1)(b), and the organizer's legitimate interest in entering tournament data quickly, art. 6(1)(f) |
We do not sell personal data, do not use it for advertising profiles and do not make automated decisions with legal effects.
Service providers
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage | EU (Ireland) |
| Vercel | Website hosting and server functions | Global network, company in the USA |
| Resend | Sending emails | EU region (Ireland), company in the USA |
| Umami | Cookie-free statistics | EU |
| Sign-in with Google; fonts loaded from Google servers (your browser sends its IP address to Google) | USA / global | |
| IndexNow (Bing and others) | Notifying search engines about new public pages; only page addresses are sent | USA / global |
| DeepSeek | Reading text for AI features, only when the organizer starts one | China |
| Groq | Turning speech into text for the “Dictate” button, only while the organizer records; we do not keep the recording | USA |
Where a provider is outside the European Economic Area, the transfer relies on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
China has no adequacy decision from the European Commission. That is why text goes to DeepSeek only when an organizer starts an AI feature themselves, and we send as little as possible: for example, result posts use placeholder labels instead of names.
How long we keep data
- Organizer account: while you use the service. Write to us to delete it.
- Tournaments and participant data: until the organizer deletes the tournament. Deleting a tournament also deletes its participants, matches and email queue.
- Password access tokens: 12 hours. Password attempt counters: about a day.
- Server logs: according to the providers' own retention periods.
- AI request log (feature, time, tokens, no text): the link to your account is removed together with the account.
If you want your data deleted earlier, write to us or to the tournament organizer.
Browser storage
Bracketa does not set cookies. It keeps a few items in your browser's local storage, needed for the site to work or to remember your choices:
- your sign-in session (organizers only);
- chosen language, light or dark theme and whether the landing page animation is on;
- a random browser identifier used for password attempts;
- the access token of a password-protected tournament (until you close the tab);
- unsaved drafts (a tournament being created, a score being entered) and the organizer's draw preference.
You can clear them in your browser settings at any time.
Your rights
You can ask us to:
- show what data we have about you and give you a copy;
- correct wrong data;
- delete your data;
- restrict or stop processing, or object to processing based on legitimate interest;
- transfer your data in a machine-readable format.
Write to tennis.tournamets@gmail.com. We answer within one month. Participants can also contact the tournament organizer, who can edit or remove their registration.
You also have the right to complain to the Lithuanian data protection authority, the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), or to the authority in your own EU country.
Children
Participants aged 14 or older may register themselves. Younger players should be registered by a parent, guardian or coach with the parent's consent.
Changes
We will update this page when the service changes. The date of the latest version is shown at the top.