PRIVACY POLICY

What this covers

This page is about the people who use the site — what is kept about you, why, and for how long. What is measured about the sites in the tournament is taken from their public pages, is about websites rather than people, and is published on purpose.

What is stored

An account: an email address, a password stored only as a hash, an optional display name, and when the account was created and last seen. It exists so a vote counts once, a claim belongs to somebody, and an order can be found again.

A domain you submit or claim is stored with your account and is public — the queue, the bracket and the site’s own page all name it.

An order stores what was bought, the amount, a contact email, and for a sponsorship the name, link and logo you supplied. Card numbers never reach this site: payment happens on Stripe’s pages.

Email: the only message we send is the password-reset link, and only when you ask for it. There is no newsletter.

Cookies and analytics

champ_token keeps you signed in for thirty days and is set only when you sign in. A simple visitor-analytics service counts page views and a few actions — a site entered, a vote cast, a checkout opened — against a random identifier in your browser; while you are signed in it is told your account’s email so a purchase can be attributed. There is no advertising network, no ad pixel, and nothing that follows you to other sites. Clearing site data for this domain removes all of it.

Requests are rate-limited by a salted hash of your IP address, held in memory and thrown away with the window. The address itself is never written down.

Who else sees it

Stripe handles every payment and receives what a payment needs. The server, the backups, the measurements, the reset email and the analytics run on infrastructure inside the EU. Nothing is sold, and nothing is shared beyond what those services need to do their job.

How long

An account is kept until you delete it. Orders are kept as long as tax law requires. Results are kept indefinitely, because they are the archive. The database is backed up nightly, and copies age out over a year, so a deletion can take up to that long to leave the oldest backup.

Your rights

You can ask for a copy of what is held about you, have it corrected or deleted, or object to it being held. Write from the address the account is registered under. You can also complain to the data protection authority where you live. Deleting an account removes the account, its sessions and its claims; it does not remove results already broadcast, which name domains rather than people.

Changes

If this page changes, the date at the top changes with it.

Terms of use →