PRIVACY POLICY

What this covers

The SEO Championship is a weekly knockout between websites, watchable from start to finish. This page is about the people who use it — what is kept about you, why, and for how long. What is measured about the sites is a different thing, and it is published on purpose: a result nobody can check is not a result.

What is stored, and why

An account is an email address, a password that is only ever stored as a bcrypt hash, an optional display name, whether marketing email was opted into, and the times the account was created and last seen. It exists so a vote counts once, a claim belongs to somebody, and an order can be found again. There is no way to read a stored password, including for us.

A session is an opaque random token, stored so it can be revoked. Choosing a new password drops every session that existed before it.

A domain you submit or claimis stored with the account that submitted it, and is public: the queue, the bracket and a site's own page all name it. A claim also stores how it was proved — a DNS record, a meta tag or a file at a known path.

An order— a sponsorship or a tournament seat — stores what was bought, the amount at the moment it was bought, a contact email, and, for a sponsorship, the brand name, link, strapline and logo supplied for it. It also stores the payment provider's reference for the transaction. Card numbers never reach this site: the payment happens on Stripe's own pages.

Measurements are taken from the public pages of sites in the tournament — the homepage, robots.txt, the sitemap, response headers, screenshots. They are about websites rather than about people, and they are published with the weekend they decided.

What is not stored

There is no analytics, no advertising network, no tracking pixel and no third-party script of any kind on this site. The two typefaces are served from this domain rather than fetched from Google.

Requests are rate limited per source address, and the address is hashed with a salt and kept in memory only for the length of the window. It is never written to the database and never leaves the process.

Cookies

One, called champ_token. It holds the session token so that a signed-in reader stays signed in, lasts thirty days, and is marked SameSite=Lax and Secure. It is strictly necessary for signing in and is set only once you do, which is why this site has no cookie banner: there is nothing to consent to.

Who else sees it

Stripe handles every payment and receives what a payment needs — the amount, the description, and the email and any VAT number given at checkout. For a tournament seat Stripe is the seller of record and issues the receipt; for a sponsorship the sale is ours and Stripe is the processor.

ProjectHQ performs the measurements. It receives the domains being measured, and nothing about the people who submitted them.

Hetzner hosts the server and the off-site backup storage, both inside the EU.

Nothing is sold, and nothing is shared with anybody not named here.

How long it is kept

An account and its history are kept until you ask for them to be deleted. Orders are kept for as long as tax law requires them to be. Results — brackets, scores, measurements — are kept indefinitely, because they are the archive and a season that quietly loses its weekends is not one.

The database is copied nightly, to this server and to storage in another building. Copies age on a fixed ladder: every night for a month, one a month for six months, then one a year. A deletion therefore takes up to that long to disappear from the oldest backup, which is the honest answer rather than a promise nobody could keep.

Your rights

You can ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, and object to it being held at all. Ask from the address the account is registered under. If the answer is unsatisfactory you can complain to a data protection authority in the country you live in.

Deleting an account removes the account, its sessions and its claims. It does not remove results already broadcast: a bracket names domains, not people, and unpicking a played weekend would falsify the archive.

Changes

If this page changes, the date at the top changes with it. Nothing here is retroactive — data collected under one version stays under it.

Terms of use →