What we keep, and what we don't.

We use it for one message: that the product is ready to use. After that you can unsubscribe in a single field, and if you do we delete the address. No newsletter. Each sign-up was also reported to us by email; beyond our own inbox, we pass the address on to nobody.

Alongside the address itself we keep the moment you signed up, which page you signed up from, and your browser's language setting. That last one so we can write to you in Dutch, English or German. Your IP address is not stored with your sign-up. When you signed up, though, a shortened fingerprint (hash) of your IP address was kept for an hour as a counter against abuse; after that it disappeared by itself. The sign-up form is no longer on the site.

Legal basis: your consent (GDPR Article 6(1)(a)). You can withdraw it at any time, by unsubscribing as described above.

Retention: until you unsubscribe, and twelve months at most in any case. After that the sign-up disappears by itself.

A tournament consists of names, results and standings. Those names are personal data, even when they are only first names or nicknames. We need them to run the tournament and to show the standings on the big screen — there is no other reason.

We also keep track, per tournament, of how many players and boards there are and when it was played, without any names, so we can run and improve the service.

With Club you can also keep a member list, with nicknames, and a season ranking. For that we keep each member's name and nicknames, and for every evening that counts the name of each player, their final placing and the date. We calculate the season standings from that. With Club you can share those standings through a public link: anyone who has the link sees the names, the points and the winners of the evenings without logging in; a new link makes the old one invalid, and without Club it no longer works.

You decide what you type in. If you would rather not use real names, nicknames or initials work just as well.

Legal basis: for these names we are the processor. The organiser who enters them is the controller, and the legal basis lies with them; we process the names only on their instructions, under the data processing agreement.

Retention: as long as you keep the tournament. Delete a tournament or your account and it is gone right away; an earlier state of a tournament can still be restored for up to 30 days, after that no longer. The member list and the season results are kept for as long as your account exists; a member or tournament you delete is gone right away, and deleting your account removes everything. They are also part of the export of your data.

For an account we keep your email address, your language choice, the moment and version of your agreement to the terms, and your session. The session sits in a cookie, only to keep you logged in, and expires 60 days after you last used it. If you have Club, we also keep until when Club runs, which reminder about it you already received, and the club name you fill in. That club name appears on the big screen, the podium and the viewer link of your tournaments: anyone with that link sees it.

To log in you request a link or a code. We keep that sign-in request for 24 hours, together with a one-way fingerprint (hash) of your IP address to curb abuse; after that it is wiped automatically. The sign-in email goes through Brevo (France). For that, Brevo gets your email address and the sign-in email itself (the link and the code), no data about your players. The service emails go through Brevo too: the invoice for a payment and, with Club, the reminders before Club ends.

If you open a sample evening from the website, we keep a one-way fingerprint (hash) of your IP address for 48 hours, only to curb abuse; after that it is wiped automatically. The names in the sample evening are made up; we keep nothing else about you.

Legal basis: performance of the contract (GDPR Article 6(1)(b)); for the fingerprint of your IP address with the sign-in request and the sample evening, our legitimate interest in preventing abuse (GDPR Article 6(1)(f)).

Retention: until you delete your account, which you can do yourself, on the account page. After that, the account data can still be restored for up to 7 days, after that no longer.

If we step in on an account as administrators, for example by blocking or deleting it, we record that together with the email address. We keep that record for as long as our administration requires: seven years.

If you pay for a single night or Club in the app, Mollie B.V. (the Netherlands) processes that payment; we see whether it was paid and the payment method, not your account or card details.

Per payment we keep: the country you give, the name and address you optionally fill in, the amount, the payment's status, the invoice number, the description with the tournament's name (kept for seven years, even after you delete the tournament), the payment method, and the link to your account.

Legal basis: performance of the contract (GDPR Article 6(1)(b)), and for keeping the invoice records a legal obligation (point (c)).

Retention: tax law requires us to keep invoice records for seven years.

We count visits to this site with Cloudflare Web Analytics. Each page loads a small script from Cloudflare that reports the page, the referring site, your browser, your country and the load time. No cookie is involved, your IP address is not stored and you are not followed across other sites. We only see totals, never an individual visitor.

In the app we also count how often someone arrives through the "Start for free" button on this site: one number per day and per site, without an IP address, browser or anything else about you. That number is not personal data.

Legal basis: our legitimate interest in seeing how the site is used and which pages work (GDPR Article 6(1)(f)). Because nothing is stored on your device and nothing can be traced back to you, we do not ask for consent.

Retention: Cloudflare keeps the visitor statistics available for six months; after a week they are reduced to a sample. We keep the daily "Start for free" counts for as long as the service exists, as they are only numbers.

The app keeps no log of requests with your IP address. We deliberately write no names or email addresses to our error messages; those are kept for a few days at Cloudflare.

Notifications from our payment provider about a payment are rate-limited against abuse using an irreversible fingerprint (hash) of the sender's IP address. In practice these are Mollie's servers. The fingerprint is kept for little more than a day at most and is then deleted automatically (legal basis: our legitimate interest, GDPR Article 6(1)(f)).