Privacy Policy

1. Who we are

CupTable ("the Service", "we", "us") is operated by an individual entrepreneur registered in Ukraine. This Privacy Policy explains what personal data we collect, why, and what rights you have. It applies to the CupTable website, the organizer application, and public tournament pages.

For the data in your account, we act as the data controller. For participant data that tournament organizers publish (see section 4), the organizer is the controller and we process that data on the organizer's behalf.

2. What data we collect

Account data — when you register: your name, email address, and password (stored only in hashed form). If you sign in with Google, we receive your name and email address from Google and keep your Google account identifier to link the sign-in, instead of storing a password. Optionally, you can add an organizer profile: photo or club crest, role, and organization name. We also store your interface language and colour theme.

Reviews — after a tournament is finished you can rate it and leave a review (stars and an optional text, plus a role and organization if your profile has none). We keep every review you submit to improve CupTable. Only if you rated 4-5 stars and ticked the consent box, and only after we approve it, we may show it on our landing page together with its date, the tournament's name and team count, your name and, if you set them, your profile picture, role and organization. You can withdraw this consent yourself at any time on the review card ("Remove from the website"); the review then disappears from the website and the picture copy is deleted. Reviews are deleted when you delete your account.

Security data — if you enable two-factor authentication: your 2FA secret and recovery codes (encrypted), and a list of devices you chose to trust (a browser/platform label and the IP address at the time of trusting).

Tournament data — the tournaments you create: teams, players, schedules, results, venues, documents, and the images you upload (tournament and club emblems/logos).

Payment data — when you purchase an upgrade or credit pack: the order (what was bought, amount, date, status). We never see or store your card details — the payment itself is handled entirely by our payment provider (Plata by mono / monobank).

Support and contact data — messages you send via support tickets or the contact form, including screenshots you attach to tickets. With a contact-form message we also store your IP address and browser details; with a support ticket, your browser details, interface language and, if you choose one, the tournament it concerns. Ticket attachments are stored privately and are visible only to you and our support staff.

Scorekeeper link data — organizers can create scorekeeper links that let a helper enter scores without an account. If you use such a link, we do not ask who you are; we record the time and IP address of the link's use — the time is shown to the organizer who created the link as an audit trail, and the IP address is stored for security and abuse-prevention purposes. The scores and match events you enter become part of that tournament's data.

Legal records — the version of the Terms you accepted and when, with the IP address and browser details of that request (kept as evidence of the agreement while your account exists).

Technical data — standard server logs (IP address, browser type, requested pages) used for security and troubleshooting, a session record (IP address, browser details, last activity), and the cookies described in section 6.

We do not use analytics or advertising trackers.

3. Why we process your data

• To provide the Service — operating your account, tournaments, and public pages (performance of a contract).
• To process payments and keep records of them (contract + legal obligations).
• To answer your requests — support tickets and contact messages (contract / legitimate interest).
• To keep the Service secure — sign-in, 2FA, bot protection, server logs, and to keep evidence of your agreement to the Terms (legitimate interest).
• To improve CupTable — reviews you submit (legitimate interest).
• To show your review on our website — your consent (you can withdraw it at any time).
• To send service emails — email verification and password/email-change links, security notices, payment confirmations, replies to your support tickets. We do not send marketing emails.

4. Participant data on public tournament pages

Organizers may add participants' names and team details to a tournament and publish the tournament page, which is visible to anyone with the link. For this data the organizer acts as the data controller: the organizer is responsible for having the right — and, where required, the consent of the participants or their parents/guardians for minors — to publish it. We host and display this data on the organizer's behalf.

Image upload fields in the Service are intended for tournament and club emblems/logos. If an organizer nevertheless uploads an image showing an identifiable person, that image is personal data too, and the same responsibility of the organizer applies.

Documents (for example regulations or rosters) that an organizer attaches to a published tournament can be downloaded by anyone who has the page link; the organizer is responsible for what they contain.

If you are a tournament participant and want your data corrected or removed from a public page, contact the tournament organizer first — they control that content. If you cannot reach the organizer, contact us via our Contact Us page and we will help.

5. Who we share data with

We do not sell personal data. We share it only with service providers we need to run CupTable:

• Hosting and infrastructure providers — the Service runs on third-party servers;
• Plata by mono (monobank) — processes payments; your card data goes directly to them;
• Google — if you sign in with Google (OAuth) and for reCAPTCHA bot protection on authentication and contact forms (Google processes your IP address and browser data; see Google's privacy policy);
• Email delivery provider — to send the service emails described above;
• public authorities, where the law obliges us to.

Some of these providers may process data outside your country, including outside the European Economic Area. Where the GDPR applies, such transfers rely on the provider's appropriate safeguards, such as EU standard contractual clauses or an adequacy decision.

6. Cookies and similar technologies

We use only cookies that are necessary for the Service to work:

We also use your browser's local and session storage for on-device preferences that are never sent to our servers: the team you follow on a tournament page, your language choice, view and layout preferences (including collapsed blocks), the colour theme of the scorekeeper page, the accent colour picked on the demo pages, the last date and time you entered in the quick schedule editor, and a note that the logo animation was already shown. Because we use no analytics or marketing cookies, no cookie consent banner is shown.

7. How long we keep data

• Account and tournament data — for as long as your account exists. You can delete your account at any time in the settings; this permanently deletes your tournaments, uploaded files, and profile.
• Payment records — after account deletion, orders and the credit ledger are kept in a form that no longer identifies you in our systems (no name, email or account link), as required for accounting and legal purposes. We also keep anonymous usage statistics (for example, how many tournaments and matches existed) that are not tied to a name, email or account.
• Backups — deleted data may persist in backups for a limited period before they rotate out; backups are not used to restore deleted accounts.
• Support tickets — until you delete your account. Contact-form messages — until you ask us to delete them, or until the account with the same email is deleted.
• Server logs — for a short technical period, then deleted or rotated.

8. How we protect your data

• All traffic is encrypted (HTTPS); session cookies are httpOnly.
• Passwords are stored only as cryptographic hashes; with Google sign-in no password is stored at all.
• Optional two-factor authentication (2FA) is available for every organizer account — a one-time code from an authenticator app plus recovery codes — as an additional layer of protection for your account and tournament data.
• Scorekeeper link tokens are stored as a one-way hash (plus an encrypted copy visible only to the organizer who created the link, so they can view and re-share it).
• Card details never touch our servers — payments are handled by Plata by mono.
• Access to support-ticket attachments is restricted to you and our staff.

9. Your rights

Subject to applicable law (including the GDPR where it applies), you have the right to:

• access the personal data we hold about you;
• correct inaccurate data (most account data you can edit yourself in the settings);
• delete your data (the account-deletion feature in the settings does this);
• object to or restrict certain processing;
• receive a copy of the data you provided;
• withdraw a consent you gave (for example, to show your review on the website) at any time;
• lodge a complaint with a supervisory authority.

To exercise any of these rights, use the account settings or reach out via our Contact Us page.

10. Children

Organizer accounts may only be created by adults (18+). Tournament participants of any age may appear in tournament data published by organizers — responsibility for that data is described in section 4.

11. Changes to this Policy

We may update this Policy from time to time. Each version is dated and archived; the current version is always available on this page. For material changes we will notify you in the Service (together with updated Terms) or by email.

12. Contact

If you have questions about this Privacy Policy, please reach out via our Contact Us page.