Privacy Policy

1. Who we are

GameOnn (gameonn.live) is operated by Sojan K Reji (“we”, “us”). We are the data controller for the personal data described in this policy. You can reach us at sojan4774@gmail.com.

2. What we collect

Account data

• Username — required. It is public and forms your profile address (/@username).
• Password — required. We store only a one-way hash, never the password itself.
• Display name — optional. Shown in place of your username where set.
• Email address — optional. Used to verify that you own it and to let you reset your own password. It is never shown publicly.
• Account timestamps — when the account was created and when you last signed in.

Content you create

• Tournaments you host: name, format, courts, scoring rules, status and the collaborators you invite.
• Participants you add to a tournament — names, and optionally a link to that person's GameOnn account.
• Every rally, game and match result recorded through the scoring console, including who scored it and when.
• Comments you post on matches, players you follow, and stream URLs you attach to a court.
• Accounts you block, and reports you file about a comment or an account: the reason you give and, for a comment, a copy of its text. Administrators read reports to decide whether to remove the comment or lock the account.

Technical data

Like any web server, ours keeps standard access logs: IP address, browser user-agent, the URL requested and the time. We use them only to keep the service running and secure. They are not linked to your account and are kept for no more than 30 days.

Separately, when you are signed in we keep an account activity log: each change you make (signing in, creating or editing a tournament, entering scores, commenting, following) with the time, your IP address and your browser user-agent. Failed sign-in attempts on your account are logged too. Only GameOnn administrators can see it, and only to keep accounts secure, investigate abuse and help you when something goes wrong. Each entry is deleted after 90 days, and the whole log is deleted when your account is removed.

To show prices in your local currency, we look up the country of your IP address in a database kept on our own server (IP geolocation by DB-IP). Only the resulting currency is used; the lookup is not stored.

Payments

If you buy tournament credits or the unlimited plan, we keep a record of each payment: what you bought, the amount and currency, the date, which payment provider handled it and its reference for the payment. Card and bank details are entered on the provider's checkout and never reach our servers.

Usage statistics

If you accept analytics cookies, Google Analytics records which pages you visit, how you arrived (the referring site), your browser, device type, screen size, language and approximate location (country and city, derived from your IP address), together with a random identifier stored in a cookie so repeat visits can be counted. Google Analytics does not store your IP address itself, and we do not send it your username, email or any account details.

If you decline or have not answered yet, Google Analytics still loads but runs in a restricted, cookieless mode: for each page view it sends a signal with the page address, the time, your browser's user-agent and your consent choice. No cookie is set, nothing is read from your device, and no identifier links one page view to the next, so these signals cannot be tied together into a profile of you. Google may use them to estimate overall visitor numbers.

Usage statistics in the GameOnn app

The GameOnn app asks the same question the first time you open it. If you accept, Google Analytics for Firebase records which screens you open and which features you use (for example starting, finishing or publishing a match, following a player or sharing a result), together with the app version, your device model, operating system, language and approximate location (country and city, derived from your IP address), and a random app-instance identifier so repeat use can be counted. We do not send it your username, email or account ID, or anything you type, such as player names, comments or searches. The app does not collect your device's advertising ID.

If you decline or have not answered yet, the app keeps no analytics identifier and sends Google only anonymous signals that cannot be tied together into a profile of you. You can change your answer at any time under Settings → Share usage statistics in the app.

What we do not collect

We run no advertising or behavioural-tracking scripts, we do not fingerprint devices, we do not use Google's advertising features, and we do not buy data about you from anyone.

3. What is public

GameOnn exists so spectators can follow a tournament without an account. The following is therefore visible to anyone, including search engines and AI crawlers:

• Your username, display name, match history, tournaments played and hosted, and who you follow or are followed by.
• Every tournament that is not in “draft” status: its fixture, results, set-by-set scorecards, rally logs and player list.
• Comments posted on match pages, together with the poster's username.
• The overlay pages used for streaming.

If you are a tournament organiser, you may enter the names of players who do not have a GameOnn account. You are responsible for having their permission to publish their name and results — see our Terms of Use. If your name appears in a tournament you did not consent to, contact us and we will remove or anonymise it.

4. How we use it

We use personal data only to:

• Provide the service — running tournaments, scoring matches, publishing results and profiles. Legal basis: performance of a contract (our Terms of Use).
• Keep your account secure — sign-in, email verification, password resets. Legal basis: contract, and our legitimate interest in preventing abuse.
• Operate and protect the service — debugging, rate limiting, blocking abuse. Legal basis: legitimate interest.
• Respond when you contact us. Legal basis: legitimate interest.
• Understand, in aggregate, how the site is used so we can improve it — Google Analytics. Legal basis: your consent for analytics cookies, which you can withdraw at any time; our legitimate interest in counting visits for the cookieless signals described in section 2.

We do not use your data for marketing, profiling or automated decision-making, and we do not send newsletters.

5. Cookies and local storage

When you sign in, your browser keeps a sign-in token in its local storage for up to 7 days so you stay signed in; signing out removes it. Your colour-theme preference and your answer to the cookie banner are stored the same way. None of these is sent to anyone but us, and none is used for tracking. They are strictly needed for the features you use, so they do not require consent.

Analytics cookies are optional. Only if you click “Accept” on the cookie banner does Google Analytics set these cookies:

• _ga — a random identifier that distinguishes visitors. Expires after 2 years.
• _ga_<ID> — keeps track of your current visit. Expires after 2 years.

Decline, or ignore the banner, and no analytics cookie is set; Google Analytics sends only the cookieless signals described in section 2. Overlay pages used for streaming load no analytics at all. You can change your mind at any time with “Cookie settings” in the footer of every page, or here: Cookie settings Withdrawing consent stops collection and deletes the analytics cookies from your browser.

6. Third parties

Video embeds

An organiser can attach a YouTube or Twitch stream to a court. When you open a match page that carries one, the video player is loaded from YouTube (Google) or Twitch (Amazon), and those companies may set their own cookies and collect data under their own privacy policies. We do not control this. Match pages without a stream load nothing from third parties.

Google Analytics

Usage statistics (see sections 2 and 5) are processed by Google Analytics, provided by Google Ireland Limited (for the EEA, UK and Switzerland) and Google LLC (elsewhere). Google acts as our processor for this data. Google's advertising features and data sharing for its own products are turned off. See how Google uses data from sites that use its services.

Payments

Our order process is conducted by our online reseller Paddle.com. Paddle.com Market Limited (United Kingdom) is the merchant of record for these orders: it sells to you, processes the payment, handles sales tax and VAT, and issues your invoice. It receives the payment details you enter on its checkout, your email address, your country and postcode where tax requires them, and handles them as an independent controller under its own privacy notice.

In some countries, such as India, payments are processed instead by Razorpay Software Private Limited (India), which receives the payment details you enter on its checkout and your email address and name, under its own privacy policy.

Hosting

Our servers are rented from a hosting provider located in the United States. The provider stores the data on our behalf and does not access it for its own purposes.

Email

Verification codes and password-reset messages are sent from our own mail server; no third-party email service is involved.

We share personal data with no one else, unless the law requires it.

7. Where your data is stored

All data is stored and processed in the United States. If you use GameOnn from the European Economic Area, the United Kingdom or Switzerland, that means your data leaves your region. We rely on the safeguards available under applicable data-protection law, including standard contractual clauses with our hosting provider where required. Given what we store — usernames, hashed passwords, optional emails and sports results — we consider the risk of this transfer to be low.

Google may process analytics data in the United States. Google LLC is certified under the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions), and Google also offers standard contractual clauses for such transfers.

8. How long we keep it

• Account data — for as long as your account exists.
• Tournament and match records — indefinitely, because they are the historical record of the event for every player who took part.
• Verification and reset codes — deleted once used or expired.
• Server logs — no more than 30 days.
• Analytics data — visitor-level data is deleted by Google Analytics after 2 months; we keep only aggregate reports beyond that.
• Account activity log — 90 days per entry, and deleted with your account.

What happens when you delete your account

Ask on the account deletion page (no sign-in required) or email us quoting your username. If you are not signed in, we first email a confirmation link to the address on the account, so nobody can request deletion on your behalf. Once confirmed you receive an acknowledgement, and an administrator acts within 30 days. Because results belong to everyone who played, deletion works by anonymising the account rather than erasing the record of the matches:

• Your email address, display name and password are erased, and sign-in is permanently locked.
• Your username is replaced with deleteduser followed by a number, so nothing identifies you.
• Your public profile stays reachable but says only that the account has been removed. Followers, people you follow, your comments, blocks and reports (yours and those about you) and your account activity log are deleted.
• Tournaments and results you took part in stay online. Any tournament you were hosting that was still upcoming or live is marked completed.
• Names typed into a draw by an organiser are the organiser's content and are not changed automatically — mention it in your request if you want your name replaced there too.

9. Your rights

Wherever you are, you can ask us to:

• Access the personal data we hold about you, and receive a copy in a common machine-readable format.
• Correct it — display name and email can be changed from your profile settings; anything else, ask us.
• Delete it — via the account deletion page — in the way section 8 describes.
• Restrict or object to processing based on our legitimate interests.
• Withdraw consent where processing relies on it — for analytics, through “Cookie settings” in the site footer or Settings → Share usage statistics in the app; for your email, by removing it from your profile.

Send requests to sojan4774@gmail.com. We answer within one month. We will ask you to confirm you control the account before acting.

If you are in the EEA or UK, you also have the right to complain to your local data-protection authority. If you are in India, this policy is intended to meet the Digital Personal Data Protection Act, 2023. If you are a California resident, note that we do not “sell” or “share” personal information as those terms are defined in the CCPA: analytics data is processed by Google on our behalf only, and never used for advertising.

10. Age limit

You must be at least 16 years old to create an account. We do not knowingly hold account data for anyone younger; if you believe we do, contact us and we will delete it. Organisers may enter younger players' names into a tournament draw with the permission of a parent or guardian.

11. Security

All traffic is encrypted with HTTPS. Passwords are hashed with bcrypt and cannot be recovered by us. Access to the servers is limited to the operator. No system is perfectly secure, so if you discover a vulnerability please report it to sojan4774@gmail.com.

12. Changes to this policy

If we change this policy in a way that matters, we will update the date at the top and, for significant changes, show a notice on the site. Continued use after a change means you accept the updated policy.

13. Contact

Sojan K Reji
sojan4774@gmail.com

See also our Terms of Use.