Privacy Policy

1. Who we are

GameOn (gameon.aabib.org) is operated by Sojan K Reji (“we”, “us”). We are the data controller for the personal data described in this policy. You can reach us at sojan4774@gmail.com.

2. What we collect

Account data

• Username — required. It is public and forms your profile address (/@username).
• Password — required. We store only a one-way hash, never the password itself.
• Display name — optional. Shown in place of your username where set.
• Email address — optional. Used to verify that you own it and to let you reset your own password. It is never shown publicly.
• Account timestamps — when the account was created and when you last signed in.

Content you create

• Tournaments you host: name, format, arenas, scoring rules, status and the collaborators you invite.
• Participants you add to a tournament — names, and optionally a link to that person's GameOn account.
• Every rally, game and match result recorded through the scoring console, including who scored it and when.
• Comments you post on matches, players you follow, and stream URLs you attach to an arena.

Technical data

Like any web server, ours keeps standard access logs: IP address, browser user-agent, the URL requested and the time. We use them only to keep the service running and secure. They are not linked to your account and are kept for no more than 30 days.

What we do not collect

We run no analytics, advertising or behavioural-tracking scripts, we do not fingerprint devices, and we do not buy data about you from anyone.

3. What is public

GameOn exists so spectators can follow a tournament without an account. The following is therefore visible to anyone, including search engines and AI crawlers:

• Your username, display name, match history, tournaments played and hosted, and who you follow or are followed by.
• Every tournament that is not in “draft” status: its fixture, results, set-by-set scorecards, rally logs and player list.
• Comments posted on match pages, together with the poster's username.
• The overlay pages used for streaming.

If you are a tournament organiser, you may enter the names of players who do not have a GameOn account. You are responsible for having their permission to publish their name and results — see our Terms of Use. If your name appears in a tournament you did not consent to, contact us and we will remove or anonymise it.

4. How we use it

We use personal data only to:

• Provide the service — running tournaments, scoring matches, publishing results and profiles. Legal basis: performance of a contract (our Terms of Use).
• Keep your account secure — sign-in, email verification, password resets. Legal basis: contract, and our legitimate interest in preventing abuse.
• Operate and protect the service — debugging, rate limiting, blocking abuse. Legal basis: legitimate interest.
• Respond when you contact us. Legal basis: legitimate interest.

We do not use your data for marketing, profiling or automated decision-making, and we do not send newsletters.

5. Cookies and local storage

We set no cookies of our own. When you sign in, your browser keeps a sign-in token in its local storage for up to 7 days so you stay signed in; signing out removes it. Your colour-theme preference is stored the same way. Neither is sent to anyone but us, and neither is used for tracking.

6. Third parties

Video embeds

An organiser can attach a YouTube or Twitch stream to an arena. When you open a match page that carries one, the video player is loaded from YouTube (Google) or Twitch (Amazon), and those companies may set their own cookies and collect data under their own privacy policies. We do not control this. Match pages without a stream load nothing from third parties.

Hosting

Our servers are rented from a hosting provider located in the United States. The provider stores the data on our behalf and does not access it for its own purposes.

Email

Verification codes and password-reset messages are sent from our own mail server; no third-party email service is involved.

We share personal data with no one else, unless the law requires it.

7. Where your data is stored

All data is stored and processed in the United States. If you use GameOn from the European Economic Area, the United Kingdom or Switzerland, that means your data leaves your region. We rely on the safeguards available under applicable data-protection law, including standard contractual clauses with our hosting provider where required. Given what we store — usernames, hashed passwords, optional emails and sports results — we consider the risk of this transfer to be low.

8. How long we keep it

• Account data — for as long as your account exists.
• Tournament and match records — indefinitely, because they are the historical record of the event for every player who took part.
• Verification and reset codes — deleted once used or expired.
• Server logs — no more than 30 days.

What happens when you delete your account

Ask on the account deletion page (no sign-in required) or email us quoting your username. If you are not signed in, we first email a confirmation link to the address on the account, so nobody can request deletion on your behalf. Once confirmed you receive an acknowledgement, and an administrator acts within 30 days. Because results belong to everyone who played, deletion works by anonymising the account rather than erasing the record of the matches:

• Your email address, display name and password are erased, and sign-in is permanently locked.
• Your username is replaced with deleteduser followed by a number, so nothing identifies you.
• Your public profile stays reachable but says only that the account has been removed. Followers, people you follow and your comments are deleted.
• Tournaments and results you took part in stay online. Any tournament you were hosting that was still upcoming or live is marked completed.
• Names typed into a draw by an organiser are the organiser's content and are not changed automatically — mention it in your request if you want your name replaced there too.

9. Your rights

Wherever you are, you can ask us to:

• Access the personal data we hold about you, and receive a copy in a common machine-readable format.
• Correct it — display name and email can be changed from your profile settings; anything else, ask us.
• Delete it — via the account deletion page — in the way section 8 describes.
• Restrict or object to processing based on our legitimate interests.
• Withdraw consent where processing relies on it (for example, by removing your email address).

Send requests to sojan4774@gmail.com. We answer within one month. We will ask you to confirm you control the account before acting.

If you are in the EEA or UK, you also have the right to complain to your local data-protection authority. If you are in India, this policy is intended to meet the Digital Personal Data Protection Act, 2023. If you are a California resident, note that we do not “sell” or “share” personal information as those terms are defined in the CCPA.

10. Age limit

You must be at least 16 years old to create an account. We do not knowingly hold account data for anyone younger; if you believe we do, contact us and we will delete it. Organisers may enter younger players' names into a tournament draw with the permission of a parent or guardian.

11. Security

All traffic is encrypted with HTTPS. Passwords are hashed with bcrypt and cannot be recovered by us. Access to the servers is limited to the operator. No system is perfectly secure, so if you discover a vulnerability please report it to sojan4774@gmail.com.

12. Changes to this policy

If we change this policy in a way that matters, we will update the date at the top and, for significant changes, show a notice on the site. Continued use after a change means you accept the updated policy.

13. Contact

Sojan K Reji
sojan4774@gmail.com

See also our Terms of Use.