Privacy policy

Last updated: 13 October 2026

1. Who we are

TourneyDo is provided by Xinger Solutions GmbH, Seefeldgasse 5, 3462 Absdorf, Austria (FN 520445k, VAT ATU74837313), represented by Georg Kreuzinger. You can reach us at office@xinger.org or +43 676 83924444.

This policy explains how we process personal data when you use the Tourneydo website (tourneydo.com), the web app, and the iOS and Android apps.

2. Local use without an account

You can create and run tournaments without signing in. In that case tournament names, players, scores, settings, and optional player photos stay only on your device (Hive on mobile, IndexedDB in the browser). We do not receive this data, and you do not need to accept this policy or the terms of service to use Tourneydo locally.

If you uninstall the app, clear the website’s storage, or wipe data in settings, this local information is deleted and cannot be recovered by us.

3. When you create an account

An account is optional. It is required only if you want to sync tournaments across devices or use features that need our servers (for example minting a live-share link). Before the first sign-in or registration we ask you to agree to the terms of service and this privacy policy.

If you sign in with email, we process your email address and password hash (stored by our authentication service; we never see your plaintext password). If you sign in with Google, Google sends us an identifier and the email associated with that Google account.

We also store a device identifier used only to resolve conflicting edits between your devices.

4. Data we sync when you are signed in

While you are signed in, we store on servers we operate:

  • Tournaments, players, matches, scores, and roster entries you choose to sync
  • Optional player avatars you upload
  • Account profile data such as a display name
  • Soft-deleted records until they are purged, so other devices can stay in sync
  • Live-share links you create (token, optional PIN hash, expiry, viewer counts)

5. Live share

If you create a live-share link, anyone with the link (and PIN, if you set one) can view a read-only snapshot of that tournament. The snapshot may include player names, avatars, scores, and bracket or table state. Do not share a link if that information must stay private.

Spectators do not need an account. We may store a random viewer id and a short-lived ticket on their device so we can count viewers and skip repeating a PIN. We do not use live share for advertising.

6. Website and contact

The marketing website does not require an account. If you send a message through the contact form, email, or Send feedback in the app, we store your message and, if you add one, your email address only to reply and to improve the product. Signed-in reports are tied to your account and deleted with it. We do not sell contact details or use them for advertising. Tournament data is not included.

The site is served from our hosting. Server logs (such as IP address, time, and requested URL) may be stored briefly for security and operations, then deleted or anonymised.

7. Usage statistics in the web app

The web app measures which screens are used. The tool is Umami, and it runs on servers we operate. The marketing website and the iOS and Android apps are not included. This measurement does not set a cookie and does not store anything in your browser for this purpose.

A page view sends the path (live-share tokens and tournament ids are removed first), the page title, the referring website without its query string, browser language, screen size, and loading times (Core Web Vitals). We do not send your name, email address, account id, or the contents of a tournament.

The same measurement counts a few named actions: a tournament was created (format only, such as knockout or round robin), a tournament was started, a live share was created, an account was created or a sign-in finished (email or Google, without an account id), and feedback was sent (only whether it was a bug, an idea, or a message).

The server uses the IP address only to derive a country and a session key that changes over time. It does not keep the full IP address. We do not build advertising profiles, and we do not pass these statistics to an outside analytics company.

The legal basis is our legitimate interest in operating and improving the web app (Art. 6(1)(f) GDPR). Because nothing is stored on your device for this measurement, we do not ask for consent in a cookie banner. If your browser sends Do Not Track, the visit is not recorded. You may object at any time (Art. 21 GDPR) by emailing office@xinger.org.

8. Mobile apps: ads and subscriptions

The free iOS and Android apps may show ads through AppLovin MAX and Google AdMob. Those partners may process device identifiers, IP address, and interaction data. Where required (for example in the EEA/UK), a consent flow is shown before personalised ads. Tourneydo Pro subscribers do not see ads.

In-app purchases are processed by Apple or Google. We use RevenueCat to verify subscription status. We do not receive your payment card number.

9. Legal bases (GDPR)

Where the GDPR applies, we process data on these bases:

  • Contract (Art. 6(1)(b)): creating and running your account, syncing your tournaments, live share you request
  • Consent (Art. 6(1)(a)): personalised advertising in the free mobile apps; you can withdraw it in the consent dialog or device settings
  • Legitimate interests (Art. 6(1)(f)): securing the service, preventing abuse, non-personalised ads, answering contact messages, and measuring web-app usage as described in section 7
  • Legal obligation (Art. 6(1)(c)): where we must retain invoices or respond to lawful requests

10. Processors and transfers

Account, sync, and live-share data are stored on servers we operate. Depending on how you use Tourneydo, the following providers may process data on our behalf or as independent controllers:

  • Google (OAuth sign-in; AdMob in the free mobile apps) — https://policies.google.com/privacy
  • Apple (App Store purchases and in-app review) — https://www.apple.com/legal/privacy/
  • RevenueCat (subscription status in the mobile apps) — https://www.revenuecat.com/privacy
  • AppLovin (ad mediation in the free mobile apps) — https://www.applovin.com/privacy/

11. Retention

Local-only data stays on your device until you delete it. Synced account data is kept while the account exists. If you delete your account in the app, we delete synced rows and avatars on the server. Live-share links expire automatically (and at the latest 12 hours after a tournament is completed). Contact emails are kept only as long as needed to handle your request. Web-app usage statistics stay on our servers until we no longer need them to understand how the app is used, or until we delete them after a successful objection. Ad and store data follow those providers’ policies.

12. Your rights

You may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent for personalised ads at any time. You may also lodge a complaint with the Austrian data protection authority (Datenschutzbehörde) or another competent supervisory authority.

To exercise these rights, email office@xinger.org. You can delete local data in the app settings, and delete your account there if you are signed in.

13. Children

TourneyDo is not directed at children under 16. We do not knowingly create accounts for children. If you believe a child has provided personal data, contact us and we will delete it.

14. Changes

We may update this policy. The date at the top will change. If the changes are material and you have an account, we may ask you to review them at the next sign-in.

Terms · Imprint