Privacy policy

What we collect

• From kids (under 13): username, hashed PIN, birth month + year (no day), match history, practice attempts. No email, phone, address, real name, or photo.
• From parents: name, email, hashed password, the kids they manage.
• From coaches: name, email, hashed password, the team they coach.
• From everyone: IP address, user agent, last login time. These are for security and abuse prevention.

How we use it

• To match you with appropriate opponents and track your progress.
• To investigate reports and abuse.
• To send transactional email (parent verification, password reset, ban appeals).

We do not sell or rent your data. Ever.

COPPA (kids under 13)

We comply with the Children's Online Privacy Protection Act:

• A child under 13 cannot register without their parent's verifiable email consent.
• Parents can review, modify, or delete their child's data at any time by emailing us.
• We don't show targeted ads to children.
• We don't allow children to share photos or videos with strangers.

Your rights

• Ask for a copy of all data we have on you.
• Ask us to delete your account and all associated data.
• Ask us to correct anything that's wrong.

Email via the contact form with the subject "Privacy request".

Security

Passwords are hashed with bcrypt. Sessions use HTTPS-only, SameSite-Lax cookies. SMTP credentials and other secrets are encrypted at rest. Server access is logged.

No system is perfect — if you suspect a security issue, please write us at the contact form with subject "Security disclosure".