Privacy policy

This policy explains what personal data Turnale stores when an organiser runs a tournament or a player uses a tournament page, why we store it, and the rights you have under the EU General Data Protection Regulation (GDPR). Turnale is deliberately minimal: no advertising, no tracking cookies, no data sold or shared.

Who is responsible for your data

Turnale is operated by SkyWave OÜ, a company registered in Estonia (registry code 14186184). SkyWave OÜ is the data controller for the data described here. For any privacy question or request, write to hello@turnale.app.

What we store

• Tournament data — the tournament name, settings, player names as entered by the organiser or by players themselves, match results, and house rules. This is what the tournament page shows.
• The organiser key — stored only as a cryptographic hash; we cannot read or recover the key itself.
• Optional player account — if a player signs in (email code or Google) to protect their name or get reminders, we store their email address and name. Email is used solely for tournament notices: signup confirmation, a day-before reminder, and waitlist promotion. Every mail has an unsubscribe link.
• Change log — every edit to a tournament is recorded (what changed and when) so mistakes can be undone.
• Feedback — if an organiser asks their assistant to send us feedback, we store that text.
• Technical data— short-lived, IP-keyed rate-limit counters for abuse prevention (they expire within hours) and aggregate, anonymous counters of which assistant platforms connect. Website analytics are cookieless (Vercel Analytics). Viewer preferences such as page language live in your browser’s local storage and never reach us.

We do not build profiles, send marketing, sell or share data, or use cookies that would need a consent banner.

Why we store it

• To run the tournament the organiser asked for (performance of the service; legitimate interest for player names entered by an organiser).
• To send tournament emails a player signed up for (consent — withdrawable any time via the unsubscribe link).
• To keep the service safe from abuse (legitimate interest).

If you chat with our built-in agent

Most organisers connect their own AI assistant (Claude, ChatGPT, …) — in that case the conversation happens in that assistant, under that provider’s own privacy terms, and we only see the tournament actions it takes. If instead you sign in on turnale.app and use our built-in agent, three things are worth stating plainly:

• OpenAI processes the conversation.Your messages, the agent’s replies, and the tournament data the agent needs to answer are sent to OpenAI as our processor, for the sole purpose of generating the reply. We do not allow it to be used for training models, and it is not stored on their side for our account.
• Player names will appear in the chat. That is what organising is — you paste a roster, the agent talks about who plays whom. Those messages are stored with the conversation, so player names are stored there too, not only on the tournament itself.
• We keep a conversation for 90 days after its last message, then delete it. Deleting your account deletes your conversations immediately. Afterwards we keep only counts (messages per day, tokens used) with no names and no message text. The tournament itself is unaffected — it lives until you delete it.

The organiser key of a tournament created this way is held encrypted on our side so you never need to handle it; you can reveal it to yourself at any time from My tournaments, and every reveal is written to that tournament’s change log.

Who we share it with

Only infrastructure providers acting on our instructions: hosting (Vercel), the database (Neon, hosted in the EU), an email delivery provider for tournament notices, and — only if you use our built-in agent — OpenAI as the model provider for that conversation. Some providers are US companies; where data leaves the EEA the transfer is covered by the EU–US Data Privacy Framework or Standard Contractual Clauses.

How long we keep it

• A tournament and its player data live until the organiser deletes the tournament. Deletion has a short recovery window (about 7 days), then the data is gone for good.
• Player accounts live until you ask us to delete yours.
• Built-in agent conversations are deleted 90 days after their last message, or immediately when the account is deleted.

If your name is on a tournament page

Organisers enter player names to run their event. If you want your name corrected or removed, the fastest route is the organiser — the page has a “can’t make it” option and the organiser can remove anyone in one step. You can always contact us directly instead.

Your rights

Under the GDPR you can ask for access, rectification, erasure, restriction, portability, object to processing based on legitimate interest, and withdraw consent at any time. Write to hello@turnale.app; we respond within one month. You also have the right to complain to a supervisory authority — in Estonia, the Andmekaitse Inspektsioon (aki.ee).

Changes

If this policy changes, the new version appears here with an updated date.