Privacy
Last updated: October 25, 2026
What Bracket stores
- The name of your tournament and its format.
- The names of the participants, in seed order. A name can be a first name only. Bracket does not check it.
- The scores of the matches.
- A secret code, kept as a fingerprint (a SHA-256 hash). The server cannot read the code. It is explained below.
Where, and for how long
The data is in a Cloudflare D1 database. The server deletes a tournament, with its names and scores, 90 days after the last change. Each saved score or fixed name is a change. You can delete your tournament sooner, with your organizer link. Cloudflare D1 keeps point-in-time backups of the database for up to 30 days, so deleted data can stay in a backup for that time. Nobody reads these backups except Kevin, and only to restore.
What Bracket does not do
- No cookies.
- No ads, and no cross-site tracking.
- The server does not log IP addresses. To limit how many tournaments one address can make in a day, it keeps a count for each address, stored as a keyed one-way hash of your IP address that changes every day. The count has no content, and the hash, its count and the key of the day are deleted after one day.
- The server also keeps anonymous usage counts (counts only, no content).
- No account, and no email address.
- When you make a tournament, or save a score, the page sends one anonymous count: the tool, which job (for example "score saved"), the page type, and mobile or desktop. No cookie, no IP address, nothing you typed.
- If the page has an error, it sends an error report. The report has no name, no score and no secret code.
Who can see a tournament
Anyone who has the view link of a tournament can see it, with the names and the scores. Share the link only with the people you want. Tournament pages are hidden from search engines.
The organizer link
When you make a tournament, you get an organizer link. It has a secret code after the # sign. Browsers never send that part to a server. The page reads it and sends it in a header, only to this site, when you change the tournament. Your device also keeps it in its local storage, so the tournament opens as yours on this device. Anyone who has the organizer link can manage the tournament. We cannot send it to you again.
Your rights, your contact and the law
Who is responsible
I am Kevin Amado, and I am responsible for the data in Bracket. I am one person in Alberta, Canada. Write to kamadorueda@gmail.com with any question or request about your data.
Why data is used, and for how long
- Counts, error reports and logs: to run the tool and fix errors. The legal basis is my legitimate interest. Counts stay 90 days. Logs and error reports stay 7 days. Nothing is counted when your browser sends Do Not Track or Global Privacy Control.
- Features you turn on, such as sign-in, sync, reminders or sharing: to give you that feature. The legal basis is your consent or our contract. This page says how long each kind of data stays.
- Data in your browser: I do not receive it. It stays until you clear it.
Who receives your data, and where it goes
Cloudflare hosts this tool and handles the data for me. It works in the United States and in other countries. For transfers from the EU and the UK, it relies on the EU-US Data Privacy Framework and standard contractual clauses. I do not sell your data. This page names any other service.
Your rights
- You can ask for a copy of your data.
- You can ask me to correct it, delete it or stop using it.
- You can ask me to move it to another service.
- You can object to how I use your data.
- You can take back a consent at any time.
- Write to the address above. I answer within 30 days.
- If the request is about an account, write from the email address of that account. This shows me it is you.
- You can also clear the data of this site in your browser. That removes what the page keeps there.
Complaints
If you are not happy, you can complain to a data protection authority. In the EU, this is the authority of your country. In the United Kingdom, it is the ICO. In Canada, it is the Office of the Privacy Commissioner of Canada. For Alberta, it is the Office of the Information and Privacy Commissioner of Alberta. In Saudi Arabia, it is SDAIA. I would like to answer you first.
Children
This tool is not for children under 13, or under 16 in the EU without a parent's permission. If a child gave me data, write to me. I will delete it.
If you collect data about other people
You may use this tool to collect data about other people, such as joiners, customers, guests or signers. You then decide why and how. You must tell them, and you must have a lawful reason. I use that data only to run the tool for you, as your processor. I use it for nothing else.