Privacy Policy
Draft policy. Have it reviewed by a legal professional before treating it as your policy of record. Last updated: 2 September 2026.
Data controller
The controller responsible for your personal data is Jonatan Westner, operator of DartBracket. You can reach the controller through the Contact link in the footer.
What we process
Account data (email address and display name, supplied by your sign-in provider or entered when you create an email account); tournament data you create (tournament titles, player aliases, boards, matches, scores and live-match state); invite codes and board codes generated by the service; friendships and friend requests between accounts (your downloadable data export includes the display names and friendship dates of your accepted friends); tournament invites sent to your friends; season standings entries (your display name and aggregate points); and any details you voluntarily send through the contact form.
Authentication
You can sign in with a Google account (OAuth) or with an email address and password. When you choose Google, Google shares the email address, name and profile picture URL associated with your Google account where you have made those available, and Google's own terms and privacy policy apply to that part of the processing. With an email account, your password is stored only as a cryptographic hash by our authentication provider, and password-reset links are sent to your email address on request.
Why, and on what legal basis
Your data is processed solely to authenticate you and to run the tournament features you asked for. The legal basis is performance of a contract (Art. 6(1)(b) GDPR) for account and tournament functionality, and legitimate interests (Art. 6(1)(f) GDPR) for keeping the service secure and answering contact requests. We do not sell your data, share it with third parties for marketing, or use it for profiling or advertising.
Who can see it
Tournament participants see the roster, groups, bracket, matches and results of the tournaments they take part in. Anyone with a board code or live-match link you share can see that match's live scoreboard. Season leaderboards are publicly visible and show your display name and aggregate points. Other signed-in users can find you by searching your display name in order to send you a friend request. Contact messages are visible to DartBracket admins so they can reply to your request. Data is stored on our hosting and database provider, which processes it on our behalf under a data processing agreement.
Local data
Unsaved quick matches are stored only in your browser's localStorage so you can resume them if you refresh the page or navigate away. They are cleared when the match finishes, is reset, is exited, or when you start a new match. Your browser also briefly stores a return destination (for example an invite or board link you opened while signed out) in localStorage so we can send you back there after sign-in; it is discarded once used and expires after about ten minutes. This data never leaves your device.
Storage and retention
Data is stored on access-controlled servers with database-level access rules and encryption in transit. Account and tournament data is kept for as long as your account exists; deleting a tournament removes its players, boards and matches. Contact messages are kept only as long as needed to handle your request. When you delete your account from your Profile page, your personal data is anonymised: your player aliases become "Deleted User" and your profile is scrubbed, while tournament records remain intact for the other participants.
Your rights
You have the right to request access to the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to processing, and to receive a copy in a portable format. The "Download my data" button on your Profile page gives you such a copy immediately; the export contains your own data plus other people's display names only where needed (accepted friends, opponents in your matches), and never their email addresses or account identifiers. Anything not covered there can be requested through the Contact link, and we will respond within one month. You can also initiate deletion yourself at any time from the Profile page. You also have the right to lodge a complaint with your local data protection supervisory authority.