Privacy Policy

Last Updated: October 27, 2026

This policy explains who is responsible for your personal data on BracketDraw, what we collect, why we use it, how long we keep it and what rights you have.

This Privacy Policy explains how we process personal data when you use bracketdraw.com, create or view tournaments, embed a tournament on another website or contact us.

It applies to everyone who uses BracketDraw, wherever they live. This policy is for your information: where we need your consent, for example for analytics cookies, we ask for it separately.

Privacy at a Glance

We never sell your personal data
Analytics runs only if you allow it in the cookie banner
Tournament pages are not indexed by search engines
You can delete your account at any time in Settings

1. Information We Collect

We collect only the data we need to run the Service:

Information You Provide

Account. If you create an account: your email address and, optionally, your name. If you sign in with Google, we receive your name, email address and profile picture from Google.
Reviews. If you post a review: your rating, review text and display name, linked to your account.
Messages to us. If you use the contact form: your name, email address, subject and message. If you email us directly: your email address and message.

Tournament Data

Tournaments. Tournament names, team and participant names, match results and design settings you enter. If you create a tournament without an account, your browser keeps an owner key that lets you manage it.
Participant names. Organizers may enter the names of other people. See “Public Tournament Pages and Participant Names” below.

Information Collected Automatically

Technical data. IP address (stored mostly in salted and hashed form), browser and device type, sign-in attempts, a record of changes to tournaments and results, and error reports.
Analytics. Only if you accept analytics cookies: the pages you visit and how you use them, collected by Google Analytics. Without your consent, Google Analytics is not loaded.
Embeds. When a tournament is embedded on another website, we record the domain name of that website, not who its visitors are. The embed sets no cookies and loads no analytics.

We do not ask for sensitive data, such as health information, and we do not need contact details of tournament participants.

2. How We Use Your Information

We use your data only for the purposes below, grouped by their legal basis under Article 6(1) of the GDPR. How long we keep the data is described in “Data Retention”.

To provide the Service, based on our contract with you (Art. 6(1)(b)):

Run your account and let you sign in by email link or with Google.
Create, display and manage tournaments, including public pages, embeds and exports.
Publish reviews you submit.

For our legitimate interests (Art. 6(1)(f)). You can object to this processing at any time:

Show participant names on tournament pages.
Keep the Service secure, prevent abuse and enforce usage limits.
Detect and fix errors.
Answer your messages and requests.

With your consent (Art. 6(1)(a)). You can withdraw it at any time in “Cookie preferences”:

Understand how the website is used and improve it.

Automated Decision-Making

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Seeding and scheduling are calculations that you start and control.

4. Cookies and Tracking

We use only the cookies and browser storage listed below. Cookies that are not strictly necessary are set only after you accept them.

Strictly Necessary Cookies and Storage

These are needed for sign-in, your settings and managing tournaments, so they do not require consent.

Strictly Necessary Cookies and Storage
Name	Purpose	Duration	Consent
bd_jwt	Keeps you signed in to your account	30 days	Not required (strictly necessary)
authjs.session-token	Keeps your session in the web app	30 days	Not required (strictly necessary)
authjs.csrf-token, authjs.callback-url	Protect sign-in against cross-site request forgery and return you to the right page after signing in	Until you close your browser	Not required (strictly necessary)
NEXT_LOCALE	Remembers the language of the website	Until you close your browser	Not required (strictly necessary)
bd_consent	Remembers your cookie choices	1 year	Not required (strictly necessary)
bdot (cookie and local storage)	Lets you manage tournaments you created without an account	1 year (cookie); until you clear your browser data (local storage)	Not required (strictly necessary)
bracketdraw-theme	Remembers the light or dark theme you chose	1 year	Not required (set when you choose a theme)
bd_view_… (session storage)	Counts a tournament view only once per browser tab	Until you close the tab	Not required (strictly necessary)

Name
bd_jwt
Purpose
Keeps you signed in to your account
Duration
30 days
Consent
Not required (strictly necessary)
Name
authjs.session-token
Purpose
Keeps your session in the web app
Duration
30 days
Consent
Not required (strictly necessary)
Name
authjs.csrf-token, authjs.callback-url
Purpose
Protect sign-in against cross-site request forgery and return you to the right page after signing in
Duration
Until you close your browser
Consent
Not required (strictly necessary)
Name
NEXT_LOCALE
Purpose
Remembers the language of the website
Duration
Until you close your browser
Consent
Not required (strictly necessary)
Name
bd_consent
Purpose
Remembers your cookie choices
Duration
1 year
Consent
Not required (strictly necessary)
Name
bdot (cookie and local storage)
Purpose
Lets you manage tournaments you created without an account
Duration
1 year (cookie); until you clear your browser data (local storage)
Consent
Not required (strictly necessary)
Name
bracketdraw-theme
Purpose
Remembers the light or dark theme you chose
Duration
1 year
Consent
Not required (set when you choose a theme)
Name
bd_view_… (session storage)
Purpose
Counts a tournament view only once per browser tab
Duration
Until you close the tab
Consent
Not required (strictly necessary)

Analytics Cookies

These are set only after you accept analytics in the cookie banner or in “Cookie preferences”.

Analytics Cookies
Name	Purpose	Duration	Consent
_ga, _ga_…	Google Analytics: tells visitors and sessions apart	Up to 2 years	Required: set only after you accept analytics

Name
_ga, _ga_…
Purpose
Google Analytics: tells visitors and sessions apart
Duration
Up to 2 years
Consent
Required: set only after you accept analytics

Do Not Track and Global Privacy Control

If your browser sends a Global Privacy Control (GPC) signal and you have not made a cookie choice yet, we treat the signal as a refusal of analytics cookies: we do not show the cookie banner and do not load Google Analytics. A choice you make yourself in “Cookie preferences” takes priority.

We do not respond to Do Not Track (DNT) signals separately, because analytics runs only with your consent. We do not allow third parties to track you across other websites through BracketDraw.

Managing Your Choices

You can change your choice at any time:

You can also delete cookies in your browser settings. Without the strictly necessary cookies, signing in and managing tournaments will not work.

5. Data Security

We protect data with encrypted connections (HTTPS) and access controls. Sign-in links, owner keys and API keys are stored only as hashes, and IP addresses are stored mostly in hashed form.

No method of transmission or storage is completely secure. If a personal data breach is likely to put your rights at high risk, we will inform you and the supervisory authority as the law requires.

6. Data Retention

We keep personal data only as long as we need it for each purpose:

Account. Until you delete your account. Sign-in links expire after 15 minutes. Accounts whose sign-in was never completed are deleted after 7 days.
Tournaments. Until the tournament is deleted. Deleted tournaments are hidden at once; we erase them from our database on request.
Participant names. As long as the tournament, or until the name is removed at the participant’s request
Security data. Usage-limit counters: up to 1 hour. Security logs: as long as needed to protect the Service; you can ask us to delete them earlier.
Error reports. Deleted automatically by our error monitoring provider after its retention period, no longer than 90 days
Reviews. Until you or we delete the review, or you delete your account
Messages to us. Up to 12 months after we answer, unless we need the message to handle a legal claim
Analytics. Event data up to 14 months in Google Analytics; cookies up to 2 years

In addition:

When you delete your account, your profile, sessions and reviews are deleted immediately and your tournaments are hidden from public view. Hidden tournaments stay in our database until you ask us to erase them.
When you delete a tournament or remove a participant, it disappears from public pages immediately, but a copy remains in our database. Contact us if you want it erased completely.
Security logs do not have a fixed retention period yet. We are introducing automatic deletion and will update this policy when it starts. Until then, we delete them on request unless we need them to deal with abuse.

7. Your Privacy Rights

Wherever you live, you have the following rights:

Access and portability. Email us to get a copy of your data. We send it in a machine-readable format (JSON).
Correction. Change your name in Settings. Email us to correct anything else.
Deletion. Delete your account in Settings, or email us to erase specific data, including deleted tournaments and security logs.
Restriction and objection. Email us and tell us what you object to. We stop unless we have compelling legitimate grounds or need the data to handle a legal claim.
Withdrawing consent. Open “Cookie preferences” at any time. Withdrawing consent does not affect processing that took place before.

Send requests to support@bracketdraw.com. We answer within one month. If a request is complex, we may extend this by up to two further months and will tell you why. We may ask you to confirm your identity, for example by writing from the email address of your account.

8. International Data Transfers

Our service providers are located outside the European Economic Area, in the United States. We rely on these safeguards:

For providers certified under the EU-US Data Privacy Framework: that Framework.
For other providers: Standard Contractual Clauses approved by the European Commission, included in their data processing terms.

You can ask us for more information about these safeguards using the contact details above.

9. Children's Privacy

BracketDraw is not intended for children under 13. You must be at least 13 years old to create an account or a tournament.

This age limit applies to the person who creates the account or tournament, not to tournament participants. A teacher, coach or parent can create a tournament for a school or youth event.

If you believe a child under 13 has given us personal data, contact us and we will delete it.

If you are under the age at which you can consent to analytics cookies in your country (up to 16 in some EU countries), ask a parent before accepting them in the cookie banner.

10. Changes to This Policy

We may update this policy when the Service or the law changes. We will publish the new version on this page and update the date at the top.

11. Advertising

BracketDraw does not currently show advertising and does not use advertising cookies or tracking pixels. If we start showing ads, we will update this policy before they appear and ask for your consent where the law requires it.

12. Contact Us

For any question about this policy or your data, contact us:

support@bracketdraw.com

Data Controller

The controller of your personal data is the operator of BracketDraw. Email for privacy requests: support@bracketdraw.com.

13. Regional Privacy Rights

The rights in “Your Privacy Rights” apply to everyone, wherever you live. This section adds information for specific regions.

European Economic Area, United Kingdom and Switzerland

The legal basis for each use of your data is listed in “How We Use Your Information”. You have the rights of access, rectification, erasure, restriction, data portability and objection, and you can withdraw consent at any time, as described in “Your Privacy Rights”.

You can lodge a complaint with a data protection supervisory authority in the country where you live, where you work or where the alleged infringement took place. We would appreciate the chance to address your concern first, so please consider contacting us before you complain. Safeguards for transfers outside these regions are described in “International Data Transfers”.

United States

Some US state privacy laws, such as those of California, give residents rights over their personal information. We offer the rights in “Your Privacy Rights” to everyone, including the right to know what personal information we hold, to get a copy, to correct it and to delete it.

We collect these categories of personal information: identifiers (email address, name); internet or other electronic network activity (pages visited and interactions, only with your consent to analytics); and approximate location derived from your IP address (only with your consent to analytics). We do not collect sensitive personal information. Sources, purposes and recipients are described in “Information We Collect”, “How We Use Your Information” and “Information Sharing and Disclosure”.

We do not sell personal information and do not share it for cross-context behavioral advertising.

We will not treat you differently for exercising your rights. You may use an authorized agent to make a request; we may ask the agent for proof of authorization and ask you to confirm your identity.

How we respond to Global Privacy Control and Do Not Track signals is explained in “Cookies and Tracking”.