Log in

Choose a language

Privacy Policy

As of: September 2026

1. Privacy at a glance

The following information provides a simple overview of what happens to your personal data when you visit this website or use our application. Personal data is any data that can be used to personally identify you.

2. Data controller

Christian Jäkl
Nesslbachweg 17
9551 Tschöran
Austria
Email: support@turniermeister.at

3. Hosting

Our website and application are hosted on a server in Germany. The server is operated by us. We do not keep access logs in which visitor data such as IP address, browser, operating system or referrer is stored. We process technical operation and error logs exclusively for error analysis and the security of our service (Art. 6(1)(f) GDPR, legitimate interest in secure, error-free operation).

4. Contact form

When you send us a message via the contact form on our website, the following data is transmitted:

  • Name
  • Email address
  • Message text

This data is used exclusively to process your enquiry and is not shared with third parties. The data is deleted after your enquiry has been resolved, unless statutory retention obligations apply. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

To protect against automated spam requests, we additionally process your IP address briefly when you submit (rate limiting per IP address) as well as technical verification values (invisible honeypot field, time-limited server-signed token, client-side proof-of-work check). If Cloudflare Turnstile is additionally enabled, section 6 applies. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in defending against abusive requests).

5. Authentication (Clerk)

For registration and login in our application, we use Clerk (Clerk, Inc., USA). Clerk enables login via:

  • Google account (OAuth)
  • Apple account (OAuth)
  • Email address

The following data is transmitted to or processed by Clerk:

  • Email address
  • First and last name
  • Profile picture (if provided by the OAuth provider)
  • Clerk user ID

Clerk stores this data on servers in the USA. The Clerk Privacy Policy applies. Data transfer to the USA is based on Standard Contractual Clauses (Art. 46(2)(c) GDPR). Legal basis: Art. 6(1)(b) GDPR (contract performance).

6. Bot protection (Cloudflare Turnstile)

To protect our sign-in and — if enabled — the contact form from automated requests, we use Cloudflare Turnstile, a service provided by Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA). Our authentication provider Clerk (see section 5) uses Turnstile as part of its bot protection ("bot sign-up protection") and only shows the challenge when a registration attempt is suspected to be a bot ("smart" challenge).

The following data is transmitted to Cloudflare:

  • IP address
  • User agent and browser characteristics (e.g. screen resolution, language settings)
  • Anonymised behavioural signals from your interaction (mouse/keyboard signals)
  • Cookie/token data used to verify the challenge

Cloudflare processes this data exclusively for bot mitigation and, according to its own statements, does not share personal data with third parties. Data is processed on servers worldwide, including in the USA. The Cloudflare Privacy Policy applies. Data transfer to the USA is based on Standard Contractual Clauses (Art. 46(2)(c) GDPR). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in defending against abusive requests and the secure operation of our service).

7. Data we store

In our database (PostgreSQL, server in Germany) we store the following personal data:

  • User ID, first and last name, email address
  • Profile picture URL
  • Selected plan (Demo or Premium) and subscription status
  • Payment information: Mollie customer ID, subscription ID, payment timestamps
  • Registration date and plan expiration date
  • User settings (e.g. display preferences)
  • Tournament data: tournaments, schedules, results, teams, participants
  • Tournament templates

This data is stored for as long as your account exists. When you delete your account, the deletion is initially scheduled only; you can undo it within 7 days. After that period your personal data is anonymised and subsequently fully deleted (see section 16). Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest).

8. Tournaments via AI assistant (MCP) and prepared tournaments

We offer a public MCP endpoint that lets AI assistants (e.g. Claude, ChatGPT, Cursor) prepare tournaments in Turniermeister. In this process we process the following data:

  • Tournament data from the assistant request: tournament name, competition type, team count and optionally team/player names you mentioned in the assistant chat.
  • Storage: team and player names are stored encrypted (AES-256-GCM) and can only be attributed via the personal claim link. Tournament name and structure data (competition type, team count) are stored unencrypted so the preview page can show which tournament is being claimed.
  • Retention: unclaimed prepared tournaments are fully deleted after 14 days — including all encrypted data.
  • Claiming: when you open the claim link and take the tournament into your account, the data is migrated into the regular tournament management and the encrypted record is deleted immediately. From that point on, the remaining sections of this privacy policy apply.
  • No access to assistant chats: we do not receive chat content — only the technically required tournament data. Processing inside the AI assistant follows the privacy policy of the respective provider.
  • Technical events: events such as “tournament prepared” are stored without personal reference. Events related to claiming (“tournament claimed”, “claim failed”) are stored without link token and without plain-text names, but linked to your user account (see section 11).

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in providing and safely operating this feature).

9. Payment processing (Mollie)

For payment processing, we use Mollie (Mollie B.V., Netherlands). When making a purchase or subscription, you are redirected to Mollie's checkout page. Mollie processes:

  • Email address
  • Payment information depending on the chosen payment method
  • Customer ID and subscription ID

The following payment methods are available: credit and debit card, Apple Pay, PayPal, eps, SEPA bank transfer, Google Pay, SEPA direct debit and Pay by Bank.

We do not store any credit card numbers or bank details. Mollie processes data on servers in the EU. The Mollie Privacy Policy applies. Legal basis: Art. 6(1)(b) GDPR (contract performance).

10. Real-time communication (WebSocket)

For live updates of tournament results, we use WebSocket connections (Socket.IO). Tournament data is transmitted in real time between server and browser. No additional personal data is collected.

11. Web analytics

Anonymous reach measurement (without consent): When you visit our website, we collect counter data (page visited, page title, language, website URL, device type broadly classified from the browser user-agent). No cookies, visitor IDs or session IDs are used, and no data is stored in your browser. For technical deduplication, the event idempotency key contains a random token limited to that page load; it is sent to and stored with the event on our server. It contains no IP address, referral or UTM information and is not reused on other pages. If you later give consent on the same page, our reports use this token once to associate the baseline counter with the consented page view; referral and UTM information from the consented event may then be included. Without subsequent consent, the baseline counter remains unassociated.

Detailed usage analytics (with consent): With your consent, we additionally collect pseudonymous usage data to improve our service. The following information is collected:

  • Page views and clicks on links to the application
  • A persistent visitor ID (stored in your browser) and a session ID (per browser session)
  • Referral information (referrer, UTM parameters, landing page)
  • Device information (broadly classified device type, language, referring website)

Pseudonymity, not anonymity: The visitor ID remains stored in your browser permanently. A random identifier alone does not achieve anonymity: when you move from the website to the application, the website transfers the visitor and session ID together with referral information in the target URL; the application adopts these identifiers and sends them along with further analytics events. As soon as you register or log in within the application, analytics events can be attributed to your user account. The detailed analytics is therefore personal data within the meaning of the GDPR.

Storage location, recipients and retention: The identifiers are stored in your browser (localStorage and sessionStorage) and transmitted to our own server in Germany. To operate lifecycle marketing campaigns, we transmit account lifecycle events (e.g. "subscription started") including your email address and user ID to the backend of our sister product else.events, which is also operated by us. There are no other recipients. Analytics events are automatically deleted after 730 days (2 years).

Consent and withdrawal: Detailed analytics only runs after you have given explicit consent via the consent banner. You can withdraw your consent at any time with effect for the future by clicking "Cookie settings" in the footer and selecting "Only necessary": the running analytics is terminated immediately – active transmissions are aborted, stored identifiers are removed from your browser and from already enriched links, and no consent-dependent data is collected or handed over to the application any further. The lawfulness of processing carried out prior to the withdrawal remains unaffected. Legal basis: Art. 6(1)(a) GDPR (consent); for storing the identifiers on your device, § 165 (3) TKG 2021 applies in Austria and § 25 TDDDG in Germany. A withdrawal in one open browser tab also takes effect in other open tabs of the website (comparison via the shared browser storage).

12. Local storage (localStorage)

We store the following technically necessary data in your browser's localStorage or sessionStorage:

  • Theme preference (light/dark mode)
  • Consent status (consent banner)
  • Language and further display settings
  • Cache for offline use as well as pending invitations and tournament claims
  • Pseudonymous analytics data (only with consent, see section 11)

This data serves exclusively to operate the application and can be deleted at any time via your browser settings.

13. Cookies

Our application uses cookies from Clerk for authentication (session management). These are technically necessary and cannot be disabled without limiting functionality. We do not use advertising or tracking cookies.

14. Your rights (Art. 15–21 GDPR)

You have the right at any time to:

  • Access (Art. 15 GDPR) – What data we have stored about you
  • Rectification (Art. 16 GDPR) – Correction of inaccurate data
  • Erasure (Art. 17 GDPR) – Deletion of your data
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR) – Export of your data in a common format
  • Objection (Art. 21 GDPR) – Against processing based on legitimate interests

To exercise your rights, contact us at support@turniermeister.at.

15. Right of withdrawal (consent)

Where the processing of your personal data is based on consent, you have the right to withdraw that consent at any time. The lawfulness of processing carried out prior to the withdrawal remains unaffected. You can declare your withdrawal by clicking "Cookie settings" in the footer and selecting "Only necessary", by using the online withdrawal form (for contractual withdrawals under § 11 FAGG), by clearing your browser data, or by sending an email to support@turniermeister.at.

16. Data deletion

When you delete your account, the deletion is initially scheduled only: the account remains usable for 7 days, and you can undo the deletion within that period. At your explicit request (“delete now”) the deletion happens immediately. After the period ends, your personal data is anonymised (name, email, profile picture) and a daily cleanup process then fully deletes the entire record including all tournament data. Any existing Mollie subscription is cancelled; as long as the cancellation has not been completed, the final deletion may be delayed until it is. Data held by third-party providers (Clerk, Mollie, Cloudflare) is handled according to their respective privacy policies.

17. Data security

Communication between your browser and our servers is exclusively encrypted via HTTPS/TLS. Access to our servers is protected by firewalls and SSH keys.

18. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority in Austria is:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna, Austria
www.dsb.gv.at

19. Changes

We reserve the right to update this privacy policy to reflect changes in the law or our service. The current version is always available on this page.

Choose original size to pan around the image.