Privacy Policy

Gauntlet (https://gauntletbrackets.com) is a tournament bracket service operated by the independent operator of gauntletbrackets.com, trading as Gauntlet. For privacy requests, email privacy@gauntletbrackets.com. We do not publish a personal legal name on this site; the contact address above is the channel for data-protection matters.

This policy explains what personal data we process when you visit gauntletbrackets.com, create an account, run or join a tournament, use the API, or embed a bracket. It applies alongside our Terms of Service and Cookie Policy.

Account data. If you register: email address, username, optional display name, password (stored only as a hash by our auth provider), and optionally Discord profile details (such as Discord user id, display name and avatar URL) when you sign in or link Discord.

Tournament content. Names, games, descriptions, entrant/team names, seeds, results, signups, admin assignments, webhook URLs you configure, and API keys you create (we store a hash and a visible prefix, never the full secret after minting).

Entrant magic links. Each entrant may receive a one-time-style access token. Redeeming it sets a browser cookie so that entrant can report results for their matches. We do not require entrants to create accounts.

Technical data. IP address and related request metadata used for rate limiting, abuse prevention, security logs and (if you accept analytics cookies) privacy-oriented page analytics. Server logs may retain request paths and status codes for a limited period.

Public content. Public tournaments and their brackets may be listed in Browse and fetched via the API or embeds. Unlisted tournaments stay link-only; private tournaments stay restricted to authorised viewers.

Under the UK GDPR / EU GDPR we rely on:

• Contract — to create and run your account, tournaments, embeds and API access you request.
• Legitimate interests — to secure the service, prevent abuse, debug failures, and keep necessary session cookies working. Where we rely on legitimate interests we balance them against your rights.
• Consent — for optional analytics cookies. You can withdraw consent at any time via the Cookie Policy controls or by clearing site data and choosing again.
• Legal obligation — where we must retain or disclose information to comply with law.

Necessary cookies keep sessions and entrant magic-link credentials. Optional analytics cookies load only after you accept them. Details are in the Cookie Policy.

We use processors that help us run the service:

• Supabase — authentication and PostgreSQL database hosting.
• Discord — when you choose Discord sign-in or account linking (subject to Discord's own terms and privacy policy).
• Umami (optional) — privacy-oriented analytics, only if you accept analytics cookies and analytics is configured for this deployment.
• Hosting / network providers — infrastructure that delivers gauntletbrackets.com (for example a VPS and reverse proxy).

We do not sell personal data. We may disclose information if required by law, or to protect the service, users or others from harm or abuse.

Our processors may store or process data in the UK, EU/EEA, United States or other countries. Where required, transfers rely on appropriate safeguards such as the processor's standard contractual clauses or equivalent mechanisms described in their documentation.

Account and tournament data is kept while your account remains active and for a reasonable period afterwards if needed for backups, dispute resolution or legal compliance. You may delete tournaments you own from the product. To delete an account and associated personal data, email privacy@gauntletbrackets.com. We will delete or anonymise personal data unless we must keep a limited record (for example abuse prevention or legal claims). Server and security logs are rotated on a shorter cycle.

Depending on where you live (including the UK and EEA), you may have rights to access, rectify, erase, restrict or object to certain processing, and to data portability. Where processing is based on consent, you may withdraw consent at any time. You may also lodge a complaint with your local supervisory authority (in the UK, the ICO).

To exercise rights, email privacy@gauntletbrackets.com. We may need to verify the request relates to the correct account.

You may use Gauntlet if you are 13 or older. If you are under 13, do not create an account or submit personal data. If you believe we hold data about someone under 13, contact us at privacy@gauntletbrackets.com and we will delete it.

We use HTTPS, httpOnly session cookies, hashed API secrets, and access controls on private brackets. No method of transmission or storage is perfectly secure; please protect your password and API keys.

We may update this policy from time to time. The "Last updated" date at the top will change when we do. Continued use after an update means you acknowledge the revised policy.