Privacy policy

Last updated 6 November 2026 · Controller: Brightstep Tech Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA · Contact: [email protected]

Summary: besides your tournaments, we keep a log of the requests made to the tools (for example the title, format, player names and results sent) for 90 days, to find and fix errors and improve the tool. The log is not linked to your name, account or IP address, and it is never sold or shared.

What we store

• Tournaments: the title, the format and its options, the player or team names you enter, the draw, and the results and scores you report, with the time of each change.
• Organizer identifier: when you use Tournament Bracket Maker in ChatGPT, OpenAI sends us an anonymized user identifier. We store it with your tournaments so only you can list, update or delete them. It does not reveal your name or email.
• Manage secret: a random code in your private manage link that lets whoever holds the link enter results without the chat.
• Usage statistics: for each request we record the hour, which feature was used, whether it worked, which assistant made the call (Claude, ChatGPT or other, from the request's technical headers, plus the app name it declares), the country and language ChatGPT reports, and a one-way hash of the anonymized identifier. We use this only to count usage and fix problems, and delete it after 90 days.
• Request log: what each tool call sent (the tool's input, such as the title, format, player names, scores and results), with the minute, the tool name, whether it worked and which assistant made the call; long text is kept only as its length. It is kept for 90 days, also after the tournament itself is deleted, and used only to find and fix errors and improve the tool. It is not linked to your name, account or IP address, and it is never sold or shared.

What we do not collect

No email addresses, phone numbers, accounts, contacts, chat history, cookies or advertising identifiers. We do not log IP addresses or user agents; a short-lived in-memory counter per IP address limits abuse and is never written to disk.

Why we process it (legal bases)

• Creating, updating and showing your tournaments: Art. 6(1)(b) GDPR (providing the service you request). Names of players you enter: Art. 6(1)(f) GDPR; the legitimate interest is the organizer's and players' interest in running the event.
• Request log and anonymous usage statistics: Art. 6(1)(f) GDPR; our legitimate interest is to run the service, count usage, and find and fix errors.
• Security, abuse protection and rate limiting, including Cloudflare transit: Art. 6(1)(f) GDPR; our legitimate interest is to keep the service secure and available.

Who can see a tournament

Anyone with a tournament's public link can see its title, the names and the results. The link is a random code that is not listed or indexed by search engines, but it is not password-protected: share it only with your group. Use first names or nicknames, and do not enter contact details or other personal information about players. Do not enter the names of children under 13.

How long we keep data

A tournament and everything in it is deleted automatically 60 days after its last change (creation, a result or an edit). The organizer can delete it at any time by asking the assistant (Claude or ChatGPT) or with the button on the manage link; the public link then stops working. Entries in the request log are deleted 90 days after the call; if you want yours removed sooner, email us the tournament link or the names and we will delete them.

Processors and sharing

Data is stored with Amazon Web Services (Frankfurt, EU) (privacy notice). Requests to this service pass through Cloudflare, Inc. (content delivery network and TLS proxy), which processes the connecting IP address and the request data in transit to deliver them to our server; Cloudflare may process this data outside the EU (privacy policy). Apart from these processors and the people you share the public link with, no third party receives tournament data. The server is in the EU (AWS, Frankfurt). Cloudflare operates a global network, so request data in transit may be processed outside the EU/EEA, including in the USA; such transfers rely on the EU-US Data Privacy Framework where the recipient is certified, or on the EU Standard Contractual Clauses. We do not sell or share data, and we do not use it to train models.

Your rights

If your name appears in a tournament, you can ask the organizer to rename or delete it, or email [email protected] with the link and we will remove it. Under the GDPR you have the right to access, rectification, erasure, restriction of processing, objection (to processing based on legitimate interests) and data portability. Write to [email protected]. You can also complain to a supervisory authority, in particular in your country of residence.