Privacy Policy

1.1 Account Information

When you create an account on Tournament Land, we collect:

• Email address (required for account creation and verification)
• Username (automatically generated)
• Password (stored as encrypted hash using bcrypt)
• Country (automatically gathered)
• Profile avatar/image (optional)
• Account role (Player, Organizer, or Admin)

1.2 Gaming Platform Accounts

When you link external gaming accounts to Tournament Land, we collect:

• Platform identifiers (Steam ID, Epic Games ID, Battle.net ID, Discord ID, Xbox ID, PSN ID)
• Platform usernames
• Rank and skill rating data (MMR, tier, leaderboard position)
• Game-specific statistics from external APIs (e.g., OpenDota, Steam Web API)

1.3 Tournament and Gameplay Data

During your participation in tournaments, we collect:

• Tournament registrations and participation history
• Match results, scores, and placements
• Game statistics (kills, deaths, assists, gold per minute, experience per minute, items, hero selections)
• Match metadata (duration, game mode, lobby IDs, external match IDs)
• Team affiliations and roles within teams
• Win/loss records and performance metrics
• Skill scores (strategy, mechanics, teamwork, communication, leadership, adaptability)

1.4 Financial Information

For payment processing and prize distribution, we collect:

• In-app wallet balance
• Transaction history (deposits, withdrawals, entry fees, prizes, refunds)
• Payment gateway transaction IDs (we do NOT store credit card details directly)
• Prize queue information (amounts, statuses, release dates)

Note: All payment card details are processed and stored by our third-party payment processors (Zarinpal, Zibal). We never have access to your full credit card information.

1.5 Communication Data

When you interact on our platform, we collect:

• In-app messages and chat conversations
• Support ticket messages and communications
• In-app notifications
• Team invitations and responses
• Friend requests and social connections

1.6 Social and Team Information

• Team memberships and roles (Captain, Member)
• Team names, logos, and descriptions
• Friend connections and social graph
• Player profiles (bio, experience level, availability, preferred positions)
• Team position applications and openings
• Referral relationships (who referred you, who you referred)

1.7 Technical and Session Data

• Session tokens and authentication cookies
• JWT tokens for API authentication
• Login/logout timestamps
• Email verification status and tokens
• OAuth tokens (for Google login)

1.8 Moderation and Safety Data

• User reports (reporter, reported user, reason, evidence)
• Ban information (reason, date, banned by)
• Dispute and review notes
• Moderation actions taken

1.9 Uploaded Media

• Avatar images
• Team logos
• Tournament banner images
• Image metadata (file size, MIME type, upload timestamp)

2.1 Service Delivery

• Create and manage your account
• Authenticate your identity and maintain session security
• Process tournament registrations and match participation
• Generate brackets and matchmaking based on skill ratings
• Track match results and player statistics
• Manage in-game lobbies and automate result ingestion

2.2 Financial Operations

• Process entry fees and tournament registrations
• Distribute prizes to tournament winners
• Maintain wallet balances and transaction records
• Prevent fraud and ensure payment security

2.3 Communication

• Send tournament notifications and match reminders
• Provide customer support and respond to inquiries
• Deliver important platform updates and announcements
• Facilitate in-app messaging and team coordination

2.4 Platform Improvement

• Analyze platform usage and performance
• Improve matchmaking algorithms and skill calculations
• Develop new features and enhance user experience
• Debug technical issues and maintain platform stability

2.5 Safety and Compliance

• Enforce our Terms of Service and community guidelines
• Investigate and respond to user reports
• Prevent cheating, fraud, and abuse
• Comply with legal obligations and law enforcement requests

4.1 Service Providers

• Payment Processors: Zarinpal, Zibal (for processing deposits and withdrawals)
• Email Service: SMTP provider (for account verification and notifications)
• Cloud Infrastructure: Vercel (hosting), Vercel Postgres (database)
• Authentication: Google OAuth (if you choose to sign in with Google)

4.2 Gaming Platforms

We retrieve data from external gaming APIs to verify ranks and import match results:

• Steam/OpenDota: Dota 2 match history, rank data, and player statistics

4.3 Public Information

The following information is publicly visible on your profile and leaderboards:

• Username and avatar
• Tournament placements and statistics
• Team affiliations
• Leaderboard rankings
• Win/loss records

4.4 Legal Requirements

We may disclose your information if required by law, such as:

• Responding to court orders or legal processes
• Protecting our rights, property, or safety
• Preventing fraud or criminal activity
• Complying with tax and financial regulations

4.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change.

6.1 Access and Portability

• Request a copy of your personal data in a machine-readable format
• View your transaction history, match records, and profile information within your account dashboard

6.2 Correction

• Update your profile information, username, and avatar at any time
• Request correction of inaccurate data by contacting support

6.3 Deletion

• Request deletion of your account and associated personal data
• Note: Some data may be retained for legal compliance (e.g., transaction records for tax purposes)
• Match results may be anonymized rather than deleted to preserve competitive integrity

6.4 Restriction and Objection

• Object to processing of your data for marketing purposes
• Request restriction of processing while we investigate a complaint

6.5 Withdraw Consent

• Unsubscribe from marketing emails (using the link in emails)
• Disable notifications in your account settings
• Revoke OAuth permissions for linked accounts

6.6 Lodge a Complaint

If you believe we have violated your privacy rights, you have the right to lodge a complaint with your local data protection authority.

8.1 Cookies We Use

• Authentication Cookies: Session tokens to keep you logged in (30-day expiration)
• Security Cookies: CSRF tokens and origin validation

8.2 What We Don't Use

We do NOT use:

• Google Analytics or similar third-party analytics
• Advertising cookies or tracking pixels
• Social media tracking (Facebook Pixel, etc.)
• Heatmapping or behavioral analytics tools

8.3 Managing Cookies

You can control cookies through your browser settings. However, disabling authentication cookies will prevent you from logging in.