Privacy Policy
Bracket Victory Director
This policy explains how this application handles information and how to contact us about privacy.
Information we process
Bracket Victory Director stores the tournaments you create or edit on your device, including tournament titles and dates, selected format and points rules, team names, colours, emblems and kits, player names and numbers, venue labels, fixtures, scores and match notes. The included School Rugby Cup is a labelled fictional example, not a record of actual pupils. Sound, haptic and language preferences are also stored locally. When you enable optional cloud backup, tournament snapshots and their modification times are sent to our backend. A random installation identifier and secret authenticate this device; the secret is held in the device Keychain and the server stores only a bcrypt hash. The service and Railway infrastructure receive network request information such as IP addresses, request time, route and response status. The app has no advertising or analytics SDK, account system, location collection or email delivery service. Visiting this policy or the public home page also sends ordinary network requests to our host; those pages do not require cookies or a login.
How we use information
Local data lets you organize rugby tournaments offline, build fixtures, detect scheduling conflicts, record results, calculate standings or brackets and prepare PDF reports. Optional cloud backup stores and reconciles tournament snapshots for the same installation. The installation identifier and secret protect access to those snapshots. Minimal operational information supports security, rate limiting, readiness and fault diagnosis. We do not use tournament data for advertising, profiling or marketing. You choose whether and with whom to share a locally generated PDF through the iOS share sheet.
Service providers and sharing
The backend and PostgreSQL database are hosted on Railway, which processes stored snapshots and infrastructure request information to provide the service. The application does not send tournament content to advertising, analytics, messaging or social login providers. Application error logs contain an operational code and request identifier rather than tournament payloads or installation secrets. Railway may maintain its own infrastructure logs under its hosting practices. A PDF is disclosed to the app or recipient you select in the system share sheet, and that recipient then handles its own copy. We may disclose information when legally required. No claim is made that hosting requests are anonymous or that no data is collected.
Data retention
Local tournament records remain until you delete them or remove the app's local storage. Cloud snapshots remain while stored for your installation until deletion is requested. Deleting a cloud tournament removes its snapshot from active storage and retains only an installation-scoped tournament identifier, modification time and deletion marker so an older offline copy does not restore it. Deleting all cloud data removes the installation row, secret hash, snapshots and deletion markers from the active database. No fixed retention period is promised for Railway infrastructure logs or any host-managed backup copies; their handling is subject to the hosting configuration and provider practices. The application does not configure a separate archival service or promise immediate erasure of host backups. Device or system backups and PDF copies you share may remain independently.
Deleting your information
Delete a tournament within the app to remove its local record and queue deletion of its cloud snapshot when backup is enabled. An offline deletion reaches the service only after a successful connection. Settings provides deletion of all cloud data, which requires a successful network request; disabling backup alone stops future synchronization and does not erase existing server records. Local records can be retained while cloud data is deleted. Separately delete local tournaments and any PDFs you saved or shared when you no longer need them. Removing the app does not itself send a server deletion request, and Keychain credentials may survive reinstallation according to iOS behaviour. If the installation secret is lost, we cannot promise restoration or identify the right private records from an email address alone. Privacy questions and deletion enquiries may be sent to chesterheneage@icloud.com.
Permissions and your choices
The app does not request camera, microphone, photos, contacts, location or notification permissions. Core tournament creation, editing, results and report generation work offline. Optional cloud backup requires a network connection and can be turned off in Settings. System sharing is initiated by you and uses the destinations you choose. You can change app preferences or available system permissions in iOS Settings; withdrawing network access or disabling backup does not delete snapshots already stored on the server.
Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal information, and to obtain a copy or complain to a data protection authority. You can review and correct tournament content in the app, export a report and request deletion through its controls. Contact chesterheneage@icloud.com about privacy rights or questions. We may need proportionate information to verify a request and locate installation-scoped data. We do not require an account or collect an email address to use the app, and email alone is not proof of access to an installation's private tournaments. Enter player information only when you are authorized to do so and avoid sensitive information in free-text fields.
Security
The production API uses HTTPS. Each installation has its own random secret, stored in the device Keychain; the server verifies a bcrypt hash and scopes database operations to that installation. Database credentials stay on the server and are not embedded in the app. The backend validates request sizes and key fields, uses parameterized PostgreSQL queries, basic request limits and private service-to-database networking. Local data relies on the iOS device's protections. No storage or network system can be guaranteed completely secure. Protect access to your device and exported reports. Installation secrets are not a cross-device account and are not recoverable through email.
Children’s privacy
This application is intended for adult school staff, sports organizers and parent volunteers, rather than for children to create accounts or submit their own information. Organizers may enter team rosters that include pupils' names and numbers. They are responsible for having an appropriate basis and any required permission to handle and share that information. Use minimal or non-identifying roster information where practical. We do not provide child accounts, advertising, behavioural tracking or public roster publication. Contact chesterheneage@icloud.com if you believe a child's information has been included inappropriately.
Changes to this policy
We may update this policy when the application's features, data processing or hosting practices change. The effective date shown on this page identifies the current version. Review the policy available from the app's Settings and this public page. Material changes will be reflected in an updated policy and, where appropriate, information in the app before new processing begins. The public privacy contact is chesterheneage@icloud.com.