Privacy
Elo Ladder is a small app run by Tommy, free to use (a paid Office plan for a league is coming). This is everything it keeps, who sees it, and why. No ads, no tracking, and nothing is sold.
What Elo Ladder keeps
- Your account: your name, your email address and your password (stored scrambled, so nobody can read it).
- Your leagues: the leagues you make or join, the name you go by in each, and every result you or others record, with the ratings they lead to.
- Guests: when someone adds you to a league as a guest, the name they type for you and your results. If you claim the guest with your own account, they become yours.
- The demo league: the names typed there and the games recorded, which anyone can see at /demo. Each Monday the table starts afresh and last week's are deleted (the next time anyone opens it); they're never in backups, and Tommy can remove a name sooner. Don't type a full name you'd rather keep private.
- Signing in: the internet address and browser you sign in from, kept by Supabase with your sign-in to keep it safe.
- Feedback you send: it goes to our GitLab (the project where Elo Ladder's work is planned, which only Tommy can see) with your name, email, phone and browser, the page you were on and any pictures you add. Elo Ladder keeps its copy for 90 days; the pictures go once GitLab has them.
- News you've closed: which of Elo Ladder's announcements you've closed, so each shows you only once. It goes with your account.
- Logs: what the server did and what went wrong, to fix problems. They're kept small and overwritten as they fill up.
- Error reports: when something breaks, on the server or in your browser, what failed, on which page and in which browser, so Tommy hears about it. Email addresses, internet addresses, passwords and links' codes are taken out first.
Cookies keep you signed in and remember your theme on that device (the list). There's no analytics.
You need to be 13 or over to create an account.
Who sees it
- People in your leagues: your name there, your rating, form and results.
- Anyone with a league's table link or QR code, or a result someone shared: the names and results in that league. A league member chooses to share these, for example in a group chat. Chat apps keep their own copy of a shared score card, which Elo Ladder can't delete.
- Anyone with an invite or guest link: the league's name, how many play, and the name of whoever made the league or added the guest.
- Tommy, who runs Elo Ladder, can see the database to fix problems.
- No other player ever sees your email address.
Who handles it for Elo Ladder
- Supabase runs the database and signing in, in Stockholm.
- GitLab holds the feedback you send.
- Resend sends the one email Elo Ladder sends: a password reset link, from elo@tapps.vip, when a reset is asked for your address. Supabase hands it your email address to send it.
- Cloudflare carries the traffic to and from Elo Ladder, and keeps its encrypted backups.
- Google Cloud keeps Elo Ladder's error reports (emails and internet addresses taken out first).
- The app runs on a server in the EU (Helsinki, at Hetzner). Supabase, GitLab, Resend, Cloudflare and Google are US companies.
How long
- Your account: until you delete it. Your results stay in their leagues after that, as "Former player".
- Backups (encrypted, so only Tommy can open them, for when something goes wrong): 30 days at Cloudflare, and the last week's on the server. A deleted account ages out of them, and of the services' logs, within about 30 days. If a backup ever has to be restored, accounts deleted since are deleted again.
- Error reports: 30 days at Google Cloud.
Cookies
Only ones Elo Ladder needs to work, so there's nothing to accept. No tracking or advertising cookies.
- elo-ladder-auth keeps you signed in. It lasts 400 days and goes when you sign out. A long sign-in can split it into parts (elo-ladder-auth.0, .1).
- elo-ladder-auth-code-verifier, elo-ladder-auth-flows-code-verifier and elo-ladder-auth-flow-…-code-verifier (one per sign-up, with a random code in the name) are set when you create an account, as part of signing in safely. They go when you sign out, and last at most 400 days.
- elo-theme remembers the theme you picked on that device. It lasts a year.
Your browser also keeps a few things on your device, not sent anywhere: each league's look, whether you closed the install bar, and an unsent feedback draft until you close the tab.
Questions, or your data
Delete your account yourself, in Settings → Delete your account. Your name and email are deleted from Elo Ladder straight away; the services' logs and the backups age out within about 30 days. Your games stay in each league as "Former player", so nobody's rating changes. A league you made passes to the player who's been in it longest with an account; if nobody else has one, the league is deleted with it. To leave one league, use Leave league at the foot of its page: your games stay there the same way.
Ask Tommy, who runs Elo Ladder, at contact@tapps.vip for a copy of what it has about you, or to correct or delete it. Added as a guest without an account? Ask whoever runs your league to pass it on, or to rename or remove you.
You can also complain to the Information Commissioner's Office (ico.org.uk).