Privacy Policy

1. Who this covers

Two kinds of people use MedalRound: tournament directors, who create and run events, and players, who browse events and register for them. This policy covers both. When you register for a tournament, the director who runs that tournament also receives your registration and keeps their own copy of it. For that copy the director decides how the information is used, and their own policies apply alongside MedalRound’s.

A MedalRound account is optional for players. You can register for a tournament and manage that registration from the link MedalRound emails you, without one. If you do make an account, on the web or in the app, it is the same account either way, and it shows you the registrations made with any email address you have verified on it. Deleting the account removes the account itself, as described in section 8; it does not cancel a registration or delete the copy the director holds.

2. What we collect

• Account informationYour email address (and any additional addresses you verify), how you sign in (email and password, Google, or Apple), your display name, and whether your address is verified. If you use Apple’s Hide My Email, your account address is the private relay address Apple issues. If you signed up from a link we sent you, which link that was. Your confirmation that you are 18 or older, and when you gave it.
• Registration detailsFirst and last name, email address, phone number, date of birth and gender where the tournament asks for them, self-reported skill rating and DUPR ID (optional), the divisions you enter, your partner, your acceptance of the tournament’s waiver, and your confirmation that you are 18 or older. On a registration a parent or legal guardian makes for a player under 18, these details are the player’s name, date of birth, and gender and rating where the tournament asks for them, and the parent or legal guardian’s own name and email address, which is the registration’s only contact, with their own phone number where the tournament asks for one. The player gives no email address, and the sign-up form asks for no DUPR ID.
• Your partnerIf you invite a partner by email, we use that address to send them the invitation. If you name a partner, we use the name you type to match your entry with theirs.
• Payment recordsThe amount, currency and status of each payment and refund, and the Stripe identifiers for them. Card details are entered on Stripe’s hosted checkout page. Card numbers never reach our servers and we never store them.
• Email delivery recordsFor each email we send you, the address, the subject, the message, when it was sent, and what happened to it afterward: whether it was delivered, bounced, was not sent because an earlier email to that address bounced or was marked as spam, or was marked as spam by you. Resend, our email provider, reports these to us. Section 8 says how long each part is kept.
• Invitation recordsWhen a tournament’s director has us email you an invitation to register, the name and email address the director entered, which the tournament’s director and co-directors see in the Invited list on the division’s Entries tab. For the Stop invitations from this tournament link and for our sending limits we keep a one-way code made from the address (not the address itself). Under that one-way code we keep the key that goes in each invitation’s Stop invitations from this tournament link and, if you asked to stop invitations, when you asked and whether you used that link or your email app’s own unsubscribe button. Under the same one-way code we count the invitations sent to each address, from each tournament and from each account that sends them. For each account that sends invitations we also keep the times, in the last 24 hours, that we looked up an address in the registrations for a director’s tournaments for that account’s invitations. These times do not include the address.
• Players a director addsA tournament’s director or co-director can add a player on the tournament’s Players page, with Add player or Import players, without a registration. MedalRound keeps what they enter: the first and last name, and the email address, rating, gender, DUPR ID, phone number and birthdate where they enter them. When the birthdate they enter makes the player under 18, or the player has no birthdate on file and is in a division whose ages include ages under 18, MedalRound keeps that player as section 11 says.
• Sign-ups by a parent or legal guardianFor each tournament, MedalRound keeps a one-way code made from the email address of each parent or legal guardian who signs up a player under 18, with a one-way code for each player signed up under it, when that player was last signed up and the registrations made for them. It counts these to hold one address to 8 players under 18 per tournament, as section 3 of the Terms of Service says.
• Helper invitationsWhen a tournament’s director invites a helper with Helpers, in the tournament’s Tournament actions menu, MedalRound keeps the invited email address, the role, whether the invitation is waiting, accepted or canceled, when it was sent, accepted and expires, and which account sent it. Once the invitation is accepted, MedalRound also keeps the helper’s email address, account and role on that tournament. The tournament’s director sees all of this in Helpers. To limit invitation emails, MedalRound keeps, under a one-way code made from each address, the invitations still open for it, and the times of the invitation emails sent in the last 24 hours from each tournament, to each address and from each inviting account.
• DUPR results filesEach time a tournament’s director or co-director downloads a DUPR results file on the Overview page’s Results card, MedalRound keeps a record of it: when and by whom, which divisions and matches it held, and the DUPR ID it wrote for each player. An older record can hold a player’s full name instead, where that file had no DUPR ID for the player. Only the tournament’s director and co-directors see it.
• Director notesWhat a director or co-director writes in the Notes box, under More details, when they add or edit a player on the tournament’s Players page, for a player who registered or one they added. Only the tournament’s director and co-directors see it.
• Moderation recordsWhen MedalRound hides or shows a tournament, holds, suspends or releases an account, or reviews a report, it keeps a record of what it did, when, and why, with any note it adds. When it looks up an email address to answer a player or a data request, it keeps a one-way code made from that address and the time of the lookup. Only MedalRound sees these records.
• Hosted by, About this tournament and club logosWhat a tournament’s director or co-director enters in Hosted by and About this tournament, and the club logo they upload under Club logo or copy there from another tournament they direct or co-direct, all in the Edit tournament dialog that Edit after the tournament’s dates and location opens. MedalRound keeps the logo as a new picture drawn from the uploaded file’s pixels, so details stored inside the file, such as where a photo was taken, are not kept. With the logo it keeps which account uploaded or copied it and when. Pressing Remove logo and then Save deletes the picture. To limit uploads, MedalRound keeps the times of the logo uploads and copies made in the last 24 hours for each tournament and for each account, and drops older times the next time a logo is uploaded or copied for that tournament or by that account. Section 5 says who sees these.
• Club pagesWhen a tournament’s director turns on a club page with Turn on club page, on the tournament Overview’s Link from your club website card, MedalRound keeps the club page address, the Hosted by name, which account turned it on, whether it is turned on, whether MedalRound has taken it down, the tournaments from other accounts that account added to it, and when it was made and last changed. For each account it keeps the club page addresses the account holds, so that one account holds at most 10. Section 5 says what a club page shows.
• Email sending limitsTo limit how many account confirmation emails, password reset emails and emails with a 6-digit code are sent to one address, MedalRound keeps a one-way code made from the address with the times of the emails sent to it in the last 24 hours. Under that kind of one-way code it also keeps the times of the emails that Update email and Resend registration page link, on a tournament’s Registration tab, sent to an address in the last 24 hours, from that tournament and from every tournament, and it keeps the times each account used those two in the last 24 hours. Older times are dropped the next time an email is sent to that address, or the next time that account uses one of those two. The counts kept under an address are not tied to an account, so deleting your account does not delete them, and an account’s own times stay after the account is deleted.
• Data requestsThe email address you confirm, the message you write and the time zone your browser reports when you use the Request your data form at medalround.com/account/delete, and when you sent it.
• Reports about a tournament pageIf you send a report with the Report this page link at the bottom of a tournament’s page, a division page or a sign-up page, MedalRound keeps what you wrote, the page and the time, and deletes the report one year after it was sent. The report is not tied to an account, so deleting your account or sending a data request does not find it. To limit how many reports come from one connection in a day, MedalRound also keeps a one-way code made from the IP address each report came from, with that day’s count of its reports. The first report saved on a later day, counted in UTC, replaces those codes and counts with that day’s.
• Error reportsWhen something on MedalRound breaks, MedalRound keeps a record of the error to fix it. Before the record is saved, email addresses, phone numbers, dates written without a time (such as a date of birth), the keys in links, the values in a link’s query other than the few that only name a tournament, a division, a tab, the Contact page’s topic or a returned payment, and quoted text that has a space, a capital first letter or an @ are removed from it. A name written outside quotes can stay in an error record. If a page on medalround.com breaks in your browser, your browser sends MedalRound an error report with the page address and the error, after the same details are removed. Error records are kept for 90 days after the error last happened, and only MedalRound can read them. MedalRound can also email an error record, with the same details removed, to its own inbox for error alerts, which deletes each of those emails 90 days after it arrives.
• Device and notification dataIf you turn on notifications in the app, the push token for that device, its platform (iOS or Android), the app version, and which notification categories you chose. For each notification it sends, MedalRound keeps the title, the text, the device tokens it went to and the account it was for, and deletes that record 7 days after it was made. It also keeps a count of the notifications sent to each account on each day.
• Technical logsOrdinary server records (IP address, browser or app user agent, and timestamps) kept for security, abuse prevention and troubleshooting.

We do not use advertising identifiers or run ad trackers, and we do not track you across other apps or websites. We count visits to our web pages with Vercel Web Analytics, which sets no cookies and does not follow you to other sites. For each counted visit, Vercel Web Analytics records the time, the page address, the page that linked to it, the country, region and city, the browser, the operating system and the type of device.

When you open a tournament’s sign-up form on the website, Cloudflare Turnstile checks that a person is using it. For this check Cloudflare receives your IP address and information about your browser and device.

3. How we use it

• Running registration, entry lists, schedules, scores and results.
• Running the checkout through which the director takes payment for tournament entries, and processing refunds under the director’s refund policy.
• Sending transactional email: registration confirmations, receipts, partner invitations and partner requests, waitlist notices, refund notices, registration page links, notices that a tournament was canceled or that a registration’s email address was changed, account confirmation and password reset emails, email confirmation codes, and invitations to help run a tournament. A director also gets an email about new sign-ups and cancellations in their tournament, and one when their tournament can take payments.
• Passing on messages a director writes to players in their tournament. Each one ends with the link Unsubscribe from director emails for this registration, which stops further director emails for that registration.
• Emailing an invitation to register for a tournament when its director asks us to, and sending no more from that tournament once you ask us to stop. We send one only to an email address already confirmed on a registration for a tournament run by that director. To decide this, we look up the address in the registrations for that director’s tournaments, past and current. When that director runs more than 100 tournaments, we search the registrations for every director’s tournaments for the address instead, and keep only the ones for that director’s tournaments.
• Sending the push notifications you turn on in the MedalRound phone app: when the desk calls your match to a court or takes it back, and when a registration, waitlist spot, partner or refund changes.
• Counting visits to our web pages, and how many accounts came from each link we sent and how many of those accounts created or published a tournament.
• Preventing fraud and abuse, and keeping accounts secure.
• Meeting our legal, tax and accounting obligations.

4. Who we share it with

• The tournament directorWhen you register, the director of that tournament receives your registration: name, email address, phone number, date of birth, gender, rating and DUPR ID where you gave them, your divisions and partner, your waiver acceptance, and the status of your payment. They need it to seed divisions, check you in, score your matches and keep their own event records. On the tournament’s Registration tab they also see whether the emails MedalRound sent you about that tournament arrived, and whether you marked the latest one as spam, so they can correct a mistyped address. If the director adds a co-director to the tournament, the co-director, signed in with their own MedalRound account, sees the same information. A helper the director adds with the Desk or Scorekeeper role, signed in with their own MedalRound account, sees your name, gender, rating, divisions, partner, matches, scores and check-in status, and does not see your email address, phone number, date of birth, DUPR ID, waiver acceptance, payment status or email delivery records. For a player under 18, a helper sees the first name and last initial, and no gender or rating.
• If you direct a tournamentMedalRound keeps your account, the tournaments you create and the ID of the Stripe account you connect. When you connect Stripe, MedalRound sends Stripe the email address of your MedalRound account and the ID of that account to open your Stripe account. The contact email you set for players is shown on the tournament’s public page and is the reply address on email about that tournament.
• StripePayments are taken as direct charges on the director’s own Stripe account. Stripe receives your email address and the card details you enter on its checkout page, and processes the payment under Stripe’s privacy policy. We never hold your money.
• DUPRFor a division that reports to DUPR, the director can download a results file and upload it to DUPR. It lists each match with its date, the tournament and division names, how games were scored and the scores, and each player’s name and DUPR ID: an adult’s full name, and the first name and last initial of a player under 18. A match with a player who has no DUPR ID is left out of it. Once it is uploaded, DUPR’s own privacy policy applies.
• Service providersGoogle (Firebase for sign-in, the database and Android push delivery, and Gmail for MedalRound’s own inbox for error alerts), Expo (push delivery), Resend (transactional email) and Vercel (hosting and page-visit counts). They process this information for MedalRound and for no other purpose.
• CloudflareCloudflare runs the check on the website’s sign-up form (section 2). It uses what it receives for that check and to improve the check, under Cloudflare’s Turnstile privacy notice.
• Legal reasonsWhen the law requires it, or where it is necessary to protect the rights, property or safety of players, directors or the public.

We do not sell your personal information, and we do not share it for advertising or cross-context behavioral advertising.

5. What is public

When a director publishes a tournament, anyone can open its pages and search engines may list them. Those pages show the names of the players entered, their divisions and partners, the schedule, scores, standings and medals. If you choose the partner board, your first name and last initial are shown there so another player can find you. The gender and rating you give are kept with your entry for seeding and eligibility, and anyone who opens the tournament can read them, although the pages do not display them. Your email address, phone number, date of birth and DUPR ID are never public.

Public pages (tournament, division, live board, results, medals and the phone app’s public views), partner emails and the partner board show a player under 18 as their first name and last initial only, whenever MedalRound counts the player as under 18 (section 11 says when it does). The public player record holds no date of birth, and for a player under 18 no gender or rating.

When a director or co-director adds a Hosted by name, an About this tournament text or a club logo to a tournament, MedalRound shows them to anyone once the tournament is published: all three on the tournament’s public page and in the MedalRound phone app, and the Hosted by name also in the tournament’s link previews, the details MedalRound gives search engines about it and its card on the MedalRound home page.

When a director turns on a club page for a tournament’s Hosted by name, MedalRound shows that name, the tournaments the page lists and a club logo to anyone at medalround.com/c/ followed by the address made from that name. The logo is the one on that director’s listed tournament with the latest start date. When the page lists none of that director’s tournaments, it is the one on that director’s published tournament with that Hosted by name and the latest start date, of those MedalRound has not hidden, or, when there is none, on the listed tournament with the latest start date. The page shows a logo only when that tournament has one. The name is also in that page’s title and description, which link previews and search results show. A club page lists the tournaments of the account that turned it on whose Hosted by name makes that address, and the tournaments of other accounts whose Hosted by name makes the same address once the club page’s account adds them. It lists a tournament only while that tournament is published and on the tournament list on the MedalRound home page, so it never lists a draft or a tournament MedalRound has hidden. A tournament leaves a club page when, for example, its director or a co-director changes its Hosted by name, unpublishes it or archives it before its last day of play ends, or when the club page’s account takes it off. A club page lists at most the 24 most recent past tournaments, so an older one leaves it.

6. What your browser keeps

MedalRound sets no cookies. Your browser keeps your sign-in and a copy of the tournament pages you open, so they still show when the signal drops. MedalRound no longer puts players’ contact details and birthdates in that copy. A copy saved by an older version of MedalRound can still hold them until that browser next keeps a MedalRound page open for a few seconds, which normally deletes them. The copy can also hold the DUPR IDs of players added to a tournament before September 11, 2026.

When a director restores a canceled division on the Divisions page and MedalRound cannot email some former players at the addresses they gave, the note about it on the Archived card names those addresses, and that browser tab keeps the note until the director presses Dismiss or signs out, or the browser ends the tab’s session.

A registration page you open is kept on that device for up to 14 days and never past the day after the tournament, and signing out removes it. A copy past that limit is deleted the next time that browser opens a page on medalround.com. That browser tab also keeps the key from the emailed registration link until the browser ends the tab’s session.

When you open a page on medalround.com from a link MedalRound sent you, your browser keeps the name of that link for 30 days, so that an account created on that browser in that time records which link it came from. Once a new account created on that browser has sent the link name to MedalRound and MedalRound has answered, the browser removes it. A name past that limit is deleted the next time that browser opens a page on medalround.com.

Stripe, Google and Apple set their own cookies on their own pages.

7. Notifications

Notifications are off until you turn them on in the MedalRound phone app. On the Account tab, under Notifications, there are two switches: Match alerts (when the desk calls your match to a court or takes it back, and when a registration, waitlist spot, partner or refund changes) and Announcements (notices from a tournament’s director, which MedalRound does not send yet). You can turn either off there, or turn notifications off for the app in your phone’s settings. Signing out of the app deletes the push token for that device, and so does deleting your account.

8. Keeping and deleting your information

You can delete your MedalRound account at any time, in the app under Account → Delete account, or on the web at medalround.com/account/delete. That immediately deletes your login, your profile, your saved email addresses, every device registered for notifications, and the record of which link you signed up from. The one exception is an account that directs a tournament which is published, has entries or registrations in it, or is connected to Stripe to take payments: only that account can give its players refunds, cancel it or change its Stripe connection, so medalround.com/account/delete cannot delete it. MedalRound cannot move a tournament to another account. To have such an account deleted, cancel the tournament with Cancel tournament in its Tournament actions menu, or wait until it is over, and once every refund it owes has gone through, use the Request your data form at medalround.com/account/delete and MedalRound will delete your account. A tournament that is unpublished, has no entries or registrations and is not connected to Stripe does not hold your account back, unless you direct more than 50 tournaments. Deleting an account never deletes a tournament: MedalRound keeps the tournament and its records. Deleting an account also takes it off Helpers in every tournament it helps with. It does not turn off the account’s club pages, which go on listing its tournaments. To take a club page down first, press Turn off club page on the tournament Overview’s Link from your club website card.

Deleting your account does not delete the registration and payment records held by the tournament directors you registered with. Those are the directors’ event records, and they keep them for entry history, refunds, chargebacks and their own tax and accounting obligations. Stripe likewise keeps payment records for as long as its own legal obligations require. If you want a director to remove the copy they hold, contact that director. If you cannot reach them, use the Request your data form at medalround.com/account/delete and MedalRound will pass your request on to the director.

Technical logs are kept for up to 90 days. We keep the full text of each email we send for 7 days, so that one that fails can be sent again, and then delete it. A short record of each email, the address it went to, its subject and whether it was sent, stays for one year, and the tournament’s email log shows the ones about that tournament. An email that carried a data request before the Request your data form saved requests on their own keeps its full text until its record is deleted, one year after it was sent. Resend, our email provider, keeps its own copy of each email and its delivery log for 30 days.

Vercel keeps the visit records that Vercel Web Analytics makes (section 2) for at least one month, and Vercel’s documentation says it may keep them longer. To tell visitors apart, Vercel Web Analytics uses a code made from each visit’s request and discards it after 24 hours.

Email delivery records are used to retry delivery, to investigate problems, and to show the director and co-directors of a tournament whether each email about it arrived and whether it was marked as spam. They are deleted one year after the email is sent. When we carry out a deletion request under section 9, we delete them too.

A data request sent through the Request your data form at medalround.com/account/deleteis kept for up to two years so that MedalRound can answer it and show that it did, and is then deleted.

A request to stop a tournament’s invitations has no fixed deletion date, because once it is deleted, that tournament’s director can have us email you invitations again. A deletion request under section 9 covers it too, and deleting it has that result. Invitation counts and lookup times older than 24 hours are dropped the next time the same tournament or account sends an invitation.

9. Your choices and requests

You can ask MedalRound for a copy of the information it holds about you, for a correction, or for deletion. Use the Request your data form at medalround.com/account/delete. It confirms your email address with a 6-digit code and then saves your request. MedalRound answers within 30 days, and will not discriminate against you for making a request.

10. Security

Everything is encrypted in transit. Sign-in is handled by Firebase Authentication; a password reset signs your account out of every device. Card data is entered on Stripe’s hosted page and never touches our servers. No system is perfectly secure. If you think your account has been compromised, reset your password with Reset password on the Sign in page, which signs your account out of every device, and use the Request your data form at medalround.com/account/delete.

11. Players under 18

MedalRound accounts are for people aged 18 and over. MedalRound does not make an account for a player under 18, and a registration for one asks for no email address of the player’s. A player under 18 can sign up for a tournament only through a registration their parent or legal guardian makes on the tournament’s sign-up form on medalround.com, where the parent or legal guardian confirms they are 18 or older and the player’s parent or legal guardian, and accepts the Terms of Service and the tournament’s waiver for the player and for themselves.

A tournament’s director or co-director can also add a player on the tournament’s Players page, with Add player or Import players. When the birthdate they enter makes the player under 18, MedalRound keeps that player as it keeps one a parent or legal guardian registers: the public record shows the first name and last initial, with no gender or rating. A player with no birthdate on file who is put in a division whose ages include ages under 18, or whose division’s ages change to include them, is kept that way from then on, even if a birthdate is added later. A birthdate on file that shows 18 or older before then keeps the full name public.

For a player under 18 registered by a parent or legal guardian, MedalRound keeps the name, date of birth, gender and rating, and the name and email address of the parent or legal guardian who registered them, plus that person’s phone number when the director asks for one. Every email about that registration goes to the parent or legal guardian. The confirmation email and the registration page link email sent to an address nobody has confirmed yet name no player.

For a player MedalRound keeps as under 18, only the tournament’s director and co-directors see the full name, date of birth, gender, rating, age on the tournament’s start date and the parent or legal guardian’s contact details on MedalRound. The DUPR results file a director downloads (section 4) names a player under 18 by first name and last initial next to the player’s DUPR ID, and DUPR receives that name when the director uploads the file. A helper sees the player’s first name and last initial, with no gender or rating, and what else their role allows. Section 5 says what public pages show. When MedalRound refuses a pairing because of a division’s ages, it names the other player only by first name and last initial and gives nobody’s age.

Apart from these registrations, MedalRound does not knowingly collect personal information from anyone under 18. If you believe a child has given MedalRound information, use the Request your data form at medalround.com/account/delete and MedalRound will delete it.

12. Where we operate

MedalRound is operated from the United States and your information is processed there. If you use MedalRound from another country, you are sending your information to the United States.

13. Changes to this policy

If this policy changes, MedalRound updates the date at the top of this page. That date is the only notice of a change.

14. Contact

MedalRound is operated by Accessible Ethical Apps LLC. To contact MedalRound, use the Request your data form at medalround.com/account/delete.