Privacy Policy
Last updated: 5 November 2026
This policy explains what personal data BOLOARENA collects, why, who receives it, how long it is kept, and the rights you have over it. It applies to boloarena.com and its subdomains, and is written to meet the EU General Data Protection Regulation (GDPR).
1. Who is responsible for your data
BOLOARENA is an independent website, not a registered company. The team that runs it ("we", "us") is the data controller for the processing described here. For anything about your data, write to [email protected].
Tournament organizers and venues decide how they run their own events. If an organizer collects information about you outside BOLOARENA, they are responsible for it.
2. The data we collect
Data you give us
- Account: email address, display name, optional nickname, and your password. Passwords are handled by our sign-in provider. We never see them in readable form.
- Google or Apple sign-in: the name, email address and profile photo those services share with us.
- Profile photo: any image you choose to upload. We process each image when you upload it, which removes hidden information such as the location where a photo was taken.
- Waitlist: your email address, if you join.
- Messages: anything you send us by email.
Data created as you use BOLOARENA
- Competition data: tournament registrations, groups, matches, scores, rankings, points and winners.
- 1 vs 1 matches: your matches and their scores, shared with your opponent.
- Account records: your public player ID, your role, your plan, your sign-up and last sign-in dates, and when you accepted our terms.
- Notifications: in-app notifications, and the emails we send you about matches.
Technical data
- Connection data: your IP address, browser and device type, processed by our hosting, security and database providers each time you load a page.
- Browser storage: described in our Cookie Policy.
- Analytics: only if you agree. Google Analytics then records the pages you visit and how you use them.
We do not ask for your phone number, date of birth, gender, nationality or home address, and we do not take payments. Entry fees and prizes shown on a tournament page are for information only.
3. What is public
BOLOARENA is a competition platform, so some of your information is visible to anyone, including people without an account:
- your display name, nickname, profile photo and public player ID
- your player page, with your match history and statistics
- your tournament participation, results and league rankings
Public tournament pages can appear in search engines and may show participants' names. We ask search engines not to index individual player pages, though we cannot guarantee that they comply.
Use a nickname or display name you are comfortable having public. Your email address is never shown publicly.
4. Why we use your data
We may only use personal data with a legal basis under GDPR. These are ours:
| Purpose | Data | Legal basis (GDPR Art. 6(1)) |
|---|---|---|
| Creating and running your account | Account data | Contract (b) |
| Running tournaments, leagues and 1 vs 1 matches | Account and competition data | Contract (b) |
| Sending match emails and notifications | Email address, match details | Contract (b) |
| Publishing results and rankings | Display name, photo, competition data | Legitimate interests (f): a competition needs visible, reliable results |
| Keeping the service secure and preventing abuse | Technical and account data | Legitimate interests (f) |
| Answering your messages | Your message and contact details | Legitimate interests (f), or contract (b) if it concerns your account |
| Measuring how the site is used | Analytics data | Consent (a), which you can withdraw at any time |
| Sending waitlist updates | Email address | Consent (a), which you can withdraw at any time |
| Keeping records the law requires, and handling legal claims | Whatever the matter involves | Legal obligation (c), legitimate interests (f) |
Rankings and brackets are calculated automatically from results. This has no legal or similarly significant effect on you, so it is not automated decision-making under GDPR Art. 22.
We do not sell your personal data, and we do not use it for advertising.
5. Who receives your data
We share data only with these providers, and only as far as they need it to run the service:
| Recipient | What they do | Data |
|---|---|---|
| Google (Firebase) | Sign-in, database, server functions and image storage | Account, competition and connection data, and images you upload, at a public link |
| Cyberfolks (Romania) | Website hosting and sending email | Connection data, email address, email content |
| Cloudflare | Delivering the site and protecting it from attacks | Connection data |
| Google Analytics | Usage statistics, only with your consent | Analytics data |
| Google and Apple | Sign-in, only if you choose it. They act as independent controllers under their own privacy policies | Your sign-in details |
| CountriesNow | The country and city list in the venue editor, used by venue admins only | Connection data |
On some devices, mostly phones, our sign-in library connects to Google's servers (apis.google.com and boloarena.firebaseapp.com) as a page loads, even if you do not sign in. This shares your connection data with Google so that sign-in can work.
We may also disclose data where the law requires it, or to protect our rights or the safety of others. Other users see the public information described in section 3, and your opponents see the details of matches you play together.
6. Transfers outside the EU
Our database, server functions and image storage run in Google's European regions. Some providers, including Google and Cloudflare, can still process data outside the European Economic Area, particularly in the United States. Where that happens, we rely on an EU adequacy decision, such as the EU-US Data Privacy Framework for companies certified under it, or on the European Commission's Standard Contractual Clauses.
Until November 2026 we stored uploaded images with ImgBB, which may keep them outside the EU. We are moving those images to our own storage.
7. How long we keep data
| Data | Kept for |
|---|---|
| Account data | Until you delete your account or ask us to |
| Competition results | For as long as the tournament or league exists. After account deletion they stay, anonymised as "Deleted player" |
| Waitlist email address | Until you ask to leave the list |
| Records of emails we send | 30 days |
| One-click links in match emails | Valid for 7 days, then removed automatically |
| Google Analytics data | 14 months |
| Messages to us | Up to 2 years after the matter is closed |
| Connection logs | For the short period set by each hosting and security provider |
We keep data for longer only where the law requires it, or where it is needed for a legal claim.
8. Your rights
Under GDPR you have the right to:
- Access your data and get a copy
- Correct inaccurate data. You can edit most of it yourself in your profile
- Erase your data, subject to section 9
- Restrict how we use your data
- Receive your data in a portable format
- Object to processing based on legitimate interests
- Withdraw consent at any time, without affecting what was done before. For analytics, use Cookie settings in the footer
To use a right, email [email protected] from the address on your account. We reply within one month, and may need to confirm your identity first.
You can also complain to a data protection authority. In Romania that is the National Supervisory Authority for Personal Data Processing (ANSPDCP), at www.dataprotection.ro.
9. Deleting your account
You can delete your account yourself from your profile. This deletes your account, login, public profile, profile photos, notifications, waitlist entry and records of emails sent to you.
Two things to be aware of:
- Results stay, without your name. Other players' brackets and standings depend on them, so your results remain, shown as "Deleted player". Your name is removed, but matches that are already well known locally could still be linked to you by people who were there.
- Older photos may remain on ImgBB. Photos uploaded before November 2026 were stored there. We delete our copy, but we cannot always remove the original from ImgBB. Email us if you need help with one.
If you manage tournaments, leagues or venues, or are registered in a tournament that has not finished, these need sorting out first. The profile page will tell you. You can always email us instead.
10. Children
You must be at least 16 to create an account. We do not knowingly collect data from anyone younger. If you believe a child has created an account, contact us and we will remove it.
11. Security
We use encrypted connections, access rules that keep private data private, and limited access for administrators. No online service is completely secure. If a breach puts your rights at risk, we will tell you and the supervisory authority where the law requires it.
The only official site is boloarena.com. Do not enter your password on any other domain that looks like BOLOARENA.
12. Changes to this policy
We will update this page when our practices change, and change the date at the top. If a change is significant, we will tell you in the app or by email before it applies.
13. Contact
BOLOARENA
Email: [email protected]