Privacy policy

EasyBracket runs tournaments and pick-up games for social sport and corporate events. It is provided by Micro Apps Limited, a New Zealand company (company number 9264564, NZBN 9429052248511) ("EasyBracket", "we", "us").

This policy explains what personal information we collect, why we collect it, who we share it with and the choices you have. It covers easybracket.app, organisation booking pages on easybracket.app addresses, website embeds and the EasyBracket connector for Claude and ChatGPT.

Organisers who run competitions on EasyBracket make their own decisions about their players' information. Section 10 explains how that works.

This policy takes effect on 25 October 2026.

Your account

• Your first name, last name (optional) and email address.
• Your password, which our authentication provider stores in hashed form. We never see it.
• If you sign in with Google, the name and email address Google shares with us.
• Anything you add to your profile: phone number, gender, date of birth or age, photo, display name and skill level. All of these are optional.
• When you accepted these documents at sign-up.

We use this to create your account, sign you in, show your name to the organisers and team mates you play with, and contact you about your account, entries and payments.

Competitions and games

The teams you belong to, requests to join a team, your entries, waiting list places, pick-up game sign-ups, referee assignments, match results, standings and notifications. We use this to run the competitions you take part in.

Organisers

• Your organisation's name, web address, contact email and phone, address, logo, banner, description and social links.
• Venue names and addresses.
• Invitations you send to admins and referees.
• Emails you send to players through EasyBracket, with delivery, open and click information so you can see what arrived.
• Your Stripe connected account reference and bank country. The identity and bank details you give Stripe during onboarding go to Stripe, not to us.
• Your subscription status, if you subscribe to a paid plan.

Entering without an account

If you enter a competition without signing in, we ask for a contact name, an email address and, for a team, a team name. We create an account for that email so you can see your entry and receipt later; you can set a password from the link we send.

If you bring guests to a pick-up game, you give us each guest's name and email address. Only add someone who is happy for you to do so.

Payments

Card details are entered into Stripe's checkout and never reach us. We keep the amount, currency, date, payment method, what the payment was for, Stripe's reference, the fees, who paid and who it was for, and any refund.

Technical information

• Your IP address, browser and device type, and request and sign-in logs, kept by our hosting providers to run and secure the service.
• Your IP address is used to limit repeated requests and, where it is turned on, for a bot check on free entries.
• When you sign up, we record your approximate location (country, region and city) from your IP address, so we know where our users are. We do not keep the IP address itself with your account.
• If product analytics is turned on, we record five organiser milestones (sign-up, Stripe connected, first competition published, first paid entry, competition completed) with account references only, never names or emails. We do not use advertising scripts.
• On our public pages we use Google Analytics, and count free tool use ourselves without any personal information. See Cookies and local storage.

What is public

Booking pages show an organisation's details, competitions, venues, fixtures, results and team names. They do not show who is in a team. Pick-up game pages show the display name and photo of each player who has signed up. Organisers can show the same public tournament information on their own websites with an embed.

Where the EU or UK General Data Protection Regulation applies, we rely on these legal bases:

• Contract: to provide your account, run competitions and games, take payments, process refunds, pay organisers and send the emails the service needs.
• Legal obligation: to keep payment and tax records.
• Legitimate interests: to keep the service secure, prevent fraud and abuse, fix faults, understand how organisers use EasyBracket and improve it. We weigh these interests against your rights, and you can object (section 7).
• Consent: for the optional profile fields. You can withdraw it at any time by clearing them.

Where an organiser decides what to collect from their players, the organiser is responsible for the legal basis (section 10).

We do not sell personal information, and we do not share it for advertising.

Organisers and other players

When you join an organisation, enter a competition or sign up for a game, that organiser and their admins can see your name, email address, phone number if you gave one, team, entries and payments for their competitions. Team mates and other players see names where the organiser shows them, for example in teams and results.

Service providers

We use trusted service providers to run EasyBracket, under contracts that limit what they can do with your information. They provide:

• Hosting, database, sign-in and file storage, with your information stored in Australia.
• Card payments and payouts to organisers. Our payment provider also handles some information under its own privacy policy.
• Sending email.
• Address search in organiser forms, and sign-in if you choose to sign in with Google.
• Bot protection on free entries, where it is turned on.
• Website analytics on our public pages (Google Analytics).

Ask us at the address below if you want the current list of providers.

AI connectors

If an organiser connects EasyBracket to Claude (Anthropic) or ChatGPT (OpenAI), the connector sends that organiser's competition information to the AI service they chose when they ask for it. This can include team names, referee names and payment amounts. That is the organiser's decision, and the AI provider handles the information under its own terms with the organiser. EasyBracket receives the connector's requests, not the conversation.

Other cases

We may disclose information when the law requires it, to protect people's safety or our rights, or as part of a sale or reorganisation of our business, in which case this policy continues to apply.

We are based in New Zealand. Our database and servers are in Sydney, Australia. Some of our service providers may process information in the United States and other countries.

When we send personal information from the EU, the UK or New Zealand to a country without comparable protection, we rely on the provider's certification under the EU-US Data Privacy Framework and its UK extension, or on the European Commission's standard contractual clauses with the UK addendum, and on the safeguards NZ Information Privacy Principle 12 and Australian Privacy Principle 8 require.

• Your account: until you delete it.
• Payment and refund records: 7 years after the end of the financial year they belong to, as tax law requires. When you delete your account, your name is removed from them.
• Match results and standings: kept as part of the competition's record. After you delete your account they show you as Deleted player.
• Logs: 30 days.
• Email delivery records: 12 months.

When we no longer need information, we delete it or remove what identifies you.

You can ask to:

• access the information we hold about you;
• receive a copy in a portable format;
• correct it;
• delete it;
• object to, or restrict, how we use it;
• withdraw consent you have given.

How to use them

Your profile page has Download your data, which gives you a file of everything linked to your account, and Delete account. You can correct your details on the same page. For anything else, email support@easybracket.app. We answer within the time the law sets, normally within one month, and we may need to confirm who you are first.

Deleting your account removes your profile, photo, team memberships, sign-ups, invitations and notifications. Payment records stay, without your name, because tax law requires them. If you are the only owner of an organisation with members or payments, transfer it or contact us first. If you have an active subscription, cancel it first.

If your request is about information an organiser controls, such as their entry lists or emails, we will pass it to them and help them answer.

European Union and United Kingdom

You have the rights above under the GDPR and UK GDPR, and you can complain to the data protection authority where you live or work. In the UK that is the Information Commissioner's Office (ico.org.uk).

New Zealand

Under the Privacy Act 2020 you can ask for access to, and correction of, your information. If you are not happy with our answer, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

Australia

Under the Australian Privacy Principles you can ask for access to, and correction of, your information. Please contact us first; if you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

California

If the California Consumer Privacy Act applies, you have the right to know what we collect, to delete and correct it, and not to be treated differently for using your rights. In the last 12 months we collected identifiers (name, email, IP address), customer records (phone, address), commercial information (entries and payments), internet activity (logs) and account sign-in details, for the purposes in section 2, from you, your organiser and the people who enter you. We do not sell or share personal information, and we use sensitive information only to provide the service. You can use an authorised agent.

Apart from analytics on our public pages (below), we use only cookies and browser storage that the service needs, or that remember a choice you made. We do not use advertising or cross-site tracking cookies.

• Sign-in cookies (names starting sb-): keep you signed in across easybracket.app and booking pages.
• clubId: remembers which organisation's booking page you are on.
• Payment cookies, set by our payment provider in checkout to prevent fraud.
• Bot check cookies, set by our bot protection provider where the check is turned on.
• eb-theme (local storage): your light or dark choice.
• eb-stripe-notice-dismissed (local storage): hides the Connect Stripe notice after you close it.
• card-style and tournament draft (local storage): an organisation's card style, and an unfinished new tournament so you do not lose it.

These are essential or remember your own choice. If you block them in your browser, sign-in and checkout will not work.

Google Analytics

On our public pages (the home and product pages, the free tools, and organisations' booking, tournament and game pages) we use Google Analytics to see which pages and tools are used and where visitors come from. It is not used in your account, the organiser console, sign-in or checkout. Google receives the page address without its query (so team names in a shared tool link are not sent), your browser and device type, an approximate location, and the free tool events (for example, a fixture list generated and for how many teams). We never send your name, email, team names or account references, and we do not use Google's advertising features or signals.

Its cookies (names starting _ga) are set only with your consent in the EU, the EEA, the UK and Switzerland, where we ask when you first visit. Elsewhere they are on by default. Anyone can change their choice at any time from Cookie preferences at the foot of the page; your choice is kept in the eb_analytics_consent cookie for 6 months. eb_geo holds your country, from your IP address, for a day, so we know whether to ask. You can also use Google's opt-out add-on (tools.google.com/dlpage/gaoptout).

EasyBracket is used for youth sport, but accounts are for adults. You must be at least 16 to create an account. A parent or guardian should enter a younger player and manage their details.

We do not ask for date of birth at sign-up. The profile has an optional date of birth field, and players who sign up with Google are asked an optional age; please leave both blank for a child.

Organisers who run youth competitions are responsible for getting a parent's or guardian's consent for the information they collect about children.

If you think we hold a child's information without the right consent, email support@easybracket.app and we will delete it.

When an organiser runs a competition on EasyBracket, the organiser decides what to collect from players, who can enter, what to send them and how to use the entry lists. For that information the organiser is the controller and EasyBracket processes it on their behalf, under our terms of service.

We are the controller for your EasyBracket account itself, sign-in, our own emails, security, analytics and billing.

Questions about how an organiser uses your information go to the organiser first; their contact details are on their booking page. We will help them answer.

• All traffic is encrypted in transit (HTTPS).
• Database access is controlled row by row, so each person sees only what their role allows.
• Card details are handled by Stripe, which is certified to PCI DSS Level 1.
• Passwords are hashed by our authentication provider.
• Server keys never reach the browser, and repeated requests are limited.

No system is completely secure. If a breach is likely to cause you serious harm, we will tell you and the regulators as the law requires.

We update this policy when the service or the law changes, and show the date at the top. For significant changes we tell account holders by email or in the app before they take effect.

Email support@easybracket.app. Our privacy officer can be reached at the same address.