Privacy policy

Cupify is a platform for organizing football tournaments. Organizers run their cups here, clubs register their teams, and anyone can look up a schedule without an account. This page explains what we do with personal data along the way.

We have tried to write it in plain language rather than the usual wall of legal text. Where something is uncomfortable — data we keep, places it goes — we say so instead of burying it.

Who is responsible for what

For your own account, and for anyone visiting the site, Cupify is the controller. We decide what an account is, what we log, and what we store on your device, so any question about that comes to us.

For the data a club or team manager enters about their players, Cupify is only the processor. The club decides which players to enter, why, and on what legal basis; we hold that data on their behalf and do what they tell us with it. We do not use it for anything of our own.

That split matters when you want something changed or deleted. If it concerns your Cupify account, write to us. If it concerns a player record, the club that entered it is the one who answers — but write to us anyway if you cannot reach them, and we will help you find the right contact.

What we collect

Your account

An email address and a name, plus a profile picture and a Google account identifier if you sign in with Google. There is no password to store: you sign in with Google or with a one-time code sent to your email. We keep a hashed copy of your active sign-in sessions so you stay logged in, never the underlying token itself.

What you enter as an organizer or team manager

Tournaments, classes, teams, clubs, match schedules, results, pitches, referees, documents and images. Most of this is not personal data, but some of it is — a referee's phone number, a contact person on a registration, a name in an uploaded photo. It is stored inside the space or team it belongs to, and people outside it cannot reach it.

Players

A team manager can record a player's name, squad number and civic registration number, because tournaments check eligibility and age classes. Civic numbers get their own section below. Players are never shown on the public site.

Forms on the public site

When you register a team or write to an organizer, we store what you filled in — typically a contact name, an email address, a phone number and your message — and pass it to the organizer running that tournament. A spam check runs first, which sends a short-lived token from your browser to Cloudflare and tells us only whether you passed.

Payments

Tournament fees are paid to the organizer, not to Cupify. If they use card payment, you are handed over to Stripe and your card details go to Stripe alone — we never see or store them. What comes back to us is the reference for the payment and whether it succeeded, so the registration can be marked as paid. If the organizer instead takes Swish or bank transfer, we only store the reference they asked you to use.

Technical records

When something breaks we record the error: which page, which request, the status code, and — for the public registration and contact forms only — what was submitted, so we can see why a registration failed instead of asking you to reproduce it. Signed-in pages never log the request body. Error records may include an IP address, browser user agent and, if you were signed in, your email address.

Visitor statistics on tournament pages

If you accept statistics cookies, a tournament's public page records which of its pages you open and what you click, under a random id kept in your browser. We store no IP address and no browser details with it, and the id is turned into a different one for every tournament, so your visits to two tournaments cannot be linked. The organizer only ever sees totals. Decline, or withdraw your yes on the cookie policy page, and the id is removed and nothing more is recorded.

Visitor statistics on Cupify's website

If you accept statistics cookies, Cupify's own website — the start page, pricing, the tournament directory, the contact page, these policies and the sign-in page — records which pages you open, in what order, how far down a page you scroll and what you click, under the same random id. The id is turned into a key of its own for the website, so these visits cannot be linked to your visits to any tournament's page. We store no IP address and no browser details — only the site you came from (its name, not the page), the campaign named in the link if there was one, the language, the kind of device and whether you were signed in. Only Cupify's administrators see it, as totals, to understand how people find their way around the site. Decline, or withdraw your yes on the cookie policy page, and nothing more is recorded.

What we do not do

There is no advertising network, no tag manager, no social media pixel and no third-party analytics on Cupify. Fonts ship with the site rather than being fetched from Google. Nothing here builds a profile of you, and there is no automated decision-making with legal effects.

Why we are allowed to process it

Under the GDPR every use of personal data needs a legal basis. Ours are:

• Performance of a contract — running your account, your space, your registrations and the tournaments you take part in. Without this data the service simply does not work.
• Legitimate interests — keeping the platform secure, preventing spam and abuse, investigating errors, and answering the messages you send us. We keep these uses narrow and short-lived on purpose.
• Consent — for optional cookies, and for anything else we ask you about explicitly. You can withdraw it whenever you like, and it takes effect immediately.
• Legal obligation — where bookkeeping or other law requires us to keep a record.

For player data the legal basis is the club's to choose, not ours. When a team manager enters players they confirm they are entitled to do so, and we act only on their instructions.

Civic registration numbers

Swedish youth tournaments verify that players belong in the age class they play in, which is why the field exists at all. We treat it as the most sensitive thing in the database and handle it accordingly:

• It is encrypted in the application before it reaches the database, with a key the database itself does not hold. A copy of the database on its own reveals nothing.
• It is masked everywhere in the interface. Seeing it takes a deliberate action, not a glance at a list.
• Every reveal is recorded — who looked, at which player, when, and in what context. The log exists so that misuse leaves a trace.
• It is erased twelve months after the player last appeared in a squad, without anyone having to ask. The name and squad number remain so the club keeps its history; the number itself is gone. A team manager can also have it erased sooner on request.

How long we keep things

We delete on a schedule rather than when someone remembers to. These are the rules the system actually runs on:

Deleted data can survive a little longer in encrypted database backups, which roll over on their own schedule. It is not reachable from the application and is not restored selectively.

Who else sees your data

Cupify runs on a small number of suppliers. Each one processes data on our instructions under a data processing agreement, and none of them may use it for their own purposes.

Beyond these, data goes to the organizer of the tournament you are dealing with, and to no one else. We do not sell personal data, we do not share it for advertising, and we do not hand it over to authorities unless the law requires it.

Cupify itself is hosted in the EU. Some suppliers are US companies and may process data outside the EU; where that happens it relies on the European Commission's standard contractual clauses and, where applicable, the EU–US Data Privacy Framework.

What is public on purpose

A tournament's public page is meant to be read by anyone: the schedule, the participating teams and clubs, results, standings and the tournament's own contact details. Team names, match times and results are published deliberately, because a cup nobody can look up is not much of a cup.

Player names, squad numbers and civic numbers are never published. They stay inside the team and the organizer's registration view.

Your rights

The GDPR gives you rights over your personal data, and we do not charge for them or make you explain why:

• Access — a copy of the personal data we hold about you.
• Rectification — anything wrong corrected. Most of it you can edit yourself.
• Erasure — your account and its data deleted, where nothing legal requires us to keep it.
• Restriction — processing paused while a dispute is sorted out.
• Objection — to processing we base on legitimate interests.
• Portability — your data in a machine-readable format.

If your request is about a player record, the club or team is the controller and decides — so ask them first. We will still take the request, forward it, and act as soon as they instruct us.

If you think we have handled your data badly, tell us first and we will try to fix it. You also have the right to complain to the Swedish Authority for Privacy Protection (IMY), or to the supervisory authority in the EU country where you live.

How we protect it

Traffic is encrypted in transit and the database is encrypted at rest. Civic numbers get a second layer of encryption on top of that. Access is scoped: a space only reaches its own data, a team only its own, and administrative access is limited to the few people who need it. Sign-in tokens are stored hashed and rotate on every use.

No system is perfect. If a breach happens that puts your rights at risk, we will notify the supervisory authority within 72 hours and tell you directly when the rules require it.

Children

Cupify accounts are for adults running tournaments and teams — we do not offer accounts to children. Many of the players recorded in the system are minors, though, and that data is entered by a team manager under their club's responsibility, not collected from the child.

Cookies

For what Cupify stores on your device specifically, see the cookie policy. It is generated from the same register the application uses, so it lists every cookie by name, purpose and lifetime — and lets you change your answer at any time.

Changes to this policy

When we change how we handle data, we change this page and update the date at the top. If a change materially affects you, we will say so rather than hoping you notice.

Contact

Questions about privacy, or a request about your data, go to [email protected] and we will answer. The registered company details and any data protection contact will be listed here.