Privacy Policy

Last updated: September 14, 2026

This Privacy Policy explains what data Tournament Bot ("the bot", "we", "us") collects when you use the Discord bot or its web control panel, and how that data is used, stored, and protected.

1. Who this covers

This policy applies to anyone who interacts with the bot in a Discord server it's added to (registering for a tournament, clicking Join/Leave, receiving a reminder DM) or who logs into the web control panel with their Discord account to organize tournaments.

2. Data we collect

We collect only what's needed to run tournaments and the panel:

• From everyone who registers for a tournament: your Discord user ID and username/tag, plus the timestamp you registered — used to show the participant list, keep the slot counter accurate, and send you a reminder DM if the organizer set one up.
• From organizers who log into the web panel: your Discord user ID, username, and avatar, plus an OAuth2 access token and refresh token issued by Discord. We request the identify and guilds OAuth scopes only — we never see or store your email address or your Discord password. Access/refresh tokens are encrypted at rest (AES-256-GCM) and are only ever used server-side to read your guild list and permissions on your behalf.
• Session cookie: a random, meaningless session ID stored in an httpOnly cookie in your browser. It can't be read by page scripts and is useless outside our server.
• Tournament content organizers create: names, descriptions, banner/thumbnail images, external links, and similar content organizers type into the panel or Discord modals.

We do not collect payment information, and we do not knowingly collect any data beyond what's listed above.

3. Third-party services

• Discord — the bot and panel run on top of Discord's API and OAuth2. Your use of Discord itself is governed by Discord's own Privacy Policy.
• Matcherino (optional, only if an organizer links a Matcherino tournament) — the bot reads publicly available bracket data (team count, prize pool) for the linked tournament ID. No data about you is sent to Matcherino.
• Anthropic (Claude API) (optional, only if an organizer clicks "Generate with AI") — the game name, format, and prize text the organizer typed are sent to Anthropic to generate a description. No participant or account data is included in that request.

4. How we use your data

• To operate tournament registration (Join/Leave, slot counts, participant lists, CSV export for the organizer).
• To send you DMs you've opted into by registering: a confirmation, an optional reminder, and a start-time role ping.
• To let organizers log in and manage tournaments on servers where they have the Manage Server permission.
• We do not sell your data, and we do not use it for advertising.

5. Data retention & deletion

Tournament and registration data is kept for as long as the tournament exists in the database, so organizers can review past participant lists. An organizer can delete a tournament (and its registrations) at any time from the dashboard. Your web panel login session is deleted when you log out or expires automatically. To request deletion of your data, contact us at kaktysgames228@gmail.com.

6. Security

OAuth2 tokens are encrypted at rest. Session cookies are httpOnly and, in production, sent only over HTTPS. Every privileged action (creating, editing, or closing a tournament) is re-checked server-side against your actual Discord permissions — never assumed from the UI alone.

7. Children's privacy

This service is not directed at children under 13 (or the minimum Discord account age in your region), consistent with Discord's own Terms of Service.

8. Changes to this policy

If this policy changes, the "Last updated" date at the top will change accordingly. Material changes will be noted here.

9. Contact

Questions about this policy or your data? Contact kaktysgames228@gmail.com.