TorneozPrivacy policy
Last updated: 2 November 2026
1. Who we are
Torneoz is an app for organising football tournaments. This policy explains what personal data Torneoz holds, why and what your rights are.
The data controller is Areeb Khan.
Contact for anything in this policy: info@torneoz.co.uk
2. What data we hold
When you create an account
- First and last name (shown in the app as your display name)
- Email address (your login)
- Phone number
- Date of birth, if you choose to give it
- Password (stored only as a secure one-way hash, never readable by us)
When you use the app
- Teams you create or join, your role in each team and invitations you send or receive
- Squads you are picked in for a tournament
- Match stats recorded against your name by a tournament organiser: goals, assists, own goals, yellow and red cards and minutes played
- Tournaments you organise: name, dates, venue, city, format, entry fee amount, prizes, age range, description and the contact details you add for teams to reach you
- Team logos and tournament posters you upload
- Notifications sent to you and your notification settings
- Reports you send about a tournament, team or user and the people you block
- Password reset codes (short lived, see section 7)
From your device
- A push notification token, if you allow notifications. We store it with the type of phone and when it was last used so we can send alerts to your phone through Google Firebase Cloud Messaging and Apple. It is deleted when you log out, change or reset your password or delete your account.
- Photos you pick from your photo library for a logo or poster. The app only opens your library when you choose to add an image.
- Technical data our server records when the app talks to it, such as IP address, time of request and the address requested. This is used for security and fixing faults.
What we do not collect
- We do not use your location, contacts or microphone.
- We do not take payments. Any entry fee is shown for information and paid outside the app.
- We do not use advertising, analytics or tracking tools and we do not sell your data.
3. Who can see your data
- Anyone using the app, even without logging in, can see published tournaments: name, dates, venue, city, format, description, prizes, fixtures, results, tables and the organiser's contact details. If you organise a tournament, only add contact details you are happy to make public.
- Other logged in users can see your display name, your teams and your public stats (matches played, goals scored, teams played for, teams managed and tournaments organised). Team managers can find you to invite you to a team by typing your full email address, your full phone number or at least 3 letters of your name. They see your name and never your email or phone number.
- Team managers and organisers see the squads and team sheets of teams in their tournaments.
- People you block can no longer find you in player search, add you to a team or send you invites or suggestions. We do not tell them they are blocked.
- We never show your email, phone number or date of birth to other users.
4. Why we use it and our lawful basis
| Purpose | Data | Lawful basis (UK GDPR) |
|---|---|---|
| Create and run your account, log you in, reset your password | Name, email, password hash, reset codes | Contract: we need it to provide the app you signed up for |
| Run tournaments, teams, squads, fixtures, results and tables | Account, team, tournament and stats data | Contract |
| Let managers find and invite players | Name, email, phone (matched, never shown) | Legitimate interests: making it easy to build a team. You can ask us to stop. |
| Send notifications about your teams and tournaments (in app, email and push) | Email, push token, notification settings | Contract for in-app and email alerts. Push only if you allow it on your phone. You can turn each type off in Notification Settings. |
| Show results and stats to other users | Name, stats, teams | Legitimate interests: tournament results are shared with the people taking part |
| Deal with reports and blocks | Reports, blocks and the content reported | Legitimate interests: keeping the app safe for everyone |
| Keep the service secure and fix faults | Technical and log data | Legitimate interests |
| Check you are old enough to have an account, if you give your date of birth | Date of birth | Consent: it is optional and never shown to other users. If you give it and it shows you are under 13, we do not create the account. |
| Meet legal obligations | Any of the above | Legal obligation |
5. Who processes data for us
We use these service providers. They only use your data to provide their service to us.
| Provider | What they do | Where |
|---|---|---|
| Railway Corporation | Hosts our server, database and uploaded images | United States (US East, Virginia). Railway is a US company. |
| Resend | Sends emails such as password resets and alerts, from noreply@torneoz.co.uk | United States |
| Google Firebase Cloud Messaging | Delivers push notifications | United States and other Google locations |
| Apple | Delivers push notifications to iPhones (Apple Push Notification service) and distributes the app | United States and other Apple locations |
| Cloudflare | Runs our domain and website | United States and other Cloudflare locations |
| Google (Workspace and Gmail) | Hosts the info@torneoz.co.uk mailbox and the inbox that receives content reports | United States and other Google locations |
6. International transfers
Some providers are based in, or can access data from, the United States. Where personal data leaves the UK we rely on the UK's adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or on the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. Contact us for details of the safeguard used for each provider.
7. How long we keep it
- Account data: while your account is open.
- When you delete your account: your name, email, phone number, date of birth, photo, password, notifications, notification settings, team memberships, invitations, blocks and push tokens are removed. Results and stats you were part of stay in tournament records so other teams' tables are not broken, but they show as "Deleted user" and are no longer linked to you. Teams you manage stay for their players with "Deleted user" as manager. Your draft tournaments are deleted. Tournaments you published that have not started are cancelled and the teams in them are told. Tournaments already under way or finished stay as a record, shown as organised by "Deleted user" with your contact details removed.
- Tournaments you organise: kept as a record of results for the people who took part, unless you ask us to remove them.
- Reports: kept while we deal with them and for 12 months after.
- Password reset codes: expire after 30 minutes.
- Server logs: kept for a short time, normally no more than 30 days.
- Backups: deleted data may stay in encrypted backups for up to 30 days before it is overwritten.
- Inactive accounts: deleted after 3 years without a login.
8. Deleting your account
You can delete your account in the app at any time: Me tab > Edit Profile > Delete account. This takes effect straight away and logs you out on every device. You can also email info@torneoz.co.uk from the address on your account and we will do it for you.
9. Your rights
Under UK GDPR you have the right to:
- get a copy of your data
- correct data that is wrong (you can edit most of it in Edit Profile)
- have your data deleted
- restrict or object to how we use it, including anything based on legitimate interests
- move your data to another service
- withdraw consent at any time, where we rely on consent
To use any of these rights email info@torneoz.co.uk. We will reply within one month. It is free.
10. Children
You must be 13 or over to create a Torneoz account. When you sign up you confirm you are 13 or over.
Torneoz is used for youth tournaments. Organisers and team managers are expected to be adults. Younger players do not need an account for their team to enter a tournament. Players aged 13 to 17 can have an account. We keep their data to the same minimum as everyone else: no location, no advertising, no tracking and their email and phone number are never shown to other users.
If you believe a child under 13 has created an account, email info@torneoz.co.uk and we will delete it.
11. Security
All traffic between the app and our server is encrypted (HTTPS). Passwords are hashed. The database is not reachable from the internet. Access to production systems is limited to the people who run the app.
12. Changes to this policy
If we change this policy we will update the date at the top. If the change is significant we will tell you in the app or by email.
13. Complaints
Please contact us first at info@torneoz.co.uk so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.
Our terms of use are at torneoz.co.uk/terms.