Privacy Policy

1. Data we collect

We only collect the data needed to run the features you use:

• Account info: email, display name, password (stored only as a hash, never in plain text), username if you set one, avatar if you upload one, preferred language, and any tags an admin assigns you.
• Match/tournament data you create or take part in: player names, per-turn scores, timestamps, and notes you enter.
• If you sign in with Google: your email and Google account ID (used to link the account) — we never receive or store your Google password.
• If you register a passkey: the public key and device info supplied by your browser — biometric data (fingerprint, face...) never leaves your device and we never collect it.
• If you enable push notifications: the endpoint address and encryption keys your browser/device issues, used to deliver notifications to that specific device.
• Your most recent sign-in time — shown to admins to track account activity.
• Anonymized usage data via Google Analytics (if enabled): pages you view, device/browser type, approximate geographic region — not tied to your account identity.

2. How we use your data

• Running the core features: creating, scoring, and sharing billiard matches and tournaments.
• Sending transactional email (email-change confirmation, password reset) through our email processor.
• Sending push notifications when a match you follow starts or ends.
• Showing your personal stats (AVG, win rate...) according to the visibility level you choose (public / friends / private).
• Protecting your account: rate-limiting password/email changes, detecting unusual sign-in activity.

3. Sharing data with third parties

We do not sell or rent your data. It's only shared with the following processors, strictly to run the features listed in section 2:

• MongoDB Atlas — database storage.
• Vercel — application hosting and avatar storage.
• Resend — sending transactional email.
• Google — only if you choose to sign in with Google.
• Google Analytics — measures visits and site usage in aggregate, helping us improve the experience.
• Your device's/browser's push notification service (e.g. Google, Apple, Mozilla) — only if you turn on push notifications.

4. The Android app

The "Billiard Scoreboard" Android app only requests the Internet permission — it does not request or access your camera, location, contacts, or device storage. The app is essentially an embedded browser displaying billiard-scoreboard.online, so data handling works exactly the same as using it in a desktop or mobile browser.

5. Cookies & local storage

We use one cookie to remember your chosen display language. If Google Analytics is enabled, your browser may also receive a measurement cookie (e.g. _ga) — not used for advertising or cross-site tracking. Your sign-in token is stored in your browser's/device's local storage, not a cookie.

6. Data retention

Account data is kept until you request deletion. Matches automatically move to an archived state after 30 days (hidden from the default list) but are not automatically deleted. Password reset tokens expire after a short time and are removed from our system.

7. Your rights

• View and edit your account info on the Account page.
• Choose who can see your personal stats (public / friends / private).
• Request deletion of your account and all related data by emailing the support address below.

8. Security

Passwords are hashed with bcrypt and never stored in plain text. One-time tokens (password reset, email-change confirmation) are stored only as SHA-256 hashes, never in their original form. Connections to the website and app are encrypted over HTTPS.

9. Children's privacy

Billiard Scoreboard is not directed at, and does not knowingly collect data from, children under 13.

10. Changes to this policy

We may update this policy from time to time. The most recent update date is always shown at the top of this page.

Contact

Have a question about privacy, or want to request account deletion? Email us.