Privacy policy

Tournament data

BracketCanvas stores tournament information in your browser. When cloud sharing is enabled, the tournament snapshot is stored on Cloudflare so public viewers and authorized editors can access it.

Private edit links

The secret portion of an edit link is stored in the URL fragment, which browsers do not send in ordinary HTTP requests. The server stores only a cryptographic hash of the capability. Anyone who receives the private link can edit, so treat it like a password.

Uploads and advertising

Logos are resized and metadata is removed in the browser before upload. Uploaded logos are used only with their tournament.

Public tool and content pages may use advertising. Editing, scoring and exporting flows do not place ads next to critical controls.

Deletion

Removing a tournament from My Tournaments deletes its local browser copy. Self-service cloud deletion is not yet available; contact us about a hosted tournament without emailing its private edit link.

Privacy-first performance analytics

When a valid Cloudflare Web Analytics token is configured, public indexable pages may load Cloudflare's performance beacon. It measures aggregate page views, referrers, navigation timing and Core Web Vitals. The beacon does not read or write cookies, localStorage, sessionStorage or IndexedDB, and it is not loaded on tournament creation, editing, scoring, spectator, projector, embed or export routes.

BracketCanvas uses this information to diagnose speed, stability and navigation quality. It is separate from advertising measurement and is disabled automatically when no analytics token is deployed.

Advertising, cookies and consent

Advertising is disabled until a valid publisher configuration is deployed. When enabled, public indexable pages may load Google AdSense. Google and its partners may receive technical information such as an IP address, browser or device details, the page URL and ad interactions, and may use cookies or similar storage to deliver, measure and protect ads.

Where consent is legally required, advertising must remain behind a Google-certified consent management platform. Visitors can accept, reject or manage the applicable purposes. Tournament editing, scoring, projector, embed and export routes do not load advertising code.

Operational and security data

Cloudflare processes the network and security information needed to deliver the site, prevent abuse, rate-limit writes and operate shared tournaments. BracketCanvas does not require user accounts and does not sell participant lists.