PingPong Arena

Privacy policy

Last updated: 13 June 2026

PingPong Arena ("the Arena", "we") is a table tennis tournament service operated from Lithuania, in the European Union. This policy explains what personal data we process, why, and the rights you have under the EU General Data Protection Regulation (GDPR). Questions and requests: hello@pingpongarena.app.

Data we process

  • Account data — your email address and authentication credentials, stored with our authentication provider when you create an account.
  • Tournament data — the content organisers enter to run events: player names, match results and scores, optional player gender, and an optional birth year. Birth years are visible only to the tournament organiser and are never shown in shared or public views.
  • Coaching profile (optional) — if an organiser uses AI coach insights, optional per-player notes such as handedness, equipment, and play style. Insights are generated from derived, non-identifying inputs; a player's raw birth year is never sent to the AI provider — at most an age band, and only when explicitly enabled.
  • Technical data — error reports (via Sentry) and product usage events (via PostHog) so we can fix problems and improve the product. Analytics runs without cookies or persistent browser identifiers: anonymous visits are not tracked across sessions, and events are tied to an account only after you sign in.

Player data entered by organisers

When a tournament organiser enters other people's data (names, results, optional gender or birth year), the organiser decides what to collect and is responsible for informing their players. We process that data on the organiser's behalf to run the tournament, and we apply privacy by design: organiser-only fields such as birth year are stripped from every shared, public, or scorer view.

Player emails (registration and results)

When you register for a tournament through a public registration link, your name goes to the organiser. Adding an email address is optional and used for exactly one thing: sending you that tournament's results and coaching tips, with your explicit consent at registration. The address is stored alongside the organiser's roster, is never shown in live views, share links, or reports, and is processed by Resend (transactional email) only when the organiser sends results. Every results email contains a one-click link to withdraw consent, which removes your address immediately; removing a player from a roster deletes it too. A separate, clearly-labelled checkbox covers marketing news — results consent alone never adds you to a mailing list.

Why we process it (legal bases)

  • To provide the service (contract) — accounts, live scoring, standings, reports, share links.
  • To keep the service working and improve it (legitimate interest) — error monitoring and cookieless product analytics.
  • Optional features you switch on (consent) — e.g. sharing an age band with AI coach insights.

Service providers

We use a small set of providers to operate the Arena:

  • Supabase — Authentication and database hosting (account, tournament data)
  • Railway — Backend server hosting (live scoring, tournament state)
  • Vercel — Web app hosting and content delivery
  • Sentry — Error monitoring (technical diagnostics, no marketing use)
  • PostHog — Product analytics (cookieless; anonymous until you sign in)
  • Anthropic — AI coach insights (derived, non-identifying inputs only)
  • MailerLite — Marketing emails — only addresses you explicitly gave consent for
  • Stripe — Payment processing for paid plans (we never see your card number)
  • Resend — Transactional tournament-results emails — only addresses given with results consent

Payments for paid plans are handled by Stripe; card details go directly to Stripe and never touch our servers. We do not sell personal data and we do not run third-party advertising.

Marketing emails

We send marketing email (product updates, tips, billing-launch news) only with your explicit consent: the optional checkbox at signup, or joining a "notify me" waitlist on the pricing page. Consented addresses are processed by MailerLite (EU company). Every email includes an unsubscribe link, and you can withdraw consent at any time by unsubscribing or emailing us. Transactional email needed to operate your account (such as sign-in confirmation) is separate and does not require marketing consent.

Cookies and local storage

We use only what is strictly necessary to keep you signed in (authentication tokens in your browser's local storage). Our analytics is configured cookieless, so the Arena shows no cookie banner — there is nothing optional to consent to in your browser.

Retention

Account and tournament data are kept while your account exists so results, history, and analytics remain available. If you delete your account or ask us to, we delete your personal data unless a legal obligation requires keeping it. Organisers can remove individual players' data from their tournaments at any time.

Your rights

Under the GDPR you can request access to, correction of, deletion of, or a portable copy of your personal data, and you can object to processing based on legitimate interest. Email hello@pingpongarena.app and we will respond within 30 days. You can also lodge a complaint with the Lithuanian State Data Protection Inspectorate (VDAI) or your local EU supervisory authority.

Changes

We will update this page when the product's data processing changes (for example, when billing launches) and revise the date at the top.