Last updated: 17 October 2026

Privacy Policy

This Privacy Policy explains how TourneyMap, operated by Jokaero (“we”, “us”), collects, uses, and protects your personal data. We are based in Zurich, Switzerland, and comply with the Swiss Federal Act on Data Protection (nFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Data We Collect

Account data

• Email address (required for account creation)
• Password (stored as a secure hash - we never see your plain-text password)
• NAF number and NAF name (optional, if you link your NAF membership)
• Display name (if you choose not to link a NAF account)

Profile data

• Home location (latitude/longitude - optional, used to calculate travel times to tournaments)
• Language preference
• How you found us: if you signed up after following a member's invitation link or a tagged link such as a QR code, we store which member or which link it was

Usage data

• Tournament attendance status (Interested / Registered) per tournament
• Trip checklist items, types, and notes you create

Technical data

• Standard server logs (IP address, browser type, pages visited) - retained for up to 30 days
• First-party usage analytics: which pages are opened, which filters and searches are used, where on the site a tournament is saved to MyTrips, and which language the site was served in. These are aggregated into daily counts; the individual events behind them are deleted after 30 days.
• To count how many distinct people visit on a given day, we derive a one-way hash from your IP address and browser user-agent combined with a salt that changes every day. The IP address is not stored alongside it, the salt is not kept, and the hash cannot be tied back to you or matched to your visits on any other day.
• If you arrive through an invitation link or a tagged link such as a QR code, the visit is counted, and the link's tag is kept in your browser's local storage for up to 30 days so that it can be attached to your account if you sign up. The tag identifies the link, not you.

These analytics are entirely first-party: they are processed on our own infrastructure and are not shared with any analytics provider. No cookie is set for analytics, and no persistent identifier is stored on your device for it.

The Service is free to use and will remain so. An optional Pro membership is available as a voluntary contribution; payments are handled entirely by Stripe and we never see or store your card details. We do not use tracking cookies or advertising technologies.

2. How We Use Your Data

• Providing the Service: displaying your trips, checklist, and attendance status
• Travel information: your home location is sent to Google Maps and Mapbox APIs solely to calculate travel times - it is not stored by those providers beyond the duration of the request
• Communication: sending transactional emails (account confirmation, password reset, friend requests, trip and squad invitations) via Supabase Auth and Resend
• Service improvement: aggregated, anonymised usage statistics

We do not sell your data. We do not use your data for advertising.

3. Legal Basis for Processing (GDPR)

• Contract performance (Art. 6(1)(b)): account data and usage data necessary to provide the Service
• Legitimate interest (Art. 6(1)(f)): security logging and fraud prevention
• Consent (Art. 6(1)(a)): home location (you can remove this at any time in your profile)

4. Third-Party Services

We use the following sub-processors to operate the Service:

The owner alerts sent through Telegram carry only the new member’s display or NAF name - no email address, no location and no account details.

Transfers to the USA are covered by Standard Contractual Clauses (SCCs) as permitted under GDPR Art. 46.

5. Data Retention

• Account and profile data: retained for as long as your account is active
• Checklist and attendance data: retained as long as your account is active
• Server logs: 30 days
• Individual analytics events: 30 days. The daily aggregate counts derived from them contain no identifiers and are kept indefinitely
• After account deletion: all personal data is permanently deleted within 30 days

6. Your Rights

Under the nFADP and GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data (via your profile settings)
• Delete your account and all associated data
• Export your data in a portable format
• Withdraw consent for home location processing at any time
• Object to processing based on legitimate interest

To exercise any of these rights, contact us at jokaero@tourneymap.com. We will respond within 30 days.

7. Security

Passwords are hashed using bcrypt. All data is transmitted over HTTPS. Database access is protected by row-level security policies (each user can only access their own data). We conduct periodic security reviews.

8. Children

The Service is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has registered, please contact us and we will delete the account promptly.

9. Changes to This Policy

We may update this Privacy Policy as the Service evolves. Material changes (e.g. new data categories, new third parties) will be communicated by email at least 14 days before taking effect.

10. Contact & Complaints

Data controller: Jokaero / TourneyMap, Zurich, Switzerland Email: jokaero@tourneymap.com

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch, or with your local EU supervisory authority if you are an EU resident.