Privacy policy
Who is responsible for this site, which data is processed, and your rights.
Who is responsible
Andrey Todorov
Oberstraße 27
47051 Duisburg
Germany
Email: support@atdrv.eu
This is a private, non-commercial website for running Magic: The Gathering tournaments. It has no advertising, no analytics and no tracking. The fonts and the Firebase software are hosted on this site. Full contact details are in the Impressum.
Hosting
This site is hosted on GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. To deliver a page, your browser sends GitHub’s servers technical data such as your IP address, the date and time, the page requested, the website you came from and your browser and operating system. According to GitHub, the IP addresses of visitors to GitHub Pages sites are logged and stored for security purposes. GitHub processes these logs as its own controller and decides how long it keeps them; I have no access to them.
The legal basis is Art. 6(1)(f) GDPR: the legitimate interest in delivering this website reliably and securely. GitHub is certified under the EU–U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR), and also uses the EU standard contractual clauses. Details are in the GitHub privacy statement and the GitHub Pages documentation.
Offline mode
The offline mode keeps tournaments only in your browser’s local storage (magic_mikes_tournaments). Nothing is sent anywhere and no consent is needed. To delete the data, delete the tournaments in the app or clear the stored data for this site in your browser settings.
Online mode: tournaments and accounts (Google Firebase)
The online mode syncs tournaments between devices through Firebase, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which processes this data on my behalf under the Firebase data processing terms (Art. 28 GDPR).
- Tournaments are stored in the Firebase Realtime Database, on servers in Belgium (europe-west1): the player names you enter, the matches and results, the format, the time of creation, and the user IDs of the organiser and of signed-in members. Anyone who knows a tournament’s code can see it, including the player names, and can enter results; until the organiser locks the tournament, anyone with the code can also change or delete it. Signed-in users can technically read all tournaments. Please use first names or nicknames for players and share the code only with the people taking part.
- Accounts are needed to create tournaments. Firebase Authentication stores your email address, your display name and a hash of your password, together with the time of sign-up and last sign-in and the IP address used. Google may process this data on servers in the USA. If you use “Forgot password”, Firebase sends the reset email.
- To keep you signed in, Firebase stores a login token in your browser (IndexedDB). This is necessary for the account you asked for (§ 25(2) no. 2 TDDDG).
The legal basis is Art. 6(1)(b) GDPR: providing the tournaments and the account you asked for. For player names you enter about other people, it is Art. 6(1)(f) GDPR: the legitimate interest in running the tournament. Where data is processed in the USA, Google is certified under the EU–U.S. Data Privacy Framework and also uses the EU standard contractual clauses. Details are in the Firebase privacy information and the Google privacy policy.
Tournaments are kept until the organiser deletes them. You can delete a tournament you created under “My Tournaments”, and you can delete your account together with every tournament you created at any time: sign in and choose Delete account. If a player wants their name removed from a tournament, they can ask the organiser or write to me.
Google reCAPTCHA (online mode, only with your consent)
To protect the database from abuse, the online mode uses Firebase App Check with Google reCAPTCHA (Google Ireland Limited). reCAPTCHA stores information on your device and sends Google data about your device and your visit, such as your IP address, browser details and how you interact with the page; Google may process it in the USA. It only starts after you agree on the first screen of the online mode. The legal basis is your consent (§ 25(1) TDDDG and Art. 6(1)(a) GDPR). Without consent you can use the offline mode. Details are in the Google privacy policy and the Google terms.
You can withdraw your consent at any time with effect for the future. The online mode will ask again before it starts reCAPTCHA. To also remove what Google has stored, clear the cookies for google.com in your browser.
Your settings in your browser
To work, the app keeps a few entries in your browser’s local storage: the tab you last looked at (mm_selected_view), the tournament you are in so you can rejoin it (currentTournament, isCreator, sessionTimestamp), the log level for troubleshooting (mm_log_level) and your reCAPTCHA choice (mm_recaptcha_consent). They stay on your device, are never transmitted, and are stored only to provide the app you are using (§ 25(2) no. 2 TDDDG). To delete them, clear the stored data for this site in your browser settings.
Contact by email
If you write to me, I process your email address, your message and the time it was sent in order to answer you. The legal basis is Art. 6(1)(f) GDPR, the legitimate interest in answering enquiries. Emails are handled by my email provider on my behalf. I delete them when the enquiry is settled, unless the law requires me to keep them.
Your rights
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). To use them, write to support@atdrv.eu. Requests about the hosting logs may also need to go to GitHub.
Right to object: you can object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 6(1)(f) GDPR), as described above for hosting, player names and email (Art. 21 GDPR).
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one in the EU country where you live or work.
Changes
This policy is updated when the website changes. Last updated: .