Privacy policy

GoldenPoint is operated from Oslo, Norway, and is the data controller for personal data processed through goldenpoint.no and the GoldenPoint app. For any privacy question, contact hei@goldenpoint.no.

• Account details: your name and email address, and a profile photo and phone number if you add them.
• Competition data: results, set scores, partners and teams, league, tournament and ladder participation, ratings and achievements.
• Friends and messages: your friend connections, the messages you exchange with other players, and any reports you submit.
• Settings: language, notification preferences and who can see your phone number.
• Device and usage data: sign-in and log times, IP address, browser or device type, and a push token if you allow notifications.
• Questions you ask Ace, the in-app assistant.

We do not collect special categories of personal data, such as health, ethnic origin, religion, political opinions or biometric data.

We process personal data on the following legal bases under the GDPR:

• Contract: to provide the service, including running competitions, recording results, calculating standings and ratings, and delivering messages and notifications.
• Legitimate interest: to keep the service secure, fix faults, prevent abuse and review reports.
• Consent: for optional communications and optional profile details such as your photo and phone number. You can withdraw consent at any time in Settings.
• Legal obligation: to respond to lawful requests from authorities.

We keep account data while your account is active. Competition records, such as results, standings, rating history and the audit trail, are kept as part of the league and tournament record. Messages stay in the conversation they belong to, also after one of the two players deletes their account. Server logs are kept for up to 90 days.

Under the GDPR you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: delete your account (see Account deletion below).
• Portability: receive your data in a machine-readable format.
• Restriction and objection: limit or object to specific processing.
• Withdrawal of consent: at any time, for processing based on consent.
• Complaint: to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or your local supervisory authority.

To exercise these rights, email hei@goldenpoint.no. We respond within 30 days.

You can delete your account at any time in Settings. If you are the only owner of a club whose subscription still renews, first cancel the subscription or make another member an owner. If your account is suspended, write to us and we will delete it. Deleting removes your login, your photo and your phone number, anonymises your name and email address, and marks your player record as deleted. Results, standings, audit entries and achievements remain so that competition records stay accurate for other players, but your name no longer appears on them, on tournament entries, in current team names made from it, or in notices other players received from you. The final tables of seasons that have already ended keep the team names they were saved with. A team name someone chose by hand stays as it is. Messages you sent remain visible to their recipients, shown as sent by a deleted player. Support requests you sent us are deleted. If you believe we hold data we should not, contact us and we will review your request.

We use the following processors to provide the service:

• Supabase: database, file storage and authentication, hosted in the EU.
• Vercel: application hosting and content delivery.
• Resend: email delivery.
• Expo: push notifications to the mobile app.
• Sentry: error monitoring.
• Stripe: payments for club subscriptions.
• Anthropic, Voyage AI and OpenAI: processing the questions you ask Ace.
• Google, Apple and Facebook: sign-in, only if you choose one of them.

Some processors are based outside the EEA. Such transfers are protected by the European Commission's Standard Contractual Clauses or an adequacy decision. We do not sell personal data or use it for advertising.

GoldenPoint is intended for players aged 13 and over. We do not knowingly collect data from anyone under 13. If you believe a child has created an account, contact us and we will close it.

If we make a material change to this policy, we will notify active accounts by email and update the date above. For questions, requests or complaints, write to hei@goldenpoint.no.