Privacy policy

GoldenPoint is operated from Oslo, Norway. We act as the data controller for personal data processed through the service at goldenpoint.no. You can reach us at hello@goldenpoint.no for any privacy question.

• Your name and email address when you create an account.
• Match results, set scores, partner pairings, league membership, and the achievements your team earns over time.
• Basic device and session data — log timestamps, IP address, browser type — to keep accounts secure and the service running.
• Notification preferences and language settings.

We do not collect special-category personal data such as health, ethnicity, religion, political views, or biometrics.

We process personal data under the following GDPR legal bases:

• Contract — to provide the service: run your league, record matches, compute standings and Elo, surface achievements, send result confirmations.
• Legitimate interest — to keep the platform secure, debug issues, and prevent abuse.
• Consent — for non-essential communications such as the weekly digest. You can withdraw consent at any time in Settings.
• Legal obligation — to respond to lawful requests from authorities where required.

Account profile data is retained while your account is active. Match and competition data — scores, standings, Elo history, audit trail — is retained indefinitely as part of the integrity of the league record. Server logs are kept for up to 90 days. When you delete your account, we anonymize your profile but retain the match history in anonymized form so league standings and tournament results remain intact for everyone else.

Under the GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your account (see the next section).
• Portability — receive your data in a machine-readable format.
• Restriction or objection — limit or object to specific processing.
• Withdraw consent — for any processing based on consent, at any time.
• Complaint — lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no, or your local supervisory authority.

To exercise any of these rights, email hello@goldenpoint.no. We will respond within 30 days.

You can request account deletion at any time. When we process the request, we revoke your sign-in, anonymize your display name and email, and mark your player record as deleted. Match results, set scores, division standings, audit-trail entries, and the achievements your team earned remain in the database — but your name no longer appears against them. This is necessary to preserve the integrity of league standings and tournament history for the other players you competed with. If you need erasure beyond anonymization (for example, you believe a specific record contains data we cannot lawfully retain), contact us and we will assess the request individually.

We use the following sub-processors to deliver the service:

• Supabase — database hosting and authentication, in the EU region.
• Vercel — application hosting and content delivery.
• Google — sign-in via Google OAuth, only if you choose this method.

We do not sell personal data and we do not use it for advertising profiling.

GoldenPoint is intended for players aged 16 and over. We do not knowingly collect data from anyone under 16. If you believe a child has signed up, contact us and we will close the account.

If we make a material change to this policy we will notify active accounts by email and update the date above. Questions, requests, or complaints — write to hello@goldenpoint.no.