Last updated: August 2026
TAP is tournament management software operated by a private individual in Germany. The operator's name and postal address are in the Imprint; they are the controller for the processing described here within the meaning of Art. 4(7) GDPR.
This policy covers tap.comae.dev and its subdomains: the organiser dashboard, the player app, the public tournament pages and the documentation site.
A tournament organiser can add you to a roster by typing your email address, before you have any account with us. We then send you one invitation email. If you do not accept it, that row stays a placeholder — an address and a name, nothing else — and it is deleted automatically after 90 days. You can ask us to delete it sooner at any time (Section 9).
For this data the organiser is the controller and we act as their processor (Art. 28 GDPR). Their own privacy notice governs why they collected it.
j…s@example.com). Both rotate
automatically — each log is capped in size and the oldest entries are discarded — and we do
not keep them longer than we need to investigate faults and abuse.We use Umami, a self-hosted, cookieless analytics tool, to understand how people use TAP. It runs on our own server; no analytics data goes to any third party. Nothing is loaded before you accept — see Section 5.
/p/:username, a match as /dashboard/match/:id. The
shape of the page is kept; who or what it was about is not.On this marketing site we additionally record aggregated heatmaps — where visitors click and how far down a page they scroll — so we can fix pages rather than guess.
We set no advertising or tracking cookies. What we do set:
account_auth, player_auth, user_auth, tournament_auth) — strictly necessary to keep you signed
in. They expire after 24 hours and are removed when you sign out. No consent is required
for these (§ 25(2) TDDDG).No analytics or heatmap script is loaded before you accept. Your choice is remembered per browser and you can change it at any time:
Switching it off takes effect immediately; the tracker is not loaded again unless you switch it back on.
We do not sell or rent personal data. Running the service does mean some data reaches the providers below. Everything else stays on our own server in the EU.
| Recipient | What reaches them | Why | Basis |
|---|---|---|---|
| Twilio SendGrid (USA) | Your email address, your name, and the content of the message (e.g. which tournament invited you) | Sending account, invitation and notification emails | Processor, Art. 28; transfer on Standard Contractual Clauses |
| Expo (USA), and via them Apple or Google FCM | Your device's push token and the text of the notification (e.g. the opposing team and the tournament) | Delivering push notifications you switched on | Processor, Art. 28; transfer on Standard Contractual Clauses |
| Discord (USA) | Team names, player display names, match results and schedules posted into a server an organiser connected. If you link your Discord account, your Discord ID, username and email address. | Running a tournament inside a Discord server, and signing in with Discord | Separate controller for their platform; our part on Art. 6(1)(b) and (f) |
| Valve / Steam (USA) | Only what Steam itself sees when you sign in there. We store your SteamID and display name. | Proving an in-game identity, if you choose to link one | Consent, Art. 6(1)(a) — linking is optional |
| A webhook address an organiser configures | Match events: teams, players named in them, results and times | Feeding an organiser's own systems | The organiser's responsibility as controller |
| Our hosting provider (EU) | Everything, as the operator of the machine | Running the servers | Processor, Art. 28 |
We may also disclose data where the law requires it, or to defend the security of the service.
Transfers outside the EU. SendGrid, Expo, Discord and Valve are in the United States. Transfers rest on the EU Standard Contractual Clauses and, where the provider is certified, on the EU–US Data Privacy Framework. You can ask us for the details (Section 9).
When you delete your account, results other people recorded stay — a match does not lose its score because a participant left — but they are no longer connected to you.
Tap is used for youth sport, so we assume people under 16 use it. Two things follow.
Everything that rests on consent is switched off for them, and cannot be switched on. Art. 8 GDPR applies exactly where processing rests on consent, and Germany has not lowered the age below 16. So a public profile, showing your email address to organisers, linking a game account and sharing your results with followers are unavailable until you turn 16.
We ask for your date of birth when you register, and we use it for exactly one thing: working out whether you have turned 16. It is never shown to anybody, never part of a public profile, and never passed to a third party. We store no flag saying you are a minor — that follows from the date, so the restriction lifts by itself on your birthday. We ask for the full date rather than the year because a year alone would have to be rounded, and rounding up would unlock these settings months before you turn 16.
Taking part does not need an account at all. An organiser can enter a young player in a squad, and then the club — not us — decides what is stored and has the parents' agreement for it. In that case we act on the organiser's instructions.
One gap, named rather than glossed over: the analytics banner appears before you sign in, so it cannot know how old you are. If you are under 16, please decline it.
Under the GDPR you have the right to:
For anything the buttons above do not cover, write to privacy@tap.comae.dev. We answer without undue delay and within one month at the latest (Art. 12(3)).
You also have the right to complain to a supervisory authority (Art. 77) — in Germany, the data protection authority of the state where the operator is based.
When you enter other people's data into TAP, you are the controller and we are your processor. A data processing agreement under Art. 28, our technical and organisational measures, and the list of sub-processors (Section 6) are available on request from privacy@tap.comae.dev.
You must be at least 16 to create an account. If you are younger, your parent or guardian has to give consent. If we learn that we hold data about a child without it, we delete it.
We update this policy when what we do changes. Material changes are announced in the service or by email; the date at the top always says when it was last revised.
privacy@tap.comae.dev for anything in this policy, or the postal address in the Imprint.