Privacy Policy

RatingRabbit (“we”, “us”, the “Service”) is a match-tracking and player-rating application. For the purposes of the EU General Data Protection Regulation (GDPR), we act as the data controller for the account information you provide. For privacy questions or to exercise your rights, contact us at [email protected].

We collect only what we need to operate the Service:

• Account data (via Firebase Authentication): your email address, display name, authentication provider (e.g. Google or email/password), email-verification status, country (as reported by the sign-in provider), and the time of your last sign-in.
• Group & membership data: the groups you belong to and your role within them (creator, admin, or member).
• Content you create: player names and ratings, recorded matches, sessions, group chat messages, session RSVPs, contact-form inquiries, and group-creation requests.
• Technical data: essential session cookies and authentication tokens, and limited request metadata (such as IP address) used for security, spam prevention, and rate limiting.

We do not use advertising or analytics tracking cookies, and we do not build advertising profiles.

We process your data on the following legal bases under the GDPR:

• Performance of a contract — to create your account, run your groups, record matches, and calculate ratings.
• Legitimate interests — to keep the Service secure, prevent abuse and bots, and respond to your support inquiries.
• Consent — where required, for example before sending optional communications. You may withdraw consent at any time.

We use only essential cookies required to keep you signed in and to operate the Service securely. The contact form is protected by Cloudflare Turnstile, which may set a cookie to distinguish humans from bots. We do not use third-party advertising or analytics cookies.

We share data only with providers that help us run the Service:

• Google Firebase Authentication — manages sign-in and account identity.
• Resend — delivers transactional emails (such as group-approval notifications).
• Cloudflare — provides secure network access and the Turnstile anti-bot check.

Match, rating, and group data is stored on our own self-hosted database. We do not sell your personal data to anyone.

We keep your account and content data for as long as your account is active. When you delete your account, we remove your account record and associated data (memberships, chat messages, RSVPs, contact inquiries, and group requests) as described in Section 8. Player records that are not linked to a user account are anonymized rather than deleted, to preserve the integrity of historical match results for other group members.

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request erasure of your data (“right to be forgotten”);
• request that we restrict or stop processing your data;
• receive your data in a portable format;
• object to processing based on legitimate interests; and
• lodge a complaint with your local data protection authority.

If you are a California resident, the CCPA gives you the right to know what personal information we collect, to request its deletion, and to opt out of its sale. We do not sell personal information. To exercise any of these rights, email [email protected].

You can request deletion of your account at any time from your account settings or by emailing us. On deletion we remove your user record and your rows in group memberships, contact inquiries, chat messages, session RSVPs, and group requests. Because player records contain only a name and ratings and are not linked to your account, we anonymize a player on your explicit request identifying which player represents you (for example, renaming “Bruno” to “Player #7”) rather than deleting the match history.

Some of our providers (such as Firebase and Resend) may process data on servers located outside the European Economic Area. Where this occurs, transfers are protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

We protect your data with industry-standard measures including encrypted connections (HTTPS), authenticated and group-scoped data access, and rate limiting. No system is perfectly secure, but we work to keep your data safe.

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, notify you through the Service.

Questions about this policy or your data? Email [email protected] or use our contact form.