Privacy Policy

Last updated: October 21, 2026

This Privacy Policy explains what information the Bracket Pad app and the bracketpad.com website (together the "Service") touch, and what they deliberately do not. Bracket Pad is a tournament bracket maker that works on your device; the one exception is a live link, which you create for a tournament you want others to follow.

1. What we do not collect

Bracket Pad has no user accounts and no registration - there is nothing to sign in to. The app contains no advertising or ad-tracking SDKs, shows no advertising, and never uploads the content you create - unless you create a live link for a tournament, which publishes that one tournament to anyone who has the link. We do not know who you are.

Two things are sent besides purchases (see the app’s network requests): anonymous usage statistics, so we can see how the app is used, and - when the app stops unexpectedly - a technical report, so the broken build can be found and fixed. Neither carries your tournaments, participants or results.

2. What stays on your device

Everything you create in Bracket Pad is stored locally on your phone or tablet:

• tournaments, their formats and settings;
• participant and team names you enter;
• match results, scores and standings;
• score counter games: their players, colors and points;
• app preferences such as the theme.

Deleting the app deletes this data from the device (subject to the platform backups described below). Every feature except the live link works offline, and none of this data is transmitted to us unless you share a tournament as a live link.

Participant names are typically the first names or nicknames of people around you. They are entered by you, stay on your device, and appear only where you put them - in the bracket, in images you choose to share, and on the live page of a tournament you choose to share as a link.

3. Device backups

So that your tournaments survive a lost phone or a reinstall, the app relies on the storage your platform already gives you - your own Apple or Google account, never a server of ours:

• iOS: tournament and score counter game files are mirrored into the app’s iCloud Drive container of your Apple account. Apple processes this data under its own terms; we never see it.
• Android: the app’s data is included in Android Auto Backup to your Google account, under Google’s terms; we never see it.

You can disable these backups in your device settings (iCloud Drive for iOS, Backup on Android). You can also export any tournament as a file and keep it wherever you like.

4. Purchases

Paid unlocks (Tournament Pass, Yearly, Lifetime) are sold through the Apple App Store and Google Play. Apple or Google process the payment; we never receive your name, email address or payment card details.

To recognize a purchase and restore it, the app uses RevenueCat, a subscription-management service acting on our behalf. RevenueCat starts with the app, so every installation gets an anonymous identifier there, whether or not you buy anything. It receives that identifier and the purchase receipt if you buy - not your name and not your email address, because the app never asks for them. On iOS it also receives Apple’s anonymous attribution token, which tells whether the installation came from an Apple Ads campaign, and the app gives it the anonymous identifier that Firebase Analytics holds for your installation (see section 5), so that a purchase can be matched to the usage statistics of the same installation. The RevenueCat library can also send RevenueCat technical diagnostics about its own work - how long its requests take, whether it answered from its cache, which errors it hit; they carry nothing you typed and nothing about your tournaments. Besides the records described in section 5, this is the only record connected with your use of the app that exists off the device. To cancel an auto-renewing plan, use your App Store or Google Play account settings.

5. The app’s network requests

Bracket Pad makes four kinds of network request on its own, all about keeping the app working and understanding how it is used - none of them carries your tournaments, participants or results - and a fifth only when you ask for it:

• Update check. The app occasionally asks the store it was installed from (Apple’s public app-lookup endpoint on iOS, Google Play on Android) which version is currently listed. The request identifies the app, not you.
• Remote configuration. The app fetches a minimal configuration from Firebase Remote Config (Google) - the minimum supported app version and the store link shown if a broken build must be stopped. Like any internet request, it is served over a connection where Google processes standard request metadata such as an IP address.
• Usage statistics. The app uses Firebase Analytics (Google) in a privacy-limited mode: its advertising features are switched off, the advertising identifier is not collected, and no account or name is attached. It records which screens are opened and which buttons are tapped - for example that a tournament was created, its format and number of participants, which plan was looked at, whether a purchase finished, which language or theme was picked - as counts and fixed labels, together with the technical data Google’s SDK adds to any request: an identifier generated for your installation (on iOS also the identifier Apple gives all apps of one developer), the device model, the OS and app version, the language, and the country and city derived from the IP address. It is how we learn how far people get and whether a feature is worth its work. During the first-launch questions you can choose Something else and type what you organize (for example a sport); if you do, that text - up to 100 characters - is sent too, and the dialog says so. Nothing else you type is sent.
• Crash reports. When the app crashes, or an action inside it fails, Firebase Crashlytics (Google) sends a technical report - the stack trace, the device model, the OS and app version and an identifier generated for your installation - at the moment of the crash or on the next launch. The app adds a few labels to it: the language of the device and of the app, the country of your App Store account (iOS), whether it is a development or a release build, and the anonymous RevenueCat identifier of your installation, so that a crash can be looked up next to that installation’s purchase record. Crashlytics also attaches the latest usage-statistics events before the crash, which includes the Something else answer above if you typed one. It is how we learn that a build is broken for someone, since the app has no other channel back. Nothing else you typed is in it: no participant names, no tournament content.
• Live links, only when you create one. From a tournament’s share menu you can create a live link and a QR code, so that others can follow that tournament in a web browser. When you do, the app uploads that tournament - its name, format, participant and team names, results and scores - to Cloud Firestore (Google Firebase) under a random link code, and uploads it again after every change you make to it. Anyone who has the link or scans the code can view it on bracketpad.com; it is not listed anywhere, and search engines are asked not to index it. So that only your device can update or remove it, the app signs in to Firebase Authentication (Google) with an anonymous identifier generated for your installation - no name, no email address, no account. Firestore keeps the shared copy in Google’s data centers in the United States, and Google sees the IP address of the device that signs in or uploads, as with any request. The shared copy is deleted when you tap Stop sharing or delete the tournament; 90 days after its last update the page stops showing it and it is deleted automatically. Tournaments you do not share are never uploaded.

6. Sharing images

When you share a bracket or standings image, the app renders it on your device and hands it to the system share sheet. Where it goes - a chat, an email, your photo library - is entirely your choice, and the app neither sees nor records the destination.

7. This website

bracketpad.com is a static site. It sets no advertising or analytics cookies. Your theme choice (light or dark) is kept in your browser’s local storage and never leaves your browser. The site is served by a hosting provider that processes standard server logs (such as IP addresses) to deliver and protect the site.

A live tournament page (bracketpad.com/t/…) loads the shared tournament from Cloud Firestore (Google) in your browser and keeps listening for updates while it is open; Google processes standard request metadata, such as an IP address, to serve it. These pages set no cookies and run no analytics.

8. Children

Bracket Pad is not directed to children under 13 (or under 16 in the European Economic Area), and - having no accounts and collecting only anonymous technical data - does not knowingly process personal data of anyone, beyond the participant names in a tournament its organizer chose to share as a live link. If you believe a child’s personal data has reached us - through support email or on a live page - contact us (send the link for a live page) and we will delete it.

9. Your rights

Where the EU or UK GDPR applies, the legal bases are: our agreement with you (the Terms of Use) for purchases and for publishing a live link you create; our legitimate interest in keeping the app working and learning how it is used, for the update check, remote configuration, usage statistics and crash reports, none of which carries your tournaments; and, for participant names on a live page, the legitimate interest of the organizer who shares the tournament and of the people following it, balanced by the right of anyone on the page to have it removed (below). Google (Firebase) and RevenueCat may process data in the United States, under safeguards such as the European Commission’s standard contractual clauses.

Depending on where you live (for example under the EU/UK GDPR or the California CCPA), you have rights over personal data - access, correction, export, deletion. Because your content stays on your device unless you share it as a live link, exercising them is mostly in your own hands: the data is yours, on your hardware, and a live link stops with Stop sharing. If you appear on someone else’s live page and want to be removed, send us the link. For the anonymous records held by RevenueCat and Google (purchases, usage statistics, crash reports), or anything you have sent us by email, contact us (see Contact) and we will help.

10. Changes to this policy

We may update this Privacy Policy from time to time - for example if a future version of the app adds an online feature. When we do, we will revise the "Last updated" date above and, where the change is material, say so in the app’s release notes before it takes effect.

11. Contact

The operator of the Bracket Pad app and website, and the controller for the little personal data described above, is Individual Entrepreneur Yevhen Troshchii. Questions about this policy or your data: .