Privacy Policy

Version 4.0 — effective 15 September 2026

Custom Elo Games is a hosted Elo ranking tool. This policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it.

Custom Elo Games is operated by Nicholas Green, an individual trading as Custom Elo Games, from New South Wales, Australia. In this policy, "we", "us" and "Custom Elo Games" mean Nicholas Green trading as Custom Elo Games, and "you" means anyone who uses customelogames.com, holds an account, or appears as a Player in a Game.

1. Contact

For anything about privacy — questions, access requests, deletion requests, complaints:

Email: dev@customelogames.com

We respond to privacy requests within 30 days.

2. What this policy covers

This policy covers the Custom Elo Games application at customelogames.com.

It does not cover:

• What other people do with what they see. Everyone in a Game can see its roster, results and leaderboard, and so can anyone at all if an Admin makes the Game public (section 4.3). What they then do with that information is outside our control, though our Terms of Service forbid the people in a Game from disclosing it outside the Game except by making it public.
• Google. If you sign in with Google, your relationship with Google is governed by Google's own terms and privacy policy. Google gives us only your name, email address and profile picture, and we keep only the first two.
• Other websites. Anything linked from Custom Elo Games is hosted elsewhere by third parties.

3. Age requirements and young people

You must be at least 13 years old to hold a Custom Elo Games account.

If you are under 18, a parent or guardian must read and accept our Terms of Service on your behalf and supervise your use of Custom Elo Games.

How we check. When you first sign in, before you can use the app, we ask you to declare that you are 13 or over and whether you are 18 or over. We do not ask for, and never store, your date of birth — we store only those two true/false answers and the moment you gave them. We cannot verify a declaration, and we do not pretend to. We rely on it, and on being told when it is wrong.

If we learn an account holder is under 13, we will delete the account and its personal information without delay, and will not use that information for any other purpose in the meantime.

Protections we apply to everyone. Rather than reserve these for young people, we apply them to every user of Custom Elo Games without exception, and offer no way to turn them off:

• We collect only what is necessary to operate the service. There are no optional data collections.
• We do not profile users, serve advertising, or use engagement-maximising design features.
• We do not sell, share, or disclose personal information for marketing, and we do not disclose it for cross-context behavioural advertising.
• We do not use your information to build a picture of you beyond what the app visibly shows.

These are statements of what we do today, written as universal promises because we deliberately do not track which of our users are minors. If any of them ever ceases to be true, that is a change to this policy, made under section 15 with notice — not something that can quietly happen.

We consider the best interests of the child when deciding whether and how to collect, use or disclose personal information about anyone under 18. A parent or guardian may exercise any of the rights in section 10 on a young person's behalf.

4. What we collect and where it comes from

4.1 Account information

Collected directly from you when you sign up or update your profile:

• First name and last name
• Email address
• Password (stored only as a salted hash by Supabase Auth; we never see or store your password in readable form)
• An avatar image, if you upload one
• Whether you declared yourself to be 13 or over, and 18 or over, and when you declared it
• The version of our Terms of Service you accepted, and when

If you sign in with Google instead of a password, we take your name and email address from Google, and no password exists for us to store. Google also offers us your Google profile picture, and we deliberately do not keep it — it is a publicly reachable image hosted on Google's servers, which would contradict the private-storage promise below. Signing in with Google leaves you with no avatar until you upload one, exactly like everyone else.

If you sign up with a password, we email you a link to confirm the address is yours before you can carry on. Account emails — that confirmation, password reset, and email-change confirmation — are sent by Supabase on our behalf, and delivered through Resend.

Your avatar image is stored privately. It has no public URL and is not visible to anyone but you: it appears in your own site header and on your own settings page, and no other user of Custom Elo Games is shown it anywhere. It is loaded through short-lived signed links issued only to you.

4.2 Games, Players and Matches

This is the substance of the app, and almost all of it is entered by hand:

• Games — the name, the Mode, the K-factor and other settings, the time zone it is played in, whether an Admin has made it public, and who created it.
• Members — which users belong to which Games, and whether they are an Admin, an Editor or a Member.
• Join links — when an Admin turns on a Game's join link: the link's code, which Admin turned it on and when. It is deleted when the link is reset or turned off, and with the Game.
• Join Requests — which user asked to join which Game, when, whether it was approved or denied and by whom.
• Invites — when an Admin invites someone to a Game: the email address they entered, the role offered, who sent it and when. We email that address a link to accept, and delete the Invite, address and all, the moment it is accepted, declined or cancelled; an expired Invite is deleted the next time anyone sends, opens or answers an Invite. The address may belong to someone without an account; we use it for nothing but that one invitation. We also note the time of each invite an Admin sends, without the address, to hold each Admin to 20 a day.
• Players — a free-text name on a Game's roster, added by an Admin or Editor, or copied from Rankade when an Admin imports a group's history from there (section 4.7). See section 4.3.
• Matches — who took part, the order they finished in, a display-only score, when it was played, and which user created, edited or deleted it.
• Rating snapshots — each Player's Elo rating after each Match, which is what the leaderboard and the rating graph are drawn from.
• A per-Game activity log — a record of destructive and history-altering actions (a Game imported from Rankade, made public or private, or moved to another time zone, an Invite sent, accepted, declined or cancelled — recorded without the invited address — a join link turned on, reset, used or turned off, a member's role changed, a Match edited or deleted, a Player added, renamed, archived or purged), recording which user did it, when, and enough detail to reconstruct what changed. This exists so that a Game's history can be explained after the fact, including where the records that would have explained it are gone.

4.3 Players: information about people who do not have accounts

A Player is a name for a real person — typed in by an Admin, or copied from Rankade when an Admin imports from there — who usually has no account here. A Player has no login, and no connection to any account, even when the person behind the name also uses Custom Elo Games. Alongside the name we hold everything the app derives from it: Matches they took part in, finishing positions, scores, and their Elo rating over time.

That person did not agree to this with us, and typically has not been shown this policy. We handle that as follows:

• We are responsible for this information. We do not treat Admins as independent controllers who merely instruct us. We designed the roster, we decided a Player is a name and nothing more, and the responsibility for holding it is ours.
• We hold it on the basis of legitimate interests — a leaderboard cannot be drawn with gaps, and the whole purpose of a Game is to record who played whom.
• We keep it to a minimum by design. A Player has a name and a competitive record, and there is no field for anything else. Our Terms of Service require Admins to use a nickname or initials where the person would prefer not to be identified, and forbid entering sensitive information anywhere in the app.
• It is private unless an Admin makes the Game public. A Player's name and record are visible to the Admins, Editors and Members of that one Game. Games are fully isolated from each other. An Admin may make a Game public, and then anyone with its link can see its roster, results and rating graph without an account, until an Admin makes it private again. We ask search engines not to index those pages, never show who the Game's members are, and our Terms of Service require Admins to make a Game public only if the people on its roster are happy to be seen.

We cannot practicably contact every person named on a roster to give them individual notice, so we publish this policy instead. If you are one of these people, section 10 applies to you in full — you can ask us what we hold, correct it, or ask us to delete it, and you do not need an account to ask. Start by asking an Admin of the Game to remove you; if you cannot reach them or they refuse, email us and we will do it.

4.4 Contact form

If you use our contact form we collect the name, email address and message you enter. That message is emailed to us by Resend so we see it promptly, and we use it only to reply to you and to fix whatever you told us about.

4.5 Technical data

Our hosting provider records ordinary server logs — IP addresses, request paths, timestamps and errors — as a necessary part of serving the site securely. We do not combine these with your account to build a profile of your behaviour.

4.6 What we do not collect

To be explicit, because their absence is the point:

• No payment information of any kind. Custom Elo Games is free, has no payment system, and will never ask you for card details.
• No date of birth — see section 3.
• No analytics, advertising, or tracking technology. We do not use Google Analytics, Meta Pixel, or any equivalent.
• No location data, no device fingerprinting, no contact list access.

4.7 Importing from Rankade

An Admin can bring a group's history across from Rankade, another ranking site, rather than typing it in. To do that they give us their Rankade group's API key and secret. Here is what happens to each part of it:

• The key and secret are sent to Rankade's API over HTTPS while the import runs, and used only to read that group's games and matches. We never store or log them. Once the import finishes or fails they are gone, and we recommend the Admin regenerates the secret on Rankade afterwards.
• What we copy — for each Rankade game the Admin picks: the names of the people who played in it, as Rankade shows them; who finished where in each match; each side's score; and when each match was played. These become Players and Matches in new Games, exactly as if the Admin had typed them in, so sections 4.2, 4.3 and 10 apply to them in full.
• What we do not copy — Rankade's own ratings, email addresses, usernames, profile pictures, match notes, or anything else Rankade holds.
• A record of the attempt — which account tried an import and when, so we can limit how often one account can try. It holds nothing about the Rankade group.

Rankade is where this information comes from, not a service provider we share your information with: the only thing we send Rankade is the key and secret the Admin gave us. What Rankade itself holds is governed by Rankade's own privacy policy.

5. Our role

We are the controller of all personal information in Custom Elo Games, in the sense that word has under the GDPR: we decide what is collected and how it is used. That includes Player names entered by Admins.

We have deliberately not adopted the arrangement where the person running a Game is the controller and we merely process on their behalf. That structure suits a platform where each customer designs their own data collection; here the schema is fixed and narrow, and we chose its shape. Claiming otherwise would put the responsibility on an individual running a board-game night, without an agreement to back it, and leave you worse off.

Admins still carry real duties to the people on their roster, set out in clause 6 of our Terms of Service. Those are obligations we impose on them as users — not a transfer of our responsibility to you.

6. Cookies and tracking

We use very little here, deliberately.

All of these are strictly necessary to provide a service you have asked for. We do not use cookies for advertising, profiling or cross-site tracking, so we do not show a cookie consent banner. There is nothing to consent to.

We run no analytics of any kind — no page-view tracking, no session recording, no performance monitoring beyond what our host does at the network level.

7. Who we share information with

We do not sell personal information. We share it only with the service providers below, only for the purposes listed, and only to the extent needed.

We may also disclose personal information:

• To the Admins, Editors and Members of a Game you belong to — your name, and, where you are also on the roster as a Player, your results and rating.
• To anyone, for a Game an Admin has made public — its roster, Match history, leaderboard and rating graph, but never the names of the users who belong to it (section 4.3).
• Where the law requires it — in response to a valid legal request, court order or regulatory demand.
• To protect people — where we reasonably believe disclosure is necessary to prevent a serious threat to someone's life, health or safety.
• To a buyer, if Custom Elo Games is ever sold or transferred, subject to that buyer being bound by terms no less protective than this policy. We will notify you before any such transfer takes effect.

Internal access. Custom Elo Games is run by one person. Access to production data is limited to what is needed to operate, support and secure the service, and is protected by multi-factor authentication.

8. Sending information overseas

Custom Elo Games runs on infrastructure outside Australia. Our database, authentication and file storage are hosted in India (Mumbai), and the other providers in section 7 are based in the United States. So yes — your personal information is stored and processed overseas.

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, as required by APP 8. In practice this means using established providers with published privacy commitments and data processing terms.

For users in the European Economic Area or the United Kingdom, this needs saying plainly: India is not covered by a European Commission adequacy decision. Neither is Australia, and neither is the United States for a provider not certified under the Data Privacy Framework. Transfers of your information to every provider in section 7 therefore rely on the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum where relevant), which are incorporated into the data processing agreement each provider offers and which we have accepted. We rely on no adequacy decision anywhere in our stack.

We have not appointed a representative in the EU or the UK.

9. Why we use your information, and our legal basis

Under Australian law, the corresponding obligations are in APP 3 (collection), APP 5 (notice), APP 6 (use and disclosure), APP 8 (overseas disclosure), APP 10 (accuracy), APP 11 (security) and APPs 12 and 13 (access and correction).

Where we rely on legitimate interests, we have assessed our interest against your rights and concluded the processing is proportionate. You can object — see section 10 — and we will stop unless we have compelling grounds not to.

10. Your rights

These rights apply to everyone, wherever you live — including people who appear as Players without an account. We have chosen not to make them depend on your jurisdiction.

You can ask us to:

• Tell you what we hold about you and give you a copy.
• Correct anything inaccurate, out of date or incomplete.
• Delete your personal information. See below for what deletion does and does not remove.
• Give you a portable copy of the information you provided to us, in a machine-readable format.
• Restrict or object to particular processing, including anything we do on the basis of legitimate interests.

Some of this you can do yourself, right now, without asking us:

• Delete your entire account from your settings page. This is real deletion, not deactivation, and it happens immediately.
• Correct your name and replace or remove your avatar, also from settings.
• Leave a Game you no longer want to belong to.

For everything else, email dev@customelogames.com. There is no self-service export in the app — a person assembles it by hand. We may ask you to confirm your identity, using the email address on your account, before we act.

Timing. We acknowledge requests within 5 business days and complete them within 30 days. If a request is complex and needs longer, we will tell you why and when to expect a response.

Cost. Free. We do not charge for access, correction or deletion requests.

What deletion removes. Deleting your account removes your profile, your credentials, your avatar image, your age declaration and terms acceptance record, your Game memberships and Join Requests. Where you were the last remaining Admin or Member of a Game, that Game is deleted outright, along with its entire roster and Match history.

What deletion does not remove, and why. Where a Game still has other members, it continues to exist and its Match history remains, because that history is a shared record of a competition involving other people — removing your account does not unmake the results they played. Your name is detached from the Matches you created or edited. Entries in a Game's activity log remain but no longer identify you. Separately, deleting your account does not delete a Player of the same name from a roster: those are different things, and a Player is removed by an Admin of that Game, or by us on request under section 4.3.

Complaints. If you are unhappy with how we have handled your information, tell us first at dev@customelogames.com. If we do not resolve it:

• Australia — Office of the Australian Information Commissioner, oaic.gov.au, 1300 363 992.
• EEA — your national data protection authority.
• United Kingdom — Information Commissioner's Office, ico.org.uk.

11. How long we keep things

We would rather describe how deletion actually works here than publish a table of retention periods we have no scheduled job to enforce. Custom Elo Games runs no automated purge tasks. What it has instead is a schema that deletes thoroughly and immediately when something is deleted:

If you want something gone sooner than the above, ask us and we will delete it.

12. How we protect your information

• Passwords are hashed by Supabase Auth. We never store them in readable form.
• All traffic is served over HTTPS.
• Database access is controlled by row-level security, so users can only reach records they are entitled to. A Game's roster and history are unreachable by anyone outside that Game.
• Avatar images are held in private storage with no public URL, reachable only through short-lived signed links issued to the person the image belongs to.
• Card data never touches our systems, because we have no payment system at all.
• Administrative access to hosting, database and domain accounts requires multi-factor authentication, and is limited to one person.

No system is perfectly secure. Custom Elo Games is a one-person operation, and we would rather tell you what we actually do than promise more than we can deliver.

13. Data breaches

If a data breach occurs and we assess that it is likely to cause serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware, and notify affected individuals without undue delay where the risk to their rights is high.

Our notification will tell you what happened, what information was involved, what we are doing about it, and what we recommend you do.

14. Automated decision-making

We do not make automated decisions about you that have legal or similarly significant effects. Elo ratings, leaderboard positions and win rates are calculated arithmetically from Match results that a person entered by hand. Nothing in Custom Elo Games decides anything about you: no account is suspended, no Player removed and no result changed except by a human.

15. Changes to this policy

We will update this policy when what we do changes. The version number and effective date at the top will change, and for any change that materially affects your rights or how we use your information we will notify you by email and in the app before it takes effect.

16. Third-party terms that also apply to you

• Supabase — supabase.com/privacy
• Vercel — vercel.com/legal/privacy-policy
• Google — policies.google.com/privacy
• Resend — resend.com/legal/privacy-policy

---

© 2026 Nicholas Green trading as Custom Elo Games. All rights reserved.