Security & Trust

• Google, Apple, and email/password sign-in via a managed auth provider.
• Passwords checked against the Have I Been Pwned database on signup and change (leaked-password protection).
• Sessions managed by the auth provider with automatic token refresh; sign-out clears cached data.

• Row-Level Security is enforced on every table so each account can only read and modify its own data.
• Administrator role is stored in a separate roles table and checked via a security-definer function — never on the profile record.

• Data in transit over TLS.
• Data at rest encrypted by the managed cloud database.

• Create/update/delete events on matches, players, opponents, tournaments, and profiles are recorded to an append-only audit log with actor, entity, and timestamp.
• Audit log visible only to administrators.

• Export: download a JSON bundle of your data from Settings.
• Delete: permanently delete your account and cascade-delete all associated match data from Settings.
• Security/audit records retained up to 12 months.

• Server-side input validation on privileged endpoints.
• No third-party analytics or advertising trackers.
• Public read-only pages are the only unauthenticated surface; all match data lives behind login.

Managed cloud platform controls (infrastructure, database encryption, patching) are provided by our hosting provider. Application-level controls (RLS, audit trail, data export/delete) are provided by CourtTalent. Account-level controls (strong password, keeping devices secure) are your responsibility.