Privacy Policy

Last updated: 2026-09-29

This policy covers the TournyON mobile app (iPhone and Android) and the Chartland Elite web app at chartlandelite.web.app (this site). Both apps share one backend on Google Firebase, run by Chartland Elite. It explains what the apps store, who can see it, and how to delete it. It describes TournyON version 1.6.1.

What we collect

1. A user ID for every device and browser. When you open the mobile app or this website, it signs in to Firebase Authentication anonymously and gets a random user ID. No name or email is attached to it unless you sign in (next item). The user ID is how our database tells devices apart and decides who may change what.
2. Sign-in: name, email address and user ID. Players do not need to sign in. To start and run your own league in TournyON, you sign in with Sign in with Apple on iPhone or with Google on Android. Firebase Authentication then stores your name and email address on your account. With Sign in with Apple you can choose to hide your email, in which case we only get Apple’s relay address, and Apple shares your name only if you let it. With Google, your account also keeps the link to your Google profile picture. On this website, the Google sign-in button on the admin page does the same: it creates a Firebase account with your Google name, email address and profile picture link, even if you turn out not to be an admin. A league is run by its owner, identified by user ID, and by anyone whose email address is listed as one of its admins. So if you are made an admin of a league, your email address is saved on the league’s record.
3. League memberships. When you join a league with its invite code, we store a membership record under your user ID: the league, when you joined, and the invite code you used.
4. “This is me” player claims. If you mark a player on a league’s roster as yourself, we store your user ID with that player’s name, so notifications about your matches and sessions reach you.
5. Push notification tokens. If you allow notifications, the app stores your device’s push token (an identifier Apple or Google issues for delivering notifications) under your user ID. We use it only to send you league notifications, such as session reminders, waitlist and cancellation updates, and league announcements.
6. League content. Organizers and members enter the content of a league: its name and settings, rosters of player names, teams, match scores, the standings and ratings calculated from them, tournament history, session and event details (date, time, place, cost and, if the organizer adds one, an email address for e-transfer payments), and announcements.
7. Invite records on rosters. For some leagues, our administrator records on a player’s roster entry who vouched for them and an invite tier (1, 2 or 3). The voucher is another player on the roster or, for the league’s first players, the email address of the league owner or admin who brought them in. These are written from this website’s admin console, not from the mobile app.
8. Session sign-ups and late cancellations. A sign-up stores the name entered, when it was made, how many guests it brings and, if an admin marks it, whether that person has paid. When someone cancels a spot shortly before a session, the app keeps a late-cancellation record with the name and the time. From these records the app shows league admins a reliability count for each player: sessions attended and late cancellations.
9. User IDs on records. Sign-ups, late-cancellation records, sessions and announcements created in the app also record the user ID of the device that created them.
10. Crash reports (mobile app). When the mobile app crashes or hits an error, it sends a report to Google Firebase Crashlytics so we can fix it. A report contains details such as the error, the device model and state, the operating system and app versions, and installation IDs generated by Firebase. The app does not attach your user ID, name or email to crash reports. Crash reporting is always on; the app has no setting to turn it off.
11. Sign-in logs. Firebase Authentication logs the IP addresses used to sign in, and keeps them for a few weeks.
12. Data kept on your device. The apps keep some data only on your phone or in your browser: the list of leagues you joined, your home league, your team picks and display preferences, and in the web app the player you picked as yourself, cached tournament data and any score-entry codes you typed. These stay on your device.

What we do not collect

• We do not access your location, contacts, photos, camera, microphone, calendar or health data, and we collect no payment information. There are no in-app purchases.
• We never see a password: sign-in goes through Apple or Google.
• Neither app contains analytics or usage-tracking software. Firebase Analytics is not used.
• There are no ads and no advertising identifiers, and we do not track you across other companies’ apps or websites.
• We do not sell, rent or share any data with advertisers or data brokers.

Who can see your data

• League content is public. Anyone can read it, including people who use neither app: our database allows reading it without signing in. That covers player names, teams, scores, ratings, standings, tournament history, schedules, session details, sign-ups and late-cancellation records (with their names and user IDs), and announcements. An invite code controls who can join a league and take part, not who can read it. Do not put anything in a league that you would not want seen publicly.
• “This is me” claims are public in the same way, so anyone can see which roster player a user ID has claimed. Admin email addresses saved on a league’s record are public in the same way too, and so are the invite records on rosters: who vouched for each player (including an owner or admin email address, where that is the voucher) and their invite tier.
• Membership records are private: only you and the league’s admins can read them.
• Push tokens are private: only you and our servers can read them.
• The name and email on your sign-in account are not shown to other users.
• We, the maintainers, can see all of the above, and the crash reports, in the Firebase console. We use it only to run and support the apps.

Open Volleyball Toronto

TournyON shows Open Volleyball Toronto’s public league data (league names, schedules, team names, standings and results), with credit to Open Volleyball Toronto. The app shows “League data provided by Open Volleyball Toronto” where it appears, with a link to openvolleyballto.web.app. Our server copies this data from Open Volleyball Toronto’s public website every 15 minutes, and also right after an Open Volleyball Toronto admin saves a change there. The app shows it read-only. To correct it, contact Open Volleyball Toronto.

Services that process data for us

• Google Firebase (Google LLC) runs our backend: Authentication, the Cloud Firestore database, Cloud Functions, Cloud Messaging for notifications, Crashlytics for crash reports, and Hosting for this website. The data described above is stored on Google’s servers. See Firebase’s privacy information.
• Apple provides Sign in with Apple on iPhone and delivers notifications to iPhones.
• Google provides Google sign-in on Android and on this website, and delivers notifications to Android phones.
• When you load this website, Google’s servers process your IP address and browser details to deliver the page, as any web host does.

How long we keep data

• Your account (the user ID, and if you signed in the name and email) is kept until you delete it. After deletion, Firebase removes it from its live and backup systems within 180 days.
• Sign-in IP address logs are kept for a few weeks.
• A membership record is kept until you leave that league or delete your account. Claims are kept until you remove them or delete your account. Push tokens are kept until you delete your account, and a token that Apple or Google reports as no longer valid is removed automatically.
• League content, sign-ups and late-cancellation records are kept as long as the league exists. League admins can edit or delete them, and we delete them on request.
• Crash reports are kept for 90 days, after which Firebase starts removing them from its live and backup systems.

How to delete your account

In TournyON, tap the gear icon, then Settings > Membership > Delete my account. It works for every account, signed in or not, and needs an internet connection. If you signed in with Apple or Google, you confirm with Apple or Google first. Deleting your account, in this order:

• removes your “this is me” claims and membership records in the leagues this device joined, and your push tokens;
• removes you as an admin of any league, and as the owner of leagues you created;
• deletes your Firebase Authentication account, with its user ID, name and email address;
• clears the app’s data on your phone.

If you signed in with Apple, the app also asks Apple to revoke its sign-in token, so TournyON no longer has access through your Apple ID. That request, and each clean-up step above, is best effort: if one fails (for example, the connection drops part way), the rest still run and your account is still deleted. If you think something was left behind, email us and we will finish it.

Leagues you own are not deleted. They stay visible to their members, without an owner. If a league has other admins, they can keep running it; if it has none, no one can run it until we step in. The app names these leagues before you confirm. To have a league deleted or handed over to someone else, email TournyON@staim.ai, ideally before you delete your account.

In-app deletion only reaches records tied to the account you delete, in the leagues this device joined. It does not remove records made from another device, or under an earlier user ID (for example, before you reinstalled the app). League content also stays with the league, because it is part of records other members share: rosters, scores, ratings, sign-ups, late-cancellation records and announcements, including ones you entered. Records you created keep your old user ID, which no longer belongs to any account. To have any of these removed, ask the league’s organizer or email us. Crash reports are not tied to your account, so deletion does not touch them; they stay until Firebase removes them (see How long we keep data).

The web app has no delete button. Every browser that opens it gets an anonymous account, and signing in on the admin page creates a Google-linked one. To delete either, or to have a player name that an organizer entered removed, email TournyON@staim.ai. To remove what the web app keeps in your browser, clear this site’s data in your browser settings.

Children

Neither app is directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, or a child’s name is on a league roster without a parent’s consent, email us and we will delete it.

Changes

If this policy changes materially, the “Last updated” date above will change.

Contact

Questions or deletion requests: TournyON@staim.ai