Privacy Policy

This Privacy Policy explains what personal data CubeManager collects, why, who processes it, how long it is kept, and the rights you have under the EU General Data Protection Regulation (GDPR).

Who is responsible for your data

The data controller is the operator of CubeManager, identified in our Legal Notice. For any question about your data, or to exercise your rights, use the contact form or the email address given there.

When an organizer enters information about a competitor — for example to register someone on their behalf — the organizer must have the right to do so. CubeManager uses that information only to run the competition.

Information we collect

• Account information — your name, email address and password when you create an account; optionally a username, phone number, bio, timezone, language and avatar. Passwords are stored only as a one-way hash.
• Competition data — registrations, results and what you submit while organizing or competing, including a competitor's name, date of birth, gender and country (used for age categories and rankings).
• Sign-in with a social account — if you sign in with Google or another provider we offer, we receive your account identifier, name, email address and avatar from that provider. We never receive your password.
• Security information — your browser, operating system and IP address, used to protect your account. We remember the browsers you sign in from so we can email you when a new one is used. When you accept a legal document we record the time, IP address and browser as proof of consent.
• Messages and feedback — what you send through the contact form or the feedback button. Technical details (page, browser, app version) are attached to feedback only if you tick the box to include them.

How we use it, and on what legal basis

• To provide CubeManager: your account, competitions, registrations, schedules, results and certificates (performance of our contract with you).
• To keep the service and your account secure, and to prevent fraud and abuse (legitimate interest).
• To send you the emails the service needs — verification, password reset, security alerts, updates about your competitions — and the optional notifications you choose in your settings.

We do not sell your data, we show no advertising, and we use no analytics tools or tracking cookies. Nothing can be bought on CubeManager during the beta, so we hold no payment data.

What is public

On a published competition, and on your public competitor profile, other people can see your name, country, gender, avatar and results. Your date of birth, email address and phone number are never shown publicly.

Minors

Dates of birth are used for age categories. A competitor under 18 on the day of a competition who registers themselves must confirm that a parent or guardian consents. A parent or guardian can also ask to manage a child's competitor profile from their own account; every request is reviewed by an administrator.

Who processes your data

A small number of service providers process personal data on our behalf, only to provide the service:

• OVH SAS (France) — hosts the application, the database and uploaded files, in a data centre in France.
• Amazon Web Services EMEA SARL — sends our emails through Amazon SES, from its Paris (EU) region.
• Cloudflare, Inc. — runs our domain name (DNS) and forwards the emails you send to our addresses.
• Functional Software, Inc. (Sentry) — when error monitoring is switched on, receives technical error reports, which can include your user ID; names and email addresses are not sent.
• Cloudflare Turnstile — when the anti-spam check is switched on for a form, checks that the form is sent by a person.
• Social sign-in providers — when you choose to sign in with one, under their own privacy policies.

Transfers outside the European Union

Cloudflare and Sentry are based in the United States. Transfers to them rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses. The rest of the data we hold is stored in the European Union.

How long we keep it

• Account data: while your account exists; erased when you delete it.
• Password-reset codes: 24 hours. Inactive sessions are removed automatically.
• Browsers you sign in from: removed after 180 days without use.
• Contact messages: the IP address is removed after 12 months, handled messages are deleted after 24 months, and messages marked as spam after 90 days.
• Feedback: 24 months.
• In-app notifications: 180 days.
• Identity documents sent with an organizer application: 30 days.
• Records of administrative actions: 36 months.
• Consent records: while your account exists, as proof of acceptance.
• Backups: each nightly backup is deleted after 30 days, so erased data disappears from backups within that time.

Your rights

• Access and portability — download a complete, machine-readable copy of your data at any time from Settings → Legal → Download my data.
• Rectification — correct your information at any time from your profile.
• Erasure — delete your account yourself from Settings → Account → Danger Zone. Results of published competitions stay in the sporting record, without the link to your account.
• Objection and restriction — ask us through the contact form.
• Complaint — you can complain to the data-protection authority of the country where you live; in France, the CNIL.

We answer within one month.

Security

How accounts and data are protected is described on Security & your data.

Changes

When we change this policy in a way that matters, we publish a new version and ask you to accept it.