Trust center

What data we use

To build the draws and run the tournament we use, for competitors: name, gender, date of birth, nationality, grade, height, weight, school and the categories they entered. For coaches: name, date of birth and school. On the tournament day, attendance and results are added.

The data comes from the entries in Sportdata. We deliberately do not import email addresses, postal addresses, ID numbers or photos, and we do not keep the original export file.

Who can see what

Schools and administrators sign in with their own personal account. A school only sees its own competitors and coaches. Tournament administrators see what they need to organise the tournament.

On the tournament day, the jury tables and the announcer use an account that can only open their own screen, with only the data they need there.

The public timetable only shows name, school and pool (ring and time), and only after the organisation has published it. That site runs as a separate service with read-only access.

For every action, the server checks again who you are and what you are allowed to do. This does not depend on anything in the browser.

Signing in and accounts

You choose your own password through a personal link that is valid for seven days and works only once. We never send passwords.

Passwords have at least ten characters and are stored as an scrypt hash: nobody can read them back, administrators included.

Sign-in attempts are limited (five per fifteen minutes per account and network) to prevent password guessing.

After signing in you get a signed session cookie that is only sent over a secure connection and cannot be read by scripts in the browser. If an account is disabled or gets a different role, it is signed out everywhere within a minute.

Secure on Google Cloud

The application runs on Google Cloud Platform in the europe-west4 region (Eemshaven, the Netherlands). The database (Firestore), the file storage and the application itself are all in that region.

Google encrypts all stored data by default (AES-256). All traffic to and from the application uses HTTPS.

The application runs on Cloud Run, a managed environment whose servers Google maintains and secures. The application itself has no administrator rights there.

The database cannot be reached directly from a browser or app. Only the application has access, through its own service account that can only use its own database and its own storage. The file storage is private; public access is switched off.

Secret keys are kept in Google Secret Manager, not in the code.

Google Cloud is certified to ISO/IEC 27001, 27017 and 27018 and is independently audited (SOC 2 and SOC 3). Google processes the data in line with the GDPR, under the Cloud Data Processing Addendum.

Backups and recovery

The database can be restored to any moment in the last seven days and is protected against accidental deletion. Deleted files remain recoverable for seven days.

Cookies

We only use necessary cookies: to keep you signed in and to remember your language (and a few display settings for administrators). There are no cookies or scripts for analytics or advertising.

Questions

Schools can view their competitors' data and submit changes in the school environment. For other questions about your data or about security, please contact the Battle of the Lowlands organisation.