Privacy policy
How Ruski Report handles data
This policy explains the information used to provide tournament viewing, public match comments, account security, moderation, and support.
Who may use the service
Ruski Report is not directed to children under 13. People under 13 may not create an account or post comments. If the operator learns that personal information was submitted by someone under 13, the associated account and information will be deleted. A parent or guardian can contact ruskisupport@gmail.com with a deletion request.
Information collected
- Account information
- Display name, an internal account identifier, account provider, account status, and timestamps. Local passwords are stored only as versioned, salted scrypt hashes; raw passwords are not stored.
- Session information
- A SHA-256 hash of each opaque session token, the account it belongs to, and creation, expiration, revocation, and last-use timestamps. The raw token is kept in the iOS Keychain and is not stored by the backend.
- Public comments
- Comment text, the associated match, author display name and account identifier, creation time, moderation status, and a one-way normalized fingerprint used to detect recent duplicate comments.
- Reports and blocks
- Comment reports include the reported comment, selected reason, optional context, reporter account identifier, workflow status, and moderator decision. Private block records contain the two account identifiers and a timestamp.
- Tournament and upload information
- Official tournament records include roster names, teams, matches, scores, events, standings, brackets, and statistics. Authorized scorebook uploads retain source metadata such as file name, size, checksum, validation results, and publication status. The original workbook bytes are processed for import and are not stored as a database file.
- Operational information
- The service may process request timestamps, routes, outcomes, request identifiers, and limited error details for security and reliability. Hosting or encrypted-traffic providers may process IP addresses and connection metadata when delivering a request. Application logs are designed not to contain passwords, session tokens, comment text, report context, or reporter identities.
- Support correspondence
- Information a person chooses to include in an email to Ruski Report support, along with the email address needed to respond.
How information is used
- Provide official tournament views and live updates.
- Create accounts, authenticate sessions, and secure access.
- Publish comments under the author’s chosen display name.
- Filter spam and prohibited content.
- Process reports, blocking choices, and moderation decisions.
- Diagnose failures, protect the service, and answer support requests.
Ruski Report does not use third-party analytics, advertising SDKs, or cross-app tracking. Personal data is not sold and is not used to build advertising profiles.
When information is public or shared
Official tournament records are public. A posted comment, its timestamp, and the author’s chosen display name are public within the associated match. Report details, reporter identities, account credentials, sessions, and block relationships are not public.
Limited information is processed by service providers only as needed to operate Ruski Report. GitHub Pages hosts these policy pages, Google processes support email sent to the Gmail address, and Apple distributes the iOS app. Cloudflare provides DNS, TLS, and encrypted tunnel delivery for the production API and may process IP addresses, connection and request metadata, and request content in transit as needed to deliver and secure app traffic. Amazon Web Services stores client-side encrypted rotating backups in S3, runs external availability checks, retains content-minimized monitor logs in CloudWatch, and sends operator alarms through SNS. AWS does not receive the separate password needed to decrypt the restic backups. Providers are expected to protect information consistently with this policy. This policy will be updated before another provider receives app data.
Information may also be disclosed when reasonably necessary to comply with law, protect a person’s safety, investigate abuse, or defend the security and rights of the service and its users.
Retention and deletion
- Tournament records
- Normalized tournament history—including teams, roster names, brackets, matches, scores, events, standings, and statistics—is retained permanently as the official Ruski archive. Upload source metadata and publication results may remain with that record.
- Comments
- Comments are retained indefinitely as part of match discussion. A moderator may remove a comment from public feeds when it violates the community standards. Deleting the author’s account permanently deletes every comment authored by that account, including its body and identifying relationship.
- Accounts, sessions, and blocks
- Account credentials, identity mappings, session records, and block relationships are retained while the account exists. Account deletion removes them in one database transaction. Signing out revokes the current session and clears its raw token from the device; account deletion removes all server session records.
- Moderation reports
- Report records are retained as needed to investigate abuse and document moderation outcomes. If a reporter deletes their account, the reporter identity and optional report context are erased. A minimal reason, state, timestamp, and resolution may remain as an operational audit record.
- Operational copies and support
- Ruski Report-controlled production logs and encrypted rotating backups are enabled with a maximum 30-day retention unless a longer period is required for a security investigation or law. Restic backup snapshots normally expire after 27 days. A backup may contain account or comment information that existed when the snapshot was made, including information later deleted from the live service. Backup copies are unavailable to normal app reads, are used only for recovery, and expire through that rotation. Support correspondence is normally deleted within one year after the request is resolved.
Your choices
- View tournaments as a guest without creating a public account.
- Sign out to revoke the current session and remove its token from the device.
- Block another account to hide that account’s comments from your signed-in view.
- Choose Account → Delete Account in the app to permanently delete the account and its associated comments, credentials, sessions, and blocks.
- Email support to ask a privacy question or request help with access or deletion.
Account deletion cannot be undone. Official tournament records are not public-account profile data and are not removed by deleting an app account.
Security
Ruski Report uses password hashing, opaque session tokens, iOS Keychain storage, authenticated operator routes, database transactions, and content-minimized logging. No system can guarantee absolute security. Please report a suspected security or privacy problem to support and do not include a password or session token.
Policy changes
This page will be updated when data practices materially change. The effective date above identifies the current version. Material changes will not be applied retroactively where consent is required.
Contact
Emilio Garcia is the policy owner and independent operator. Email requests are normally answered within three business days.