Privacy Policy

Operator

EsportsCalendar.io is operated by [Operator Name / Legal Entity]. For contact information, see the Contact section below.

Our Privacy-First Approach

EsportsCalendar.io is designed with privacy as a core principle. We collect minimal data necessary to operate the service and never sell or share your personal information with third parties for advertising purposes.

Cookies and Local Storage

We do not use tracking cookies. However, we use browser storage for essential functionality:

• localStorage: Stores your authentication session (if you create an account) and UI preferences such as calendar view settings
• sessionStorage: Temporarily stores authentication state during your browsing session

This data remains on your device and is not transmitted to our servers for tracking purposes. You can clear this data at any time through your browser settings.

What We Collect

Browsing the Site (Anonymous Visitors)

When browsing without an account:

• No tracking cookies: We do not use cookies to track you
• No cross-site tracking: We do not track you across websites
• No persistent identifiers: We do not create user IDs for anonymous visitors
• No third-party analytics: We do not use Google Analytics, Facebook Pixel, or similar services

User Accounts

If you create an account, we collect:

• Email address: Required for authentication and account recovery
• Display name (optional): If you choose to set one
• Consent timestamp: When you agreed to receive communications
• Account creation date: When your account was created

Purpose: Providing account functionality, saved filters, and email digests.
Legal basis: Contract performance (providing the service you requested).
Retention: Account data is retained until you delete your account.

Saved Filters and Digest Subscriptions

If you use saved filters or subscribe to email digests, we store:

• Filter preferences: Games, event types, and time ranges you selected
• Digest frequency: Daily, weekly, or monthly preference
• Unsubscribe token: A secure token for one-click email unsubscribe

Purpose: Delivering personalized event notifications.
Legal basis: Your consent (you opt in to digests).
Retention: Retained until you delete the filter or unsubscribe.

ICS Calendar Feeds

If you subscribe to an ICS calendar feed, we collect:

• Feed access logs: Timestamp of feed requests for rate limiting
• One-way IP hash: For rate limiting only (60 requests per hour per token)

Purpose: Preventing abuse and ensuring service availability.
Legal basis: Legitimate interest in service operation.
Retention: Access logs deleted after 30 days. You can regenerate your feed token at any time to revoke access to old URLs.

Outbound Link Clicks

When you click external links (tickets, official sites, streams), we collect:

• Link type and destination: To understand which resources are most useful
• One-way IP hash: A cryptographic hash of your IP address used only for rate limiting (cannot be reversed to your actual IP)
• Timestamp: When the click occurred
• User agent and referrer: Optional browser information for bot detection

Purpose: Improving content quality and understanding which events generate interest.
Legal basis: Legitimate interest in improving our service.
Retention: IP hashes anonymized after 30 days. Click metadata retained for 365 days, then deleted.

Affiliate Links

Some links to ticketing sites and merchandise are affiliate links. When you click these links, we track:

• Click event: That an affiliate link was clicked, and which partner
• One-way IP hash: For rate limiting only (cannot identify you)
• Timestamp: When the click occurred

We do not track your purchases, purchase amounts, or any activity after you leave our site. Our affiliate partners may use their own cookies and tracking on their sites.
Legal basis: Legitimate interest in operating our service.
See our Disclosures page for more information about affiliate relationships.

Sponsored Content

For sponsored listings (clearly labeled with a "Sponsored" badge), we collect aggregate metrics:

• Impression counts: How many times a sponsored listing was displayed
• Click counts: How many times a sponsored listing was clicked
• Page context: Where on the site the listing appeared

This data is aggregated and does not identify individuals. We do not use cookies, user identifiers, or cross-site tracking for sponsored content.
Legal basis: Legitimate interest in operating our service.
Retention: Detailed metrics retained for 90 days, then aggregated.
See our Disclosures page for more information about sponsored content.

Event Submissions

When you submit an event or suggest an edit:

• Email address (optional): Only if you provide it, to contact you about your submission
• One-way IP hash: For rate limiting to prevent spam
• Submission content: Event details you provide

Purpose: Processing your submission and contacting you if needed.
Legal basis: Your consent (providing the information is voluntary).
Retention: Emails deleted 90 days after submission is reviewed. IP hashes deleted after 7 days.

Administrator Accounts

For site administrators only:

• Email address: For authentication
• Password hash: Securely stored using industry-standard hashing, never in plain text
• Action audit logs: Records of administrative actions for accountability

Retention: Audit logs retained for 2 years (730 days), then deleted.

What We Do Not Collect

• Raw IP addresses (only one-way hashes that cannot be reversed)
• Tracking cookies
• Persistent identifiers for anonymous visitors
• Third-party analytics data (no Google Analytics, Facebook Pixel, etc.)
• Cross-site tracking data
• Purchase information or financial data

Data Retention Summary

We retain data only as long as necessary:

• Rate limit records: 2 days
• Submission IP hashes: 7 days
• Outbound click IP hashes: 30 days (then anonymized)
• ICS feed access logs: 30 days
• Sponsored content metrics: 90 days detailed, then aggregated
• Submission emails: 90 days after review
• Outbound click metadata: 365 days
• Audit logs: 2 years (730 days)
• User accounts: Until account deletion

Third-Party Services

We use the following services to operate EsportsCalendar.io:

• Cloudflare: Hosting and CDN (processes your IP address for security and DDoS protection)
• Supabase: Database and authentication (stores account data if you register)
• Cloudflare Turnstile: Spam protection on forms (privacy-preserving CAPTCHA alternative)
• Resend: Email delivery for digest notifications (processes email addresses for delivery)

Each service has its own privacy policy. We only share the minimum data necessary for each service to function.

Your Rights

Under GDPR and similar privacy laws, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your personal data
• Portability: Request your data in a machine-readable format
• Object: Object to processing based on legitimate interest
• Withdraw consent: Withdraw consent for digest emails at any time via one-click unsubscribe

For anonymous visitors: Since we use one-way hashes and do not create persistent identifiers, most visitors have no personal data stored with us that can be linked to them.

For account holders: You can manage your data directly in your account settings, including deleting saved filters and unsubscribing from digests. To delete your account entirely, contact us using the information below.

For event submitters: If you submitted an event with your email address, you can request deletion by contacting us.

Data Security

We implement appropriate technical and organizational measures to protect your data:

• All data transmitted over HTTPS encryption
• Passwords stored using secure one-way hashing
• IP addresses hashed with cryptographic salt before storage
• Database access restricted to authenticated services
• Automated data retention enforcement via scheduled cleanup

Contact

For privacy-related questions or data subject requests, please contact us at:
privacy@esportscalendar.io

We aim to respond to all requests within 30 days.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. For significant changes, we may notify account holders via email.