TunaflyTournaments, on the fly. Log in

Privacy policy

Last updated 1 November 2026

Tunafly is in early testing. It's a demo while it's being built: features change, things may break, and tournaments and accounts may be reset or deleted without notice. Please don't rely on it for anything important yet.

Tunafly is an independent project based in Ontario, Canada. This page says what Tunafly keeps about you, why, who can see it, and how to see, change or delete it. Questions about your privacy go to Tunafly's site admin, who is responsible for your information, at [email protected].

What Tunafly keeps

  • Your account: your name, your username and, if you add one, your email address. Your password is stored scrambled (one-way hashed), so nobody can read it, Tunafly included.
  • Your tournaments: your teams, sign-ups, matches, scores, results, reschedule requests, no-show reports and disputes, and organizers' announcements.
  • Arrivals, if you say so on a match: when you said "I've arrived", or that you're running late and when you'll be there.
  • Questions you ask in "Ask about this tournament", with their answers.
  • Notifications sent to you.
  • Emails sent to you, if you add and confirm an address: which kinds you chose, what is waiting to go in your next email, and a copy of each email for 30 days. Amazon's notices if an address bounces or someone marks an email as spam.
  • Phone alerts, if you turn them on: for each phone, the address its browser gives for alerts (and the keys to encrypt them), what kind of phone and browser it is, and which kinds of alerts you want. Turn them off or remove a phone on Me → Alerts.
  • An activity log of what was done on the site (for example "result entered"), when, by which account, and from which IP address. It helps settle disputes and keep the site safe.
  • Error logs: when a page fails or a request is refused, the server notes the time, the page's address and the error, so it can be fixed.

Cookies and your browser

  • A sign-in cookie, which keeps you signed in until 30 days after your last visit.
  • A device cookie saying this phone or computer has signed in here before, so a busy venue's shared wifi doesn't lock it out after other people's typos. It holds nothing about you.
  • A security cookie that stops other sites from submitting forms as you.
  • Your theme choice, kept in your own browser.
  • Scores not sent yet: the results desk keeps a result on the phone until a bad connection is back, and the live scorer keeps its point-by-point count, so a reload doesn't lose it. They hold scores, nothing about you.
  • A note of the day this phone's alerts were last checked, if you turned alerts on.

No advertising or tracking cookies. Tunafly shows no ads and never sells your information.

Who can see what

  • People in the same tournament see your name, your team, your matches and results, and the tournament news.
  • Your opponent, and the tournament's officials and organizers, see when you said you've arrived or are running late.
  • The days you say you can't play are seen by you, the others in your pair or team, and the people running the tournament, to keep your matches off them.
  • An organizer sees the people in the tournaments they run.
  • What you send as feedback, and the page it was sent from (any private key in its address taken out), your device and browser: the site's admin, or the tournament's organizers you send it to. They see who sent it, so they can answer.
  • Whether you can be reached by alert or email, as a yes or no, to the tournament's organizers (not its officials): never your address or your phone, so they can tell those who can't be at the desk.
  • Tunafly's site admin can see everything, to run and fix the site.
  • Tunafly is invite-only: people outside a tournament can't see it, unless its organizer shares its live board, for a group chat or a screen at the venue. Anyone with that link sees how many are in before the start, then the matches on now and next, the latest results and the standings, with names, and in its screen mode the tournament's news story (unless the organizer leaves it out), until the organizer stops it. The people in the tournament are told when it's first shared, and its invite link says so to anyone joining after.

The AI

Tournament news and answers to questions are written by an AI model. It runs on Tunafly's own computer or, when Tunafly's admin chooses, at DeepInfra, Anthropic or OpenAI through OpenRouter (all US companies). What goes to them is a tournament's results and schedule and the question asked, with every person's name replaced ("Player A") before it leaves Tunafly; the names are put back on Tunafly's own server. DeepInfra says it doesn't keep or train on what it's sent; for a Google model such as Gemma, Google may keep it for a while to check for abuse. Anthropic says it doesn't train its Claude models on what it's sent this way, and may keep it for a while to check for abuse. OpenRouter passes it on to the model's maker, OpenAI, and says it doesn't keep it; OpenAI says it doesn't train on what it's sent this way, and may keep it for a while to check for abuse. Either way, no one's name is in it. Every story is checked against the real results before it's shown.

Services Tunafly uses

  • Amazon Web Services (Amazon SES, a US company) delivers Tunafly's emails, if you add and confirm an address. It handles your email address and each email's content. Emails carry no tracking images and their links aren't rewritten: Tunafly doesn't know whether you open them.
  • Cloudflare (a US company) carries all traffic to and from the site, to keep it fast and protected from attacks. It handles your IP address and may count visits anonymously.
  • Phone alerts travel through your phone maker's or browser's push service (Apple, Google or Mozilla). Each alert is encrypted for your phone, so the push service can't read it.
  • Google Drive (Google, a US company) keeps copies of Tunafly's backups, so a broken server doesn't lose your tournaments. They're encrypted on Tunafly's server before they leave, so Google can't read them.
  • DeepInfra (a US company) runs the AI model when Tunafly's admin chooses it: it gets a tournament's results and schedule and the questions asked about it, with every person's name replaced before they leave Tunafly.
  • Anthropic (a US company) runs its Claude model when Tunafly's admin chooses it, and gets the same, with every person's name replaced before they leave Tunafly.
  • OpenRouter (a US company) passes the same on to the model's maker, OpenAI (a US company), which runs its GPT model, when Tunafly's admin chooses it: every person's name is replaced before they leave Tunafly.
  • Everything else, including your account, runs on Tunafly's own server in Canada; so does the AI unless DeepInfra, Anthropic or OpenRouter is chosen.

How long it's kept

  • Your account and its data: until you delete your account.
  • The activity log: 6 months, then deleted automatically.
  • Error logs: until newer ones replace them, as the server keeps only so much.
  • Copies of emails sent: 30 days, then deleted automatically.
  • Alerts sent: 7 days, then deleted automatically.
  • Feedback, with its picture and answers: 6 months, then deleted automatically.
  • The questions at a tournament's end: your answers are kept without your name, the day only, for 6 months, then deleted automatically; that you answered, for as long.
  • Tournament results stay as part of the tournament's history, so the table stays right for everyone else. When you delete your account, your name is removed from them.
  • News stories already written may mention you by name. Ask, and they'll be removed.
  • Backups made to protect against data loss may hold your data until they're replaced: up to 6 months, including the encrypted copies kept off the server.

Your rights

  • See what Tunafly keeps about you: ask at [email protected].
  • Correct your name in Me → Profile and password, and your email in Me → Email, or ask.
  • Stop emails with the link at the bottom of any email, in Me → Email, or by removing your address. Emails about your account (confirming it, resetting your password) only come when you ask.
  • Delete your account at any time in Me → Delete my account.
  • If you're not satisfied with an answer, you can contact the Office of the Privacy Commissioner of Canada.

Children

There's no minimum age, so junior players can take part. If you're under 13, a parent or guardian should set up or approve your account. Parents can write to [email protected] to see or delete their child's information.

Changes

If this policy changes, the date at the top changes too. Big changes will be announced on the site.