Privacy Policy

This Privacy Policy describes how Ruloo ("Ruloo," "we," "us"), a Georgia sole proprietorship, collects, uses, and shares information when you use our tournament management platform for Play! Pokemon events -- whether you're an organizer, judge, or a player registering for an event.

In plain terms: what we hold about players and judges

About players: the name and Play! Pokemon Player ID already printed on your event's roster and result slips, your age division (computed from birth year, when the official event software provides it), and your tournament records -- round results, table assignments, wins/losses/ties, drop status, and a submitted decklist if the organizer has that turned on. If you sign up through Ruloo, a registration record (name, Player ID, division, birth year and email if you gave them, and for paid entries the amount paid, a confirmation number and any refund or dispute). Tournament records, pairings, penalties and decklists are scoped to a single tournament and are automatically deleted with it, and so are sign-ups that weren't paid online (see Section 4). Two things are kept after that: records of entries paid online, so organizers can handle refunds, card disputes, accounting and taxes; and season statistics, a scrambled form of your Player ID kept so an organizer can see totals such as unique and returning players across their events -- never your name, results, or any view of your individual history.

About judges: your account email, judge name, and Player ID -- that's the entire profile. We don't collect or store phone numbers, Discord handles, or addresses for judges. The penalties, notes, and actions you log during an event are signed with your name and Player ID plus the judge level you held (Judge, Assistant Head Judge, or Head Judge) -- the same attribution as signing a paper penalty slip -- and those records are deleted with the tournament too. So you can see your own judging totals over a season, Ruloo keeps a short summary for each event you judged after the event is deleted: your judge name and Player ID, your judge level, the event's name, date, type and organizer, and how many penalties, notes, late arrivals and deck checks you logged and how much extra time you gave. It holds no player names, Player IDs or record text, only you (and Ruloo administrators) can see it, and it is deleted when you delete your account.

Who can see any of it is limited by design: judges see only tournaments they're assigned to, organizers see only their own events, and public pairings pages require the event's own join code and show only what's already posted on the wall at the venue -- your table number and opponent. When an event is marked complete, its final standings are shown on that page for 10 minutes; after that, the page shows a player only their own result. We never publish anyone's email address or contact information publicly.

1. Information we collect

Organizers, judges, and admins: name, email address, and password/login info for your account. Judges also have a judge profile -- a display name and a Play! Pokemon Player ID, the two fields used to sign penalty records and tournament paperwork. Organizers can save venues (such as name, address, phone, public email, hours, description and images) and turn on a public event page; we hold the venue and event details you choose to save or publish there (such as venue, address and schedule). Organizers who take online payments have their Ruloo account email saved with their payment account so Ruloo can email them about refund requests and card disputes. If you get organizer access through Patreon, we receive your Patreon user ID, name, membership status, the date and status of your latest Patreon charge, and your pledge amount, and use them only to give and check organizer access. Organizers who use Floor Map also save venue layouts they draw (walls, areas and tables); a layout holds no personal information and is kept until the organizer deletes it or their account.

Players: registering for an event doesn't require an account. We collect your name, and optionally a Play! Pokemon Player ID and/or email address, as entered at registration by you or the organizer. If you submit a decklist, we also collect the decklist itself and, for events that ask for it, a self-entered date of birth (used only to fill in the printed decklist's Birth Year line and to cross-check it against the event roster). Match results, pairings, and standings tied to your name/Player ID are entered by tournament staff from official event software, or self-reported by you where an organizer has turned that on. If you ask for a refund from your registration page, we keep the date and any reason you write, and show them to the organizer.

Payment information: if you pay an entry fee online, your card details are entered directly into Stripe, our payment processor -- Ruloo never receives or stores your full card number. We do receive transaction information from Stripe (amount, currency, payment status, Stripe's processing fee, refunds, disputes, and a payment reference) and give each payment a confirmation number, and, if you provide an email at checkout, Stripe will send you a receipt directly. Organizers who connect a Stripe account give their identity, tax and bank details to Stripe directly; Ruloo only stores the account's status from Stripe (for example, whether it can take payments and receive payouts). When an organizer opens Payouts, Ruloo reads their Stripe balance, payout schedule and recent payouts (amounts, dates, and the bank's name and last four digits) from Stripe to show them; this isn't stored, and full bank account numbers are never received.

Judge-entered records: penalties, notes, and late-arrival records a judge or organizer logs against a player's name/Player ID during an event.

Feedback: anything you submit through Ruloo's Feedback button.

Automatically collected: standard technical information from normal web server operation, such as IP address, browser/device type, and pages visited. We also use product analytics (see PostHog in Section 3) to understand how the app is used: which pages are visited and how features are interacted with, tied to your account ID and role if you're signed in. Session recordings mask what you type into fields, but other text shown on the screen -- which on tournament pages can include player names and table numbers -- can appear in a recording. Our named analytics events carry only non-sensitive metadata (round numbers, penalty types, tournament IDs) -- never player names or IDs. We don't use analytics for advertising and don't sell any of it.

2. How we use information

• operate tournaments -- pairings, standings, penalty tracking, decklist review;
• process paid registrations and refunds, per our Refund & Cancellation Policy;
• communicate with you about your registration, payment, or a support/feedback request;
• give organizers season totals for their own events, such as unique and returning players (see Section 4);
• maintain and improve the service and keep it secure; and
• comply with legal obligations and enforce our Terms of Service.

3. How we share information

We share information with the service providers that make Ruloo work, and don't sell your personal information. Those providers include:

• Stripe -- payment processing and, for organizers, Stripe Connect accounts and payouts;
• Base44 -- our application hosting, account authentication, and database platform;
• Supabase -- database infrastructure for tournament operational data (registrations, pairings, decklists);
• TCGdex -- a public card-database lookup used to show card images/legality on a decklist; we send card names/set codes, never your personal information;
• PostHog -- product analytics: page views, feature interactions, and session recordings, tied to your account ID if you're signed in (see Section 1);
• Resend -- email delivery for our emails (welcome, registration and payment confirmations, refund-request and card-dispute alerts to organizers, tournament warnings, digests); they receive the recipient's email address and the content of that message;
• Patreon -- for organizers who get organizer access through a Patreon membership; Patreon tells us the membership details listed in Section 1;

We also share tournament data with the people who need it to run the event: the organizer hosting your event and the judges assigned to it can see your registration, decklist, and match records -- that's the core purpose of the product, the same way this information would be visible to tournament staff at an in-person check-in table. If you dispute a payment with your bank, the organizer can create a record of that payment, your registration and decklist times, and the rounds you played at the event (with table numbers, results and your opponents' names) and send it to Stripe and the card network to answer the dispute. Ruloo administrators can see totals across all organizers (for example, how many events and players use Ruloo) to run and support the service. We may also disclose information if required by law, to prevent fraud or abuse, or as part of a merger, acquisition, or sale of assets.

4. Data retention

We keep tournament data for as long as the tournament exists in Ruloo. Tournaments -- and their pairings, penalties, notes, decklists, match records, and sign-ups that weren't paid online -- are automatically and permanently deleted 14 days after the event's date (120 days for events that take online payments, the window in which a card payment can be disputed); organizers receive an email warning beforehand and can exempt an event if they need to keep it longer. Deleting a tournament manually is likewise permanent for those records. Players can't delete or change a decklist themselves once it's submitted -- a player who needs theirs removed or corrected asks the organizer, who can delete or unlock it from Ruloo's decklist review screen. Registered users can delete their account (removing their profile details) from their account settings.

Season statistics: when an organizer imports a tournament roster, Ruloo keeps a scrambled form of each player's Player ID (made with a secret key only Ruloo's servers hold, so it can't be turned back into the ID by anyone who sees it), along with the event's name, venue, date, and type and the player's age division, so organizers can see season totals such as unique and returning players. Ruloo does not keep names or results for this, does not show any individual player's history, and keeps this data after the tournament itself is deleted. It is deleted when the organizer deletes their account.

Judging summaries: when a tournament is deleted, Ruloo keeps one summary for each judge who worked it: the judge's name, Player ID and judge level, the event's name, date, type and organizer, and counts of the penalties, notes, late arrivals and deck checks that judge logged plus the extra minutes they gave. Unlike season statistics, it uses the judge's real Player ID so the judge can see their own totals. It holds nothing about players, only that judge (and Ruloo administrators) can see it, and it is deleted when the judge deletes their account.

Paid entries and payment records: for entries paid online, the registration (name, Player ID, division, birth year and email if given, status, and any refund request) and the payment record (the event's name and date, players, amounts, Ruloo's service fee, Stripe's fee, confirmation number, refunds and disputes) are not deleted with the tournament. In the rare case that a sign-up that wasn't paid online is referenced by our payment audit log, we erase its personal details when the tournament is deleted and keep only an anonymous entry. Ruloo keeps them so organizers can answer card disputes, handle refunds and keep accounting and tax records; the organizer can still see their payment records in their payment history. Stripe also keeps payment records according to its own retention practices and applicable law. Patreon membership details are kept while the linked Ruloo account exists.

5. Children's privacy

Play! Pokemon's Junior division includes players who may be under 13. When a Junior division player's information (name, Player ID, decklist, match results) is entered by a parent/guardian or by tournament staff running the event, we treat that as information provided on the child's behalf, consistent with how an in-person tournament sign-in sheet works. We collect only what's needed to run the tournament (see Section 1), never more, and we don't use it for advertising or sell it. A parent or guardian who wants to review, correct, or request deletion of their child's information can contact us at the email below, or ask the tournament organizer directly.

6. Data security

We use industry-standard measures to protect information in Ruloo. Access is enforced on the server, not just hidden in the interface: every record is subject to row-level access rules, so a judge can only see tournaments they're assigned to, an organizer only their own events, and the server itself rejects any attempt to read or change data that isn't yours. Sensitive actions are re-verified server-side before they're applied, and all credentials and keys stay on the server -- never in the app's browser code. Passwords are stored only in hashed form by our authentication platform, never in readable form, and payment details are handled entirely by Stripe's own PCI-compliant systems rather than by us. Ruloo uses no advertising or cross-site tracking cookies, and sign-in is token-based; our analytics provider sets a single first-party session identifier to tie usage events together (see Section 3). We don't send marketing email. Account and event emails (such as welcome messages, deletion warnings and digests) include a one-click unsubscribe; payment and registration messages (confirmations, receipts, and refund-request and dispute alerts to organizers) are sent because of a payment you made or handle, and don't have one.

No method of transmission or storage is 100% secure, and we can't guarantee absolute security. If a data incident ever occurs, we will act to contain it quickly and will disclose it to affected users.

7. Your rights and choices

You can ask us to access, correct, or delete personal information we hold about you by contacting us at the email below. For a specific tournament registration, the fastest path is often asking the organizer directly, since they can act on it inside Ruloo right away.

8. International data

Our service providers may process and store information in the United States and other countries. By using Ruloo, you understand your information may be processed outside your own country of residence.

9. Changes to this policy

We may update this Privacy Policy from time to time. We'll update the "Last updated" date above when we do.

10. Contact

Questions about this policy, or a request about your data: support@ruloo.app.