Last updated: October 23, 2026

Privacy policy

The short version

There are no accounts on this site. A tournament you make stays in your browser until you press Share. When you share it, the tournament, including the team and player names you typed, is stored on Cloudflare so the link works, and anyone with the link can see it. Shared tournaments that haven’t changed for 18 months are deleted. Our own code sets no cookies.

Every outside service the site relies on is described below, along with what it receives and why.

Who we are

Bracket Maker is made by Lora Studios, a small independent studio. For any privacy question or request, write to us through the contact form.

Tournaments on your device

While you build and score a tournament, it’s saved in your browser’s local storage, so it survives a refresh and shows up under “Your brackets” the next time you visit on that device. Your light or dark theme choice is saved the same way. None of this is sent to us until you share, and none of it is a cookie.

Clearing this site’s data in your browser removes your saved tournaments from that device. If your browser blocks storage, the tool still works; it just can’t remember your tournaments after you close the page.

QR codes are drawn by your browser, so making one sends nothing anywhere.

Shared tournaments

When you press Share, the page sends us the tournament: its title, the names of the teams or players, the format and sport settings, and the scores. We store it in a database on Cloudflare, together with when it was created and last changed. Each later change you make is sent the same way.

• The view link lets anyone who has it see the tournament, including every name in it. Shared tournaments aren’t listed anywhere on the site, and we ask search engines not to index them, but a link can be forwarded, so treat it like anything else you post in a group chat.
• The edit link carries a secret key after the # in the address. Browsers don’t send that part of an address to websites, so the key never shows up in server logs; the page sends it to us only when you save a change. We store a scrambled (hashed) version of the key, not the key itself. Anyone with the edit link can change the tournament, so share it only with the people running the event.
• Names: use first names, nicknames or team names. Don’t put phone numbers, email addresses or anything sensitive into a tournament.
• Deletion: a shared tournament that hasn’t changed for 18 months is deleted. Organizers can delete one sooner from its edit link, or ask us through the contact form with the view link.

We don’t sell tournament data, use it for advertising, or read it except to fix a problem you’ve reported or to deal with abuse.

Analytics

We use Google Analytics 4 to understand how the site is used: page views, plus tool events such as creating a tournament (with its format, sport and number of entrants), entering a score, and opening the share, TV or print views. These events never include tournament titles, team or player names, or scores. This shows us which formats and sports people use and where the tool gets in their way.

Outside the EEA, the UK and Switzerland, Google Analytics sets cookies (named _ga and similar) to tell visits apart. In the EEA, the UK and Switzerland we don’t ask for consent, so Google Analytics runs there without cookies or ad features (Google’s consent mode with storage denied) and Google only receives anonymous measurements. Google Analytics 4 does not log or store IP addresses; it uses them only to estimate a rough location, such as the country or city. Event-level analytics data is kept for up to 14 months and then deleted; aggregated reports, such as monthly page-view totals, are kept.

To opt out, you can install the Google Analytics opt-out browser add-on, block cookies for this site, or use a browser or extension that blocks trackers. The tool works the same either way.

Hosting and server logs

The site and its database run on Cloudflare (Cloudflare Workers and D1). Like any web host, Cloudflare processes request data such as your IP address and browser type (user agent) to deliver the pages and protect the site from abuse.

When you share or save a tournament, your IP address is also used for a moment to limit how many requests can arrive from one connection. We don’t store it. When something goes wrong on our side, a short error message is written to Cloudflare’s logs so we can fix it; these messages never contain tournament names or scores.

Cloudflare may also measure anonymous page-load performance (Cloudflare Web Analytics). It sets no cookies and does not identify you.

Our fonts are served from this site, not from a font service. Cloudflare and the other services named on this page may process data in the United States and other countries.

Messages you send us

The contact form sends your name, email address and message to our inbox through Web3Forms, a form delivery service. We use them only to read and answer your message, we don’t add you to any mailing list, and we keep messages only as long as we need them to deal with your request.

Children

Brackets are often made for kids’ teams, school field days and youth leagues. We don’t ask anyone for personal information and there are no accounts. If you run an event for children, use first names, initials or team names in shared tournaments, since anyone with the view link can see them. If you believe a child’s personal information is in a shared tournament or a message you sent us, tell us and we’ll delete it.

Your rights

Depending on where you live, for example in the EEA, the UK or California, you may have the right to:

• know what personal data is held about you and get a copy of it;
• have it corrected or deleted;
• object to or restrict how it’s used, and withdraw consent you gave earlier;
• complain to your local data protection authority.

We hold no accounts, so the personal data we have is usually a name typed into a shared tournament or a message you sent us. To have a name removed from a shared tournament, ask its organizer to edit it, or send us the view link through the contact form. We’ll reply within one month.

Changes to this policy

When we change this policy, we update the “last updated” date on this page. If a change matters, such as a new service that receives data, we’ll say so here rather than change it quietly.