Privacy policy
Last updated 2026-11-01
This policy explains what Clincher ("we", "us") collects when you use this service, why, and what control you have over it. It's written to be read, not skimmed past — it's short because we collect little.
Who this covers
- Organizers — people who create an account to run competitions.
- Players — people an organizer adds to a competition, or who join one through its web page. Players don't have accounts, but each gets a private page, reached by a personal link, that shows their matches and, across every event they join with any organizer, their record, titles and rivalries. Organizers can also see people from their own past events to re-invite them.
- Visitors — anyone viewing a public bracket or Pro Page, including people who follow a page with their phone or email.
What we collect
Organizers: your email address and/or mobile number (used to sign you in with a one-time code — we never store passwords), an optional display name, the competitions you create, and API keys you generate (stored only as a hash).
Players: the name and mobile number and/or email address the organizer entered or you provided, your responses (accept/decline, results), and your place in the bracket. Organizers are responsible for having a basis to share your contact details with us; you can decline or opt out at any time. If someone signs you up as their partner, we keep the contact they entered and send you one invitation; nothing more unless you say yes.
Teams: team managers and league managers enter parents' names and mobile numbers or emails, and may list children by first name for scheduling (children are never texted or emailed). We store the schedule, who's in, volunteer sign-ups and team talk posts. Team talk is visible to everyone on the team, including a message sent by replying to the evening team-talk text; a parent's other notes to the manager are visible only to that parent and the team's managers. Managers and authors can delete posts. A league's public page shows team names, the schedule, scores and standings; never players' or parents' names or contacts.
League registration: when you register on a league's page we keep your name, email, optional mobile number, the division, who you'd like to play with, whether you can help, the league's waiver as you accepted it (your typed name and the time), and the league's other forms as you did them: what you signed and the exact words, your answers, or that you marked something done elsewhere, with the time and the address your browser connected from. For a child we keep only the first name and last initial: no birth date (a birth year you pick only chooses the division and isn't saved), and no address, school, photo or medical details, and a league's forms can't ask for them. Registrations, and the forms with them, are deleted about 18 months after they're made (the season and a year). Card payments go straight to the league's own Stripe account.
A child's own page: a parent can turn on a read-only page for their child's phone with the team's schedule, scores and standings, and notifications when something changes. It asks the child for nothing and nobody can message the child through it; the only thing stored is the phone's notification subscription, used only to deliver those notifications. The parent is emailed when it's turned on, can turn it off any time, and it's deleted at the end of the season.
Phone notifications: if you turn them on from your page, we keep the delivery address your browser gives us (not your phone number) so we can send you notifications about your events and teams. Turn them off on your page or in your browser settings, and we forget it.
Followers: if you follow an organizer's Pro Page with a phone number or email, we keep it so they can invite you to their events; reply STOP or use the unsubscribe link to end it.
Messages: we log every text and email we send and receive, including one-time codes (hashed) and your replies, so that results can be verified, disputes resolved, and opt-outs honored.
Technical: standard server logs (IP address, browser, pages requested) kept briefly for security and debugging. We use a session cookie to keep organizers signed in and a CSRF cookie to protect forms. We do not use advertising or analytics trackers.
How we use it
- To run competitions: build brackets, notify players, record results.
- To send the messages described in our SMS policy — only about events you're part of, never marketing.
- To sign organizers in and secure their accounts.
- To process payments for paid features and card entry fees (handled by Stripe; we never see your card number, and entry fees go straight to the organizer's own Stripe account). If an organizer asks for payment by Venmo, Cash App, PayPal or in person, that happens outside our service: we only show where to pay and keep the organizer's note of who has paid.
- To respond to support requests and comply with law. To help with a request, our staff can view your account as you see it and fix things in it for you. They can't send messages or make payments in your name, each visit ends after 30 minutes, and each one is logged with who looked, why, and what they changed.
Who we share it with
Only service providers needed to run the product, each bound to use data solely to provide their service to us:
- Twilio — delivers text messages (sees phone numbers and message content).
- Our email provider — delivers email notifications and sign-in codes.
- Your browser's push service (Apple, Google, Mozilla or Microsoft, depending on your browser) — delivers phone notifications if you turn them on, and sees their text.
- Anthropic — when an organizer texts commands to the service or uses the assistant chat on their account page, the message and a summary of their competitions (names, entrant names, match status) are sent to Anthropic's API to interpret the command. Player replies (Y/N, scores) are handled without AI.
- Your own AI assistant — if an organizer connects one by signing in, it can read and change their competitions, and what it sees is handled under its provider's terms, not ours. Organizers can disconnect it any time from their account page.
- Stripe — payments.
- Our hosting provider — stores the database.
We don't sell personal information and don't share it with advertisers. Within a competition, your name and results are visible to the organizer and, if the organizer made the bracket public, to anyone with the link. Your phone number and email are visible only to the organizer, any co-organizers they add and, on a team, its managers and league manager.
How long we keep it
Competition data is kept while the organizer's account exists so they can look back at past events. Message logs are kept for the life of the competition plus a reasonable period for dispute resolution, then may be deleted. Sign-in codes expire in 10 minutes and are purged. Organizers can delete a competition, which deletes its players and messages.
Your choices
- Opt out of texts at any time by replying STOP.
- Turn off notifications on your page or in your browser's settings.
- Stop email with the unsubscribe link at the bottom of any email we send. It covers every event and team, including a wrong address someone entered for you. Sign-in codes you request still arrive.
- Ask to be removed from a competition by contacting the organizer or us at support@heyclincher.com.
- Access, correct, or delete your information: email support@heyclincher.com. Organizers can delete their account and its data on request.
Children
This service is for adults. Teams may list a child by first name for scheduling, and league registration keeps a child's first name and last initial, but we only ever text or email adults. A parent may turn on a read-only page for their child's phone (above): it collects nothing from the child, its notifications are about the team's schedule only, and the parent can turn it off at any time. Organizers must not enter phone numbers or emails of children under 13, and should enter a parent's or guardian's contact for minors where contacting a minor would be inappropriate.
Security
Data is transmitted over HTTPS and stored with a reputable hosting provider. Passwords don't exist here; sign-in codes and API keys are stored only as hashes. Incoming webhooks from Twilio are cryptographically verified. No system is perfectly secure, and we'll notify affected people of any breach as required by law.
Changes
If we change this policy in a meaningful way we'll update the date above and, for organizers, note it on the account page.
Contact
Clincher, WY, USA — support@heyclincher.com.