Privacy

How Bowin handles tournament information

Draft — not legal advice. This notice describes how the software works today and the approach we intend to follow. It has not been reviewed by a lawyer and may change before it is final.

Bowin is software that martial arts tournament organizers use to run their events. Most of the information in Bowin is about competitors and their families, and it belongs to the organizer running the event.

Who is responsible

The organizer (the club or association running the tournament) decides what to collect and why. In privacy terms the organizer is responsible for that information, and questions about an entry, a choice or a withdrawal go to them first.

Bowin stores and processes that information for the organizer, as their service provider (a processor). We use it only to run the organizer's events, keep it separate from other organizers' data, and do not sell it, advertise with it or use it for anything else.

For the accounts of organizers and their staff (name, email address and a password we store only as a secure hash), Bowin is responsible.

What is collected

Competitors: name, school, and the details divisions need, such as gender, age, belt, weight and height, and which events they enter.
Parents, guardians or coaches who register: name, email address, phone number and an emergency contact.
Medical notes: only if the family chooses to give them.
Consent records: what was agreed, when, and the exact wording that was shown.
Results: brackets, scores and placings.

Children

Children do not create accounts. A parent or legal guardian, or a coach who has the parent's consent, registers each child and agrees to the privacy notice for them. In Canada a parent or guardian consents for children under 13, and in Quebec for children under 14.

Who sees what

The organizer and the staff they invite see the entries for their own events.
Scorekeepers see only names, schools and weights, which is all scoring needs.
Coaches the organizer sends a coach link to see their own school's athletes in that event (name, gender, age, belt, weight, divisions and bouts) and, of other schools, only an opponent's display name. A coach link stops working at the end of the day after the event.
Medical notes are seen only by the organizer.
The public sees results only after the organizer publishes them: each competitor's display name, with their divisions, brackets, scores, placings and ring times. For an online registration the display name is the first name and last initial (for example, "Avery E.") unless the family ticks the choice to show the full name. For competitors the organizer adds or imports, it is the name the organizer sets, which starts as the first name and last initial. Schools, dates of birth, contact details and medical notes are never published.

Choices families make

When registering, the privacy notice, the organizer's waiver and the concussion code of conduct must be agreed. Everything else is optional and starts unticked: showing a full name in results, photos and video at the event, photos used to promote future events, and emails about future events from the organizer. To change a choice or withdraw, contact the organizer.

How long information is kept

Medical notes are deleted automatically 30 days after the tournament ends.
Uploaded spreadsheet previews are cleared after one hour if they are not imported or saved.
A saved import draft keeps its spreadsheet rows until the organizer imports or discards it, or until registration closes or the tournament starts, when it is deleted.
A family's saved profile can be deleted by the family from the registration page unless the organizer has placed a legal hold.
Parent, guardian and emergency contact details (names, email addresses and phone numbers), the online entries that hold them, and a family's saved profile are deleted automatically 24 months after the family's last event (the end of the latest tournament they entered). A new entry, or a change the family saves to their profile, starts the 24 months again. An entry made by a coach is deleted 24 months after that tournament. Emails about registration sent to a family (sign-in links and confirmations) are removed from our email records 24 months after they were sent.
When an entry is deleted, a short consent record is kept: the competitor's name, the name of the person who agreed, the versions of the notice, waiver and code of conduct they agreed to, and when. It holds no email address, phone number or address. It is deleted 7 years after the event or, if the competitor was under 18 on the first day of the event and a saved profile gave their date of birth, when the competitor turns 21.
The organizer can set different periods for their organization: contact details between 6 and 60 months, and consent records 2 to 10 years after the event, or until age 20 to 25 for competitors under 18. The registration page shows the periods that apply.
Results (competitor display names, divisions and placings) and other event information are kept while the organizer's account is open, so results stay available. An organizer can ask us to delete their organization's data.

These periods are our starting defaults and are pending legal review. Deletions run automatically every 10 minutes; each deletion is recorded with counts only, never names or contact details. Deleted information can remain in our encrypted backups for up to 14 days.

An organization owner can place a legal hold to pause scheduled data removal and deletion of family profiles, import drafts, tournaments and the organization. Held import data is preserved until release. Releasing the hold resumes cleanup of expired data. Expired sign-in links and sessions still expire.

Cookies and tracking

The app uses one cookie to keep you signed in, and online registration uses one to keep a family signed in to its saved profile. This website sets no cookies, runs no analytics and loads nothing from other companies. The app also remembers your sidebar preference in browser storage. See the cookies page for the details.

Where information is stored and who helps us

Information is stored on servers we operate: Hosting location — to be confirmed. Email (invitations, sign-in links, registration confirmations) is sent through Mailgun in the United States. When an organizer uses an AI suggestion, OpenAI in the United States helps, as described under AI suggestions below. We will list any other service provider here before we use it.

AI suggestions

Bowin can ask an AI service for suggestions. The service is OpenAI, in the United States. Nothing is sent unless an organizer uses an AI suggestion, and the organization's owner can switch AI off.

The owner chooses between two modes. In the default mode, names are not sent.

Names not sent (default): belts, ages, weights, genders, divisions, counts and event settings. Each competitor and each club is replaced by a code, such as C1 or S1, that exists only for that one request.
Names allowed (the owner must opt in and confirm): the same details, plus competitor and club names.

These are never sent in either mode: medical notes, guardian and emergency contacts, email addresses, phone numbers, street addresses, waivers and signatures, and payment data. A birth date is turned into an age first.

OpenAI does not use data sent through its API to train its models by default. We send each request with storage turned off. Bowin’s server never stores or logs the question, prompt or reply; OpenAI may keep API data for up to 30 days to detect abuse, then deletes it. Each request does leave an audit record: who asked, which feature, which model, how many tokens, whether names were allowed, and how it ended. The owner controls both settings: AI on or off, and whether names are allowed. AI suggestions can be wrong, and an organizer decides what to apply.

Ask Bowin currently accepts general questions in English using a limited product vocabulary; unsupported wording stays local and the static help remains available. For accepted questions, we send your scrubbed question, Bowin’s help topics and a summary of your organization’s setup. We do not send competitor records or previous questions. Known competitor and club names and contact details are removed from the question even when names are allowed for other AI features. Please keep private details out of your question. The conversation stays in browser memory until you clear it, sign out or close the page. Helpful feedback records only your yes or no with the normal audit metadata.

The screen-aware assistant accepts general English product questions using a limited vocabulary; unsupported wording stays local. Known competitor and club names and contact details are removed locally regardless of the names setting. Screenshots, raw screen text, competitor records and prior conversation are not sent. Questions and answer text remain in browser memory. Reviewed saved-action plans and their before/after changes, actor, time and audit link are stored for permission-checked history and undo; this does not store the conversation or provider reply text. A change requires explicit Apply and fresh server validation.

Security and breaches

Passwords and sign-in links are stored only as hashes, connections are encrypted, and each organizer can reach only their own data. If a breach affects an organizer's information, we will tell the organizer without delay so they can meet their own duties.

Contact

For an entry or a choice, contact the organizer of the event. For anything about Bowin itself, email cameron@ashbi.ca.