Privacy notice

Who operates RivalGround

RivalGround is the name of a gaming competition platform operated by Bradley Yarrow in Nigeria. It is not represented as a registered company. Contact the operator above for privacy requests. This notice describes the implemented service; it is not a certification of legal compliance.

What we collect and why

Account details include your name, email, hashed password, gamer tag, declared country, optional city and platform. We use them to provide your account, verify email, recover access and arrange compatible matches. We record an adult/residency declaration and versioned terms acceptance without collecting a date of birth or identity documents. Declarations are not official identity verification.

Competition records contain edition/platform declarations, entries, schedules, check-ins, score reports, confirmed results, titles and moderator decisions. Private evidence, complaints, lobby instructions and in-game IDs are accessible only to appropriate participants and authorised reviewers. Do not upload unrelated personal information. Optional uncertain country observations at check-in are review information, never proof of cheating; the installed provider currently returns unknown rather than calling a location service.

Laravel sessions contain IP/user-agent information for session/security handling. Throttles use keyed hashes; the online-activity panel uses keyed session hashes and last-active times, not public IP addresses. Creator referrals record the referring link, registration and actual participation separately. Optional Discord linking stores the linked identity and encrypted connection credentials to associate authorised commands; unlinking stops future use, subject to revocation retries and security audit retention.

Legal bases and visibility

Account and competition processing is necessary to perform the service you request under these terms. Proportionate security, abuse prevention, dispute decisions and operational monitoring support legitimate interests, subject to your rights and an operator assessment. Legal obligations may require limited records. Optional public profiles and Discord publicity use separate, withdrawable consent. We do not treat terms acceptance as marketing consent and do not send marketing email.

Entering a public tournament displays your gamer tag, edition/platform, bracket and confirmed results on the website as operational competition information. Private challenges and earlier private records are not made public. A public player-directory profile is optional. Real names, email, city, IPs, location checks, evidence and disputes are not public. Discord welcomes and named winners require separate publicity permission checked at delivery. Previously delivered public messages may be copied by others; ask support for removal assistance.

Services and overseas processing

The website/database runs on AWS Lightsail in London; encrypted private backups use S3 in London. Account email is sent through London Amazon SES. Operator receiving email uses ImprovMX forwarding to the operator’s inbox; receiving providers may process outside Nigeria. Optional Discord OAuth/commands and authorised announcements use Discord infrastructure outside Nigeria. Social links are plain external links; visiting them subjects you to that service’s policies. No embedded social tracking, advertising or analytics is installed.

The operator must document appropriate cross-border transfer safeguards and vendor terms before public activation, including transfers to the UK and onward provider processing. Provider use and encryption alone do not establish NDPA transfer compliance.

Retention and security

Essential sessions expire after 120 minutes of inactivity; database cleanup may follow later. Online-activity observations are pruned after one day. Coarse location observations are scheduled for removal after 30 days and private match evidence after 90 days. Application logs rotate over 14 days; Caddy logs omit request URLs/headers and retain bounded files. Backups use the reviewed 30-day retention, subject to versioning lifecycle and restore procedures.

Account and competition history remains while needed to provide your account and resolve reliability/abuse matters. Audit/policy-acceptance records and necessary suppression hashes may be retained after deletion requests to meet justified integrity or legal needs. There is not yet an automatic whole-account erasure process or a fixed universal history-retention period. The operator will explain the record-specific decision and minimise/anonymise information where possible rather than promise immediate erasure of every backup. Passwords are hashed; secrets and evidence stay outside the public web root. Email bounce/complaint records contain event metadata and keyed recipient hashes, not email bodies.

Your rights and requests

Request access, correction, portability where applicable, restriction, objection, consent withdrawal or deletion via the contact above. You can edit your player declarations and publicity preferences in account settings. We will verify ownership proportionately through the existing account/email, explain any lawful retention, acknowledge requests promptly and aim to respond within 30 days; applicable law may require a different deadline. You can complain to the Nigeria Data Protection Commission. No fee or identity document is demanded as a default condition for exercising rights.

The planned service scale requires addressing NDPA/GAID major-importance duties, including a suitable data protection officer and applicable registration/audit deadlines. Processing and overseas-transfer grounds must be documented. The platform does not claim registration, an exemption or legal approval.