Privacy Policy
This notice explains how Baran Ahmedov, based in Bulgaria, handles information for this Baran's Scoreboard instance. Contact: [email protected].
Your scoreboards stay in your browser
The optional GitHub star reminder stores its last visit, dismissal time and whether you selected GitHub locally in your browser. It makes no analytics request and is hidden permanently after you select a project GitHub link.
No account is required. Names, team names, scores, icons and appearance settings are saved locally in the IndexedDB database named scoreboard. They are not uploaded to the application server or included in analytics. Exported JSON backups are files you choose to download; imports are read locally. You control where you keep or share these files. Share links contain a snapshot directly in the URL fragment, not in a sharing database. Anyone with the link can read and copy its names, scores and settings. The fragment is not sent in the HTTP request to this site; recipients open their own independent copy. Share only information you intend to disclose.
Browser storage is not permanent: clearing site data, private browsing, storage limits, a different browser, or a changed domain can remove access. Export important results. A normal application update at the same origin does not intentionally delete scoreboards.
Necessary delivery and security processing
The hosting provider processes connection information, including IP addresses, request times, requested URLs, browser details, referrer information where the browser provides it, and response statuses, to deliver and secure this site. If the hosting provider enables AWStats, it may analyse these access logs, including the IP addresses recorded in them, to prepare traffic reports. This happens independently of optional application analytics; rejecting those analytics does not disable hosting logs, AWStats or necessary security processing. No hosting-level logging settings are changed by this application.
If Cloudflare is configured as a reverse proxy, it processes connection information, including IP addresses, for delivery and security, whether or not its optional analytics beacon is allowed. The application does not require Cloudflare. Delivery and security processing relies on the operator’s legitimate interests in providing and protecting the service, subject to applicable law; hosting providers may also have their own obligations and legal grounds. Exact log fields, retention periods, backup retention and access depend on the active provider arrangements and must be confirmed for the deployed instance.
Optional site usage analytics
Only after you opt in, the application may record a random browser preference identifier, visit times, allowlisted public page paths, predefined action labels and click counts, and estimated active time. A visit ends after 30 minutes of inactivity. Active time is estimated from visible, focused pages with recent activity. Records are held in the hosting MySQL database and accessible only through authenticated administration. Consent is the legal ground for this optional processing.
Custom application analytics do not store visitor IP addresses, IP-derived visitor identifiers, fingerprints, precise location, query strings, text input, scoreboard content, mouse movement or screen recordings. Server security processing described separately still uses connection addresses where needed.
Optional Cloudflare Web Analytics
This performance beacon requires its own separate opt-in and can be refused independently of site usage analytics. It is disabled by default and unavailable unless the operator configures it. The application does not send its first-party click records, active time or scoreboard content to this service. The beacon uses browser timing metrics, such as page-load timings. Cloudflare states that Web Analytics does not track individual end users across customers’ internet properties. According to its current documentation, unsampled beacon data is retained for seven days and then aggregated to around 10% for longer-term storage; Web Analytics data is accessible in its dashboard for six months. See Cloudflare’s Web Analytics FAQ and data collection documentation.
The operator must disable automatic beacon injection before enabling the manual integration. Rejecting this beacon does not disable Cloudflare’s delivery or security services. A request already in progress when you withdraw may finish.
Your privacy choices and browser preferences
Both optional analytics choices start off. You can close the panel without consenting, reject both choices, allow configured options, or save an individual choice. The scoreboard works with all analytics disabled. Reopen Privacy choices in the footer or on this page.
A necessary first-party Secure, HttpOnly, SameSite=Lax cookie named score_preferences remembers an opaque preference token for up to 180 days. Permissions are checked on the server for every application analytics request. The matching preference record is kept for no longer than one year. Withdrawing usage consent deletes analytics associated with that browser preference. Disabling Cloudflare prevents subsequent beacon loads and reloads this page to stop its loaded integration. Other open pages refresh consent on focus and receive same-origin preference-change notifications.
Local storage remembers the site theme, chosen language, dismissed language suggestion and active scoreboard identifier. Theme follows the device by default. A different supported device language can produce an optional suggestion; explicit localized URLs are respected. These preferences are necessary user-interface settings and do not grant analytics consent. Clearing preference cookies may prevent linking a later request to earlier analytics. It does not delete IndexedDB scoreboards unless you also clear site data.
Administration and retention
There is no public registration. The operator configures an administrator password outside the public repository. A Secure, HttpOnly, SameSite=Strict cookie named score_admin maintains an authenticated session for at most one hour. Temporary login and public API abuse limits process connection IP addresses transiently. A keyed hash and counter are kept in a separate security table during a 15-minute rate-limit window and until scheduled cleanup, which normally runs hourly; if cleanup fails, expired rows may remain until it succeeds. No raw IP addresses are stored in this table, and hashes are not used as visitor identifiers. This security processing relies on legitimate interests in preventing unauthorised access and abuse and maintaining service availability.
Visits from an authenticated administrator are excluded from first-party usage analytics. This does not change hosting logs, AWStats or Cloudflare processing.
Application visits, page views and clicks expire within 365 days. Expired records are excluded from administration queries immediately; a scheduled cleanup removes them from storage. Operators must schedule cleanup hourly, including during quiet periods, and monitor failures. Preference records expire within one year. Server backups are separate; their access, retention and deletion depend on the deployment settings. The supplied backup guidance limits temporary copies and requires purging restored analytics and consents before reopening a restored service. Deletion from live tables does not immediately erase existing backups.
Recipients, transfers and correspondence
The site operator and hosting personnel with a need to operate the service may access server information. Recipients may include the hosting/database provider, Cloudflare if configured for delivery or separately consented analytics, and email providers if you contact the operator. The application has no contact form. If you send email, your address, message and attachments are processed to respond and retain relevant correspondence; this is separate from analytics and based on legitimate interests in managing enquiries. Correspondence is kept while reasonably needed, not for a fixed analytics period.
Provider locations, contractual safeguards, transfers outside the EEA, hosting-log retention and backup schedules must be confirmed for the deployed service. This notice does not invent those provider facts or promise universal compliance. External links, including GitHub, connect to another operator only when selected; that operator’s privacy notice applies. Personal information is not sold by this application, and there are no advertising trackers.
Your rights
Contact [email protected] to request access, correction, deletion, restriction or portability where applicable, to object to processing based on legitimate interests, or to withdraw consent. Reasonable verification may be needed to locate records and protect other people’s data. Requests are ordinarily handled within one month under applicable data protection rules; lawful extensions may apply. You may complain to your competent authority, including Bulgaria’s Commission for Personal Data Protection (cpdp.bg/en/), without first contacting the operator.
Age and privacy
The scoreboard is intended for general use, including classrooms, without requiring student information. Do not put sensitive personal information in team names or backups. No age or student profile is collected. Where Bulgarian rules require parental authorization for consent-based online processing of children under 14, optional analytics must not be enabled for such use without an appropriate authorization process. The supplied deployment disables analytics by default; schools and self-hosters must assess their actual audience and arrangements before enabling them.
Security
No internet service can be guaranteed entirely secure. This application does not make automated decisions with legal or similarly significant effects.
Data controller and contact
Baran Ahmedov