Privacy policy
Last updated: 23 July 2026
This policy is available in Dutch and English.
This is a plain-language summary of how Copa handles your data — written to be honest and readable rather than exhaustive.
Copa is a small tool for running amateur football tournaments: a schedule, live scores, standings and a “man of the match” vote. It is built to hold as little about you as possible.
In short
- No analytics, no advertising, no third-party trackers, no tracking pixels.
- No cross-site tracking and nothing sold or shared for marketing.
- That is why there is no cookie consent banner — there is nothing to consent to beyond a login cookie and a language preference.
Who runs Copa
Copa is operated by Bliz.io BV, Elandsstraat 4C, Amsterdam, Netherlands. For any privacy question, email privacy@copafutbal.com.
What data we collect
The personal data Copa holds is deliberately narrow:
- Your account: your email address, an optional display name, and your password. The password is never stored in a readable form — it is hashed with scrypt and a per-account random salt, and the plaintext is never written down.
- Player names: when an organizer builds a tournament roster, they type players’ names. Those names appear on the tournament’s own page, which is private by default — visible only to the people the organizer shares its link with — unless the organizer chooses to list the tournament on the public calendar.
- A venue, if an organizer adds one: its name, address and map coordinates, so players can find the pitch.
- The “man of the match” vote is anonymous. It uses a random token stored on your own phone to stop double-voting — it is not linked to your name or your account.
Cookies and local storage
Copa uses exactly three small things, and none of them track you:
- copa_session — keeps you signed in. Strictly necessary; set only when you log in; readable only by the server (httpOnly), never by scripts.
- copa-lang — remembers your language choice. Functional; set only when you explicitly pick a language.
- A one-vote-per-phone token in your browser’s local storage, so the anonymous man-of-the-match vote counts once per device.
Who else is involved
Copa relies on exactly two outside services, and no others:
- Fly.io hosts the app. The servers are in the EU (Amsterdam). Standard server logs may briefly hold technical data such as IP addresses to keep the service running and secure.
- When you search for a venue, your browser sends what you type to Photon (photon.komoot.io), a geocoder built on OpenStreetMap data, to look up matching places. Only your typed query is sent, and only while you are searching.
How long we keep it
Your account is kept until you delete it. Tournaments are the shared record of a day many people played, so they remain even after an organizer deletes their account — but they are no longer linked to that account.
Changes to this policy
If this policy changes, the “last updated” date above changes with it. There is no history of prior versions kept here.
Your rights
You can download a copy of your data or delete your account at any time from your profile: your account settings.