CPL Privacy Policy

Cup Pong League (“CPL,” “we,” “us,” or “our”) uses account, tournament, communication, ranking, and map information to operate the CPL tournament system. This policy explains what we collect, why we use it, what can be public, the service providers that process data for us, and the choices available to you.

Public CPL pages use usernames, team names, profile images, and tournament statistics. CPL does not sell or license personal data or SMS consent data. Private information may be processed by contracted service providers only as needed to provide, secure, support, or lawfully operate CPL.

1. Information we collect

Account information: username, first and last name, email, phone number, password hash, verification status, opt-in status, region, profile image, and account security history. During new-account creation, CPL sends the submitted date of birth to its backend only to determine whether the user is at least 21. CPL stores the resulting 21-or-older eligibility record, not the raw date of birth.

Tournament information: tournament names, backend IDs, PIN settings, organizer account, team names, player usernames, table assignments, check-ins, score submissions, brackets, standings, match status, points, and organizer/admin actions.

Payment and rental information: checkout session details, Whop purchase/webhook events, rental windows, organizer access, and purchase status. CPL does not store full credit card numbers.

SMS and email information: outbound messages, inbound replies such as YES, NO, HELP, STOP, HERE, START, and tournament commands, delivery status, timestamps, and related support/audit records.

Map and location information: CPL map pin submissions, venue/location names, addresses, schedules, organizer qualification status, uploaded pin logos/images, and activity checks.

Technical and security information: session data, device/browser details, IP address and IP-derived region, request logs, error logs, rate-limit activity, abuse reports, and admin alerts.

2. How we use information

Create, verify, secure, recover, and manage CPL accounts.
Run live tournaments, including team signup, table assignment, check-in, score submission, bracket advancement, standings, rankings, and organizer controls.
Send required transactional texts and emails for verification, security, account changes, tournament flow, organizer alerts, support, and deletion requests.
Display public tournament information using usernames, team names, team/profile images, live scores, rankings, standings, and map pins.
Prevent abuse, spam, unauthorized access, duplicate teams, score manipulation, fake accounts, and unsafe content; process user reports; and maintain each signed-in user's blocked-player list.
Maintain audit logs and records needed for security, support, payments, disputes, legal compliance, and platform reliability.

3. Information that may be public

Public CPL areas may show your username, profile image, team name, team image, tournament participation, wins, overtime records, points, standings, rankings, bracket placement, and map pin information. CPL is designed to avoid showing real first/last names, phone numbers, or email addresses on public rankings and tournament views.

4. SMS, email, consent, and opt-outs

Required operational texts. CPL accounts require a separate, unchecked consent to receive automated non-marketing texts used for verification, security, tournament signup, table assignments, match timing, bracket and result flow, organizer commands, and related operations. CPL cannot provide text-dependent account and tournament features without this consent.

Optional marketing texts. Promotional texts require a separate, unchecked opt-in. Marketing consent is not required to create an account, buy or rent services, or play. Message frequency varies and message/data rates may apply.

Reply STOP, STOP ALL, UNSUBSCRIBE, CANCEL, END, or QUIT to revoke SMS consent. Reply HELP, INFO, or SUPPORT for help. CPL treats other clear requests to stop as revocations when reasonably understood. CPL suppresses further covered texts as soon as practicable and in all events no later than 10 business days after receiving a valid revocation request. CPL may send one non-marketing confirmation that the opt-out was processed. Opting out does not delete your account, but text-dependent features will remain unavailable until you affirmatively opt in again.

CPL may send transactional emails for account notices, verification, security, recovery, purchases, tournaments, privacy requests, and support. Marketing email, if introduced, will use a separate lawful opt-out process.

5. Service providers, third-party categories, and no sale

CPL does not sell or license personal data, does not sell or share phone numbers or SMS opt-in records for third-party marketing, and is not a data broker. CPL does not use personal data for third-party targeted advertising.

CPL discloses only the data reasonably needed to contracted processors and service providers. Current categories include Cloudflare for edge hosting, security, storage, and analytics; private hosting and PostgreSQL database infrastructure; Telnyx for SMS delivery; Whop and its payment partners for checkout and payment events; Apple Music for catalog and playlist functions; email providers for transactional email; and monitoring, fraud-prevention, and support tools. These providers process data under their own terms and CPL's instructions where applicable. CPL may also disclose information to comply with law, respond to valid legal process, protect safety, investigate fraud or abuse, or enforce CPL rules.

6. Retention and security

CPL retains personal data only for the period reasonably necessary for the purpose collected. Account data is kept while the account is active; active tournament records are kept while needed to operate and resolve the event; payment, consent, opt-out, security, fraud, and audit records are kept as needed to satisfy legal, accounting, dispute, safety, and compliance obligations; completed tournament results and rankings may be retained in public or anonymized form to preserve league history. When data is no longer needed, CPL deletes, anonymizes, or securely isolates it according to the applicable record category and legal obligations.

CPL uses backend access controls, least-privilege service roles, password hashing, HTTPS, verification, audit logs, rate limits, and administrative role checks. No system is perfectly secure; report a suspected privacy or security issue promptly to support@cuppongleague.com.

7. Your privacy rights and choices

Confirm whether CPL processes your personal data and request access to it.
Correct inaccurate personal data in your account or ask CPL to correct it.
Request deletion of personal data, subject to lawful exceptions.
Request a portable copy of eligible personal data.
Opt out of sale, targeted advertising, or qualifying profiling. CPL does not currently engage in these activities.
Withdraw consent where processing is based on consent. The withdrawal method will be at least as easy as the method used to give consent, and CPL will stop covered consent-based processing as soon as practicable and, where New Jersey law applies, no later than 15 days after receiving the request.
Reply STOP to revoke SMS consent, or change available communication choices in account settings.
Appeal a denied privacy request.

8. How to submit a privacy request or appeal

Email support@cuppongleague.com with the subject CPL Privacy Request and identify the right you want to exercise. CPL will use reasonable methods to verify that the request concerns you or an authorized agent. CPL will respond without undue delay and generally within 45 days after receiving a verifiable request. When reasonably necessary and legally permitted, CPL may extend the response once by up to 45 additional days and will explain the reason.

If CPL denies a request, reply with the subject CPL Privacy Appeal. CPL will review and respond to the appeal within 45 days. If an appeal is denied, the response will explain how to contact the New Jersey Division of Consumer Affairs or another appropriate regulator. CPL will not discriminate against you for exercising a privacy right.

9. Age requirement and event rules

CPL is an adults-only service. A person must be at least 21 years old to create or use a CPL account or use CPL's interactive services. New-account creation requires a date of birth that passes CPL's server-side 21-or-older check. CPL does not retain the raw date of birth after that check. Tournament organizers and venues remain responsible for event-specific identity and age checks, alcohol laws, and venue admission rules. Contact CPL if you believe an under-21 person created or used an account.

10. Policy changes and contact

CPL may update this policy when practices, providers, or law change. The effective date above identifies the current version. Material changes will be presented through the site, app, account flow, or another reasonable notice before they take effect when required.

Privacy questions, requests, appeals, and complaints may be sent to support@cuppongleague.com.

Back to Cup Pong League View CPL Terms Community Guidelines Cookie Notice Privacy Requests

This policy describes CPL's current data practices. It is not a substitute for advice from qualified counsel about a particular event or business obligation.