Privacy Policy

This policy covers Formation — the web app your organization uses to manage rosters, scheduling, strategy, and communication — and the esports-tools.com sign-in that Formation and our sibling products share. The Discord bot has its own Bot Privacy Policy. Using Formation is governed by our End User Agreement.

Two roles matter here. Your organization decides what to enter about its members, staff, and prospects and is responsible for that information. We run the service and handle that data on the organization’s behalf, and we’re responsible for the account and security information we collect for ourselves.

The list below is a summary. Our Data We Collect document is the detailed inventory — each kind of data, where it comes from, why we use it, who can see it, and how long we keep it.

Account information: name, email address, password (stored only as a salted hash), timezone and time-format preference, an optional avatar, phone number, and Discord handle, your two-factor authentication secret and recovery codes if you enable them, and a record of the version of our agreement you accepted and when. If you connect or sign in with Discord, we also receive your Discord user ID, username, and the email address Discord has verified for your account (we ask Discord for nothing else), and use them only to match you to your Formation account.

Organization data: whatever your organization enters — rosters, jersey numbers, positions, in-game names, ranks, player bios and tracker links, schedules, match results, availability, strategies, discussion messages, direct messages between members, announcements, venues, gear and expense records, uploaded files and brand assets, onboarding documents and e-signatures (typed name, timestamp, and a snapshot of the signed document), player conduct records such as benching and disciplinary actions, and recruiting prospects — who are often people who have not signed up for Formation and whose information their organization entered.

Security and log data: the IP address and browser or device description recorded when you sign in (shown to you as “recent sign-ins”) and with entries in your organization’s audit log, request logs, and rate-limiting counters keyed to IP address.

Communications: messages you send to Formation Support, survey responses your organization gives us, and the emails we send you (verification, password reset, invitations, security and legal notices).

Device information: if you enable browser push notifications, we store the subscription your browser gives us. We can’t read anything else about your device from it.

Usage data: if analytics are enabled for this deployment, aggregate usage data (pages visited, approximate location, device type) through Google Analytics, only after you accept cookies.

Data from services you connect: game statistics from Riot Games or Steam for the account you give us, and Discord information described above and in the Bot Privacy Policy.

To authenticate you and run Formation for your organization; to display and sync the data your organization enters; to send reminders and notifications you or your organization configure; to secure the service, prevent abuse, and investigate problems; to respond to support requests; to send account, security, and legal notices; and to understand how the product is used well enough to improve it. We rely on performing our agreement with you, our legitimate interests in running a secure service, your consent where we ask for it (for example, analytics cookies), and legal obligations.

We don’t sell your personal information, we don’t share it for cross-context behavioral advertising, and we don’t use your organization’s roster or strategy data for advertising.

Within your organization. Other members and administrators see what your organization’s roles allow. Owners and administrators can see audit logs, which include the IP address recorded with an action.

Service providers that process data for us, only as needed to deliver their function: Amazon Web Services (hosting and storage, in the United States), Cloudflare (network protection and traffic routing — requests to Formation pass through it), Resend (transactional email delivery), and Discord (see next paragraph).

Discord. When you use the Discord bot, or when a message is sent to Formation Support, information is delivered through Discord’s platform. Support messages are posted to a private channel in our own Discord server so we can respond; they include the message, your organization’s name, and your name.

Other integrations you enable: your browser’s push service, Riot Games or Steam for stats syncing, and Google Analytics if enabled and accepted. Each receives only what its feature requires.

Our other products. Your Formation account is also your esports-tools.com sign-in. When you sign in to a sibling product with it, that product receives your name, email address, avatar, and account ID. Your password never leaves Formation.

Legal and safety. We may disclose information to comply with law or valid legal process, to protect rights, safety, and security, or as part of a merger, acquisition, or sale of the service (with notice to you where required).

Formation sets a session cookie so you stay signed in; it’s required and can’t be turned off. We also store small preferences in your browser (such as theme, dismissed notices, and which release notes you’ve seen). If Google Analytics is enabled, it sets cookies only after you accept them in the cookie banner, and declining doesn’t limit your access. We don’t respond to “Do Not Track” signals because there is no common standard.

Your organization’s data lasts as long as the organization exists. Organization owners can set how long the audit log is kept. Account and security records last while your account exists. You can disconnect integrations at any time, which deletes the data stored for them. You can delete your own account from the Account page, and an organization’s Owner can delete the whole organization from its Settings; both take effect immediately. You can also contact us to delete your account or an organization’s data, and we’ll act on verified requests within a reasonable time. Copies in backups age out on our normal rotation. We may keep limited information we’re required to keep by law or need to resolve disputes and enforce our agreement.

Depending on where you live (including California, the European Economic Area, and the United Kingdom), you may have the right to know what we hold about you, to access, correct, export, or delete it, to object to or restrict certain processing, and to withdraw consent. Much of this you can do in the app (your account page, integration settings, and the CSV exports), or you can email us at the address below. We’ll respond within 30 days (45 where the law allows) and won’t discriminate against you for exercising these rights.

If your information was entered by an organization, we may need to direct your request to that organization, which controls it. You may also complain to your local data-protection authority.

Formation is hosted in the United States. If you use it from elsewhere, your information is transferred to and processed in the United States, which may have different data-protection rules than your country.

Passwords are hashed and never stored or logged in plain text. Two-factor authentication is available. Sensitive endpoints (sign-in, signup, password reset) are rate-limited, traffic is served over HTTPS, and sensitive changes — role changes, permission grants, data resets — are written to an audit log your organization’s administrators can review. No system is perfectly secure. If a breach affects your personal information, we’ll notify you and regulators as the law requires.

Formation is not directed at children and isn’t for anyone under 13; we delete accounts we learn belong to a child under 13. People aged 13 to 17 may use it only with a parent’s or guardian’s permission, which the organization that adds them is responsible for getting. Formation is not designed to be a school’s system of record for student education records; schools and youth programs should decide whether their use is appropriate. A parent or guardian can email us to review or delete a minor’s information.

In the interest of transparency: substantial parts of Formation’s code were written with the assistance of AI tools (Claude, by Anthropic), directed and reviewed by a human developer. No user or organization data is used to train any AI model — this describes how the software was written, not how your data is processed while the app runs.

We may update this Privacy Policy at any time. When we do, we will notify you — by email to the address on your account and/or with a notice inside Formation — and we will change the effective date at the top of this page. For material changes we aim to give at least 14 days’ notice before they take effect.

If you keep using Formation after a change takes effect, you accept the updated Privacy Policy. If you don’t agree with a change, stop using Formation and contact us, and we’ll delete your data. Which version of our documents you accepted, and when, is recorded with your account.

Questions or data requests: [email protected].