Last updated: October 2026
Buhurt Arena ("we", "our", "us") operates the website buhurtarena.app and related services, including the Buhurt Companion mobile application (the "Service"). This Privacy Policy explains what personal data we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR) and applicable Finnish data protection law.
By using the Service you agree to the collection and use of information in accordance with this policy.
The data controller responsible for your personal data is the operator of Buhurt Arena. For any privacy-related enquiries please contact us at: [email protected]
When you sign in through a third-party identity provider (Authentik / OAuth), we receive your email address and display name. We store only the minimum information required to identify your account and control access to the Service.
If you or an administrator creates a fighter or marshal profile in the system, the following data may be stored: first name, last name, nickname, nationality, weight class, club affiliation, the year the fighter started the sport, and a short biography. This data is used to manage tournament registrations and display competition results.
When you sign up for an event on the website, we store your first and last name, email address, club, nationality, the categories and roles you chose (fighter, marshal, support or manager), your weight when a category asks for it, any note you write, and your answers to the organiser's own questions on the form, together with the organiser's answers. Those questions can ask for health information such as food allergies: answering is your choice where the question is optional, and the answers are used only to run that event. When the organiser asks for them, we also store an emergency contact (a name and a phone number, which you give with the other person's knowledge, to be called only if something happens to you at the event) and what the event's stream may show of you (pronouns, how to say your name, a nickname, height, the year you started the sport, a line for the commentators, a social media handle — each optional). The organiser may mark whether you have paid the event's fee. You do not need an account: we email you a link to confirm the sign-up, and the same link lets you see, change or cancel it. Your details are shown only to the organisers of that event (and to site administrators), so they can run the event and contact you about it. They are never shown publicly.
When an organiser marks an event as streamed, everyone who signs up for it (fighters, marshals, supports and managers) is asked to agree that the event is filmed and streamed live, that recordings may be published afterwards (the form says where, when the organiser gives it), and that their name, club, nationality and results may be shown on the stream. This agreement is needed to take part in a streamed event; to take it back, cancel the sign-up. The stream and its recordings are run by the event's organiser, who is responsible for them.
When an organiser asks for stream photos, the form asks separately whether the photo you send may be used on the stream's graphics and in the event's posts. This is optional: if you do not allow it, you are not asked for a photo. You can allow it or take it back at any time from the link in your sign-up email, also after the sign-up has closed, and the organiser sees the change in their list. Photos are sent by replying to the email and go straight to the address the organiser gave; they are not stored on this website. The organiser should use them only for that event and delete them when they are no longer needed for it.
We keep each agreement with the time it was given and the version of the wording shown, so that the organiser can show what was agreed. Someone under 18 signing up gives the name of a parent or guardian and confirms that the parent or guardian agrees to the sign-up and to everything agreed on the form.
To keep automated mass sign-ups out, the sign-up form uses Cloudflare Turnstile, a check that you are not a bot. It runs in your browser when the form is shown and usually needs nothing from you; Cloudflare receives technical information about your browser and connection to do the check, as its own privacy policy describes, and sets no tracking cookies. Our server only receives the result. Sign-ups from one connection are also limited to a number per hour.
Club profiles may include the club name, country, location, and a logo image uploaded by an authorised administrator.
We store event schedules, match results, scores, and standings. Fighter names may appear in publicly visible match results and league tables.
We may collect standard server log data (IP address, browser type, pages visited, timestamps) for security and operational purposes. This data is not used for profiling or marketing.
The Buhurt Companion mobile app has no account and no sign-in. Everything you enter in it — your fighter profile, body measurements and weight, any optional cycle tracking, training logs and session history, armory entries, notes and settings — is stored on your device only. It is not transmitted to our servers, and it is not sold or shared. Deleting the app removes it from the device; if you back up your device, the app's data is part of that backup under your own account.
The app does not request or record your location. The camera is used to scan a connection QR code and to take photos you choose to add to your profile and armory; the photo library is used only for the photos you pick. Those photos stay on your device.
The app uses the network to read public event, league, club and fighter listings and to download rule and reference documents from buhurtarena.app, and about once a day to check which app version is the latest. These requests carry no personal data. In the optional Marshal mode, match timing, scores and penalties are sent to the event organiser's own Buhurt Arena computer on the local network, together with the name you entered as marshal and the list you are working at, only while connected. A score that could not be delivered waits on your device and is sent when the connection returns.
If you choose a fighter or club to follow at an event, that choice is stored on your device only. With your permission the app can then notify you when their fight is coming up. These notifications are created on your device from the event's public schedule; they are not sent through a push service, no notification token is sent to us, and you can switch them off in your device's settings at any time.
We process personal data on the following legal bases:
We do not sell, rent, or share your personal data with third parties for marketing purposes.
We retain personal data for as long as necessary to provide the Service and comply with legal obligations. Fighter profiles and competition records are kept as part of the historical record of the sport. You may request deletion of your account data at any time (see Section 8).
An event sign-up that is not confirmed is reminded once after a day. It does not count until it is confirmed, but its organiser sees it (so a confirmation email that went astray can be sent again). A confirmed one may get one reminder email shortly before the event. A sign-up, confirmed or not, is kept until the event is deleted or its organiser removes the sign-up; a cancelled sign-up stays on the organiser's list as cancelled. You can ask the organiser, or us, to delete your sign-up at any time. Every email the site sends is logged — the address, what it was about, when, and whether the email service delivered it — and the log is kept for a year, so an email that did not arrive can be found and sent again.
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. All data in transit is encrypted using TLS. Access to administrative functions requires authenticated credentials.
Under the GDPR you have the following rights regarding your personal data:
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).
The Service uses session cookies necessary for authentication. We do not use tracking cookies, advertising cookies, or third-party analytics services.
Authentication is handled via an Authentik identity provider. Your login credentials are managed by that provider and are not stored directly by Buhurt Arena. Please review the privacy policy of your identity provider for further details.
The Buhurt Companion mobile app uses Sentry (Functional Software, Inc.) for crash reporting. Sentry may collect device model, operating system version, app version, and stack traces when a crash occurs, together with a random per-install identifier. No name, account or content you entered is included. 20% of app sessions are sampled for performance monitoring. Data is processed on Sentry's EU infrastructure. Sentry's privacy policy: sentry.io/privacy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.