The data controller for this tournament is Triple N, contact GeneralAdminTripleN@protonmail.com. The governing law and supervisory authority are those of [JURISDICTION / GOVERNING LAW].

We are not affiliated with, endorsed by, or sponsored by KRAFTON, Inc., Tencent Games, or PUBG MOBILE. Any trademarks referenced belong to their respective owners.

• Account data — your email address, an optional display name, and a salted Argon2id hash of your website password.
• PUBG player identity — the in-game identifier (UID), nickname and region, together with a verification status and the identifier the authentication provider uses for you. Where this comes from is described in section 04.
• Team and registration data — team name, roster composition, registration status and timestamps.
• Operational data — a hashed form of your IP address in audit records, request timing and error metadata.

We do not collect, store, transmit or process PUBG MOBILE account passwords. We never display a PUBG MOBILE login form on this website, our API rejects any request that carries a game credential, and there is no column in our database capable of holding one.

We make no claim to be authorized to process PUBG MOBILE account credentials, and this platform does not do so. Should a tournament workflow ever require the involvement of an official game-account or anti-cheat system, that would be implemented only under official written authorization from the relevant rights holder, and this policy would be revised first to describe exactly what is collected, on what legal basis, and for how long.

When you select Connect PUBG MOBILE, your browser leaves this website and goes to an authentication page operated by a third party. You authenticate there, on their page, under their privacy policy. We are not a party to that exchange: we do not see the page, the form, or anything you type into it.

The destination address is fixed by the tournament administrators in server-side configuration. It cannot be influenced by a link you were sent, a bookmark, or anything in your browser — the only value we will ever send you to is the configured one.

When you start this flow we record that it happened: your account identifier, the time, a hashed form of your IP address and the origin of the destination. We deliberately do not record the full address, because its path and parameters belong to the authentication provider.

No official callback is available at this time. That means returning from the external page does not, by itself, create or verify a player profile here. Until an official integration exists, a player profile is either supplied by you for a tournament administrator to check by hand, or entered by an administrator. We never mark a profile verified without a human doing so, and we never present an unverified profile as verified.

• To operate your account — authentication, email verification, password reset. Basis: performance of a contract.
• To run the tournament — identifying squads, validating rosters, allocating slots, publishing results. Basis: performance of a contract.
• To keep the competition fair and the service secure — audit logging, rate limiting, abuse prevention. Basis: legitimate interests.
• To meet legal obligations where applicable. Basis: legal obligation.

In the current development build, no data is shared with any third party. There are no outbound integrations, no analytics, no advertising, and no email delivery — messages are written to the local server console only.

A production deployment would use the processors listed below. This section must be completed before launch: [HOSTING PROVIDER], [EMAIL DELIVERY PROVIDER], [CDN / SECURITY PROVIDER], [ANY OTHER PROCESSOR]. Each requires a data processing agreement.

The current build contains a simulated anti-cheat step. It generates a reference identifier locally and performs no network request. No data is transmitted to any anti-cheat system, by any channel.

If an official anti-cheat integration is added in future, the following must be documented here before it is enabled: the exact fields transmitted, the recipient, the legal basis, the transfer mechanism, the retention period applied by the recipient, and the security measures in place. No such integration exists today, and nothing is transmitted to any anti-cheat service.

Account data is retained while your account is active. Registration and audit records are retained for the period required to run and settle the tournament and to handle disputes: [RETENTION PERIOD]. After that they are deleted or anonymized.

Development test data is discarded whenever the local database is reset.

Subject to applicable law, you may request access to, correction of, or deletion of your personal data; object to or restrict processing; and request portability. You may also lodge a complaint with your supervisory authority.

To exercise these rights, contact GeneralAdminTripleN@protonmail.com. [RESPONSE TIME COMMITMENT]

Website passwords are hashed with Argon2id and are never stored or transmitted in plain text. Sessions use HttpOnly, SameSite cookies and can be revoked. Requests are rate limited, database access is parameterized, and administrative actions are recorded in an append-only audit log with credential fields stripped before writing.

No system is perfectly secure. Report a suspected vulnerability to GeneralAdminTripleN@protonmail.com.

We use two strictly necessary cookies: a session cookie that keeps you signed in, and a CSRF token cookie that protects against cross-site request forgery. There are no analytics, advertising or tracking cookies.

The service is not directed at anyone under 16, and we do not knowingly hold data about them. Triple N may request proof of age. If you believe someone under 16 has provided personal data, contact GeneralAdminTripleN@protonmail.com and it will be removed.

Material changes will be communicated to registered users before they take effect. The version and date at the top of this page always reflect the current text.