Privacy policy

1. Who we are

Dyst is operated by Software By Bear (enkeltmandsvirksomhed), CVR no. 42094099, Thit Jensens Gade 4, 11, 8000 Aarhus C, Denmark (the “Controller”, “we”, “us”).

Contact for privacy and data-subject requests: bjornsnorgaard@gmail.com.

This policy explains how we process personal data when you use Dyst at https://dyst.bybear.dk and related gateway services.

2. What Dyst does

Dyst lets people in a competitive organisation record match results and maintain derived skill ratings. It is not a gambling, betting, or real-money staking service.

3. Data we collect

We process the following categories of personal data:

3.1 Account data from Google

Sign-in currently uses Google OAuth (scopes: openid, email, profile). From Google we receive and store your:

• email address
• name
• profile picture URL

Google’s own processing is governed by Google’s terms and privacy policy. We do not receive or store your Google password.

3.2 Data you provide in Dyst

• optional display name on your profile
• organisation names and optional organisation picture URLs
• team display names (cosmetic labels for roster fingerprints)
• match facts you or other members record (line-ups, scores, played-at time, optional comments)
• invitation email addresses when someone invites a person to an organisation
• membership and permission settings within organisations

3.3 Technical and session data

• session identifiers stored in HttpOnly cookies so we can keep you signed in securely
• standard server and security logs that may include IP address, user agent, timestamps, and request metadata needed to operate and protect the service
• OpenTelemetry traces, metrics, and logs collected by our collector and stored on infrastructure we operate (Grafana Loki, Tempo, Prometheus, and Jaeger). These may include request paths, operation names, and internal identifiers such as user and organisation UUIDs. They do not include your email address or session cookie values.

We do not currently run third-party product analytics (such as advertising trackers). If we introduce additional telemetry or analytics later, we will update this policy.

4. Why we process your data (purposes and legal bases)

Under the GDPR / Danish data-protection rules, we rely on:

• Contract (Art. 6(1)(b)) — to create your account, authenticate you, provide organisations, matches, ratings, and invitations, and respond to support requests related to the service.
• Legitimate interests (Art. 6(1)(f)) — to secure the service, prevent abuse, debug faults, keep match-history projections usable for remaining members after account deletion (see section 7), and improve reliability. Where we rely on legitimate interests, we balance them against your rights and expectations.
• Legal obligation (Art. 6(1)(c)) — where we must retain or disclose information to comply with Danish or EU law.

5. How we use your data

• operate sign-in and sessions
• show profiles, memberships, teams, matches, and ratings inside organisations you belong to
• deliver invitation flows using the email addresses provided by organisers
• recalculate skill ratings from effective match history
• maintain security, integrity, and availability of the service
• communicate with you about your account or the service when needed

We do not sell your personal data. We do not use it for third-party advertising.

6. Sharing and hosting

Personal data is processed by Software By Bear. The application is intended to run on infrastructure we operate (including a self-hosted / homelab setup). Hosting location and subcontractors may change as the service evolves; material changes will be reflected in this policy.

We share data only when necessary:

• Google — to authenticate you via OAuth
• Other organisation members — your name, display name, picture, and match participation are visible to members of organisations you join, according to how the product works
• Authorities — if required by law or to establish, exercise, or defend legal claims

Authentication with Google may involve processing outside the EU/EEA under Google’s arrangements (including Standard Contractual Clauses or equivalent safeguards where applicable).

7. Retention and deletion

We keep account and service data for as long as your account is active and as needed to provide Dyst.

From launch, you may request deletion of your personal information in the app (Profile → Delete account) or by emailing bjornsnorgaard@gmail.com from the address associated with your account. When we fulfil a deletion request:

• personal identifiers such as email, Google name, display name, and profile picture are deleted or anonymised
• match scores, results, and related competitive history are retained in anonymised form so skill-rating projections remain consistent for other users in the organisation
• active sessions for your account are invalidated
• if you still own an organisation, you must transfer ownership or delete that organisation before your account can be deleted

Technical logs and OpenTelemetry data (traces, metrics, and operational logs) are kept for about 30 days for security and operations, then deleted. They are stored on infrastructure we operate; we do not send this telemetry to a third-party analytics processor.

8. Cookies and similar technologies

We use essential cookies (and equivalent storage) for OAuth state and authenticated sessions. These are required for the service to function. We do not currently use non-essential advertising cookies.

9. Your rights

Subject to applicable law, you may request to:

• access your personal data
• rectify inaccurate data
• erase data (subject to the anonymisation approach in section 7)
• restrict or object to certain processing
• receive a copy of data you provided in a portable format where applicable
• withdraw consent where processing is based on consent (without affecting prior lawful processing)

To exercise these rights, contact bjornsnorgaard@gmail.com. You may also lodge a complaint with the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.

10. Security

We apply reasonable technical and organisational measures appropriate to a small self-operated service, including encrypted transport (HTTPS), HttpOnly session cookies, and access controls on production systems. No method of transmission or storage is completely secure.

11. Children

Dyst is intended for users aged 18 or older. We do not knowingly collect personal data from children under 18. If you believe a minor has created an account, contact us and we will take appropriate steps.

12. Changes

We may update this policy from time to time. The “Last updated” date at the top will change when we do. Continued use of Dyst after an update means you acknowledge the revised policy. For material changes, we may provide additional notice in the product or by email when practical.

13. Contact

Software By Bear · CVR 42094099
Thit Jensens Gade 4, 11
8000 Aarhus C
Denmark
Email: bjornsnorgaard@gmail.com