Rankbrawl
Back home

Privacy Policy

Last updated: July 5, 2026

This policy explains what information Rankbrawl ("the Service"), operated by WBX Digital ("we", "us", "our"), collects, how it is used, and the choices you have.

1. The short version

Rankbrawl is designed to collect as little as possible. There are no user accounts, we run no advertising, and we never sell your data. To understand how the Service is used and make it better, we use privacy-respecting analytics: the open-source, cookieless tool Umami and Microsoft Clarity (which uses cookies and records anonymized usage sessions, and which EU/EEA/UK visitors opt into first); see section 4. Most of what you create stays in your own browser. Information reaches our servers only when you deliberately create a shareable link or join a live bracket. Anything you share becomes accessible to anyone who has the link.

2. Information stored on your device (not sent to us)

As you build a ranking, the Service saves your work locally in your browser (using IndexedDB and local/session storage) so a refresh doesn't lose it. This includes:

  • your in-progress ranking: item names, any pictures, scores, and rater names;
  • a per-browser history of rankings and brackets you've opened, hosted, or joined, and the share links you've created;
  • preferences such as your chosen theme and a randomly generated, anonymous participant ID and display name used for brackets.

This information lives only in that one browser and is not transmitted to us. You can erase it at any time using the in-app "Clear all" action or by clearing your browser's site data.

3. Information you choose to send us

The following is stored on our servers only when you take an action that requires it:

Shared rankings, data sets, and bracket results

When you create a share link (a ranking link, a "roster only" data-set link, a continuously-updating link, or a shared bracket result), we store a snapshot of the relevant content so the link can be opened later. Depending on what you share, a snapshot may include item/person names, pictures (either an image URL you provided or an uploaded image embedded in the snapshot), numeric scores, an optional title, and creation/update timestamps, all keyed to a short random code. We also keep a simple counter of how many times each shared link has been opened.

Live brackets

When you host or join a real-time bracket, the bracket (participants' display names, the roster, votes, and timers) is kept in the server's memory only while the bracket is active and is discarded when the bracket ends. We do not persist votes or participant lists. For public brackets and for aggregate counts, we keep a small registry record for each bracket (its code, optional title, whether it is public, its status, roster size, the champion's name, and timestamps). A completed bracket is stored only if a participant chooses to create a shareable results link.

4. Information collected automatically

Like virtually all websites, the infrastructure that hosts the Service may automatically record standard technical log data (such as IP address, browser/user-agent, and timestamps of requests) for security, abuse-prevention, and operational purposes. We do not use this data to build advertising profiles of you or to track you across other sites.

Analytics

To understand how the Service is used and to improve it, we use two third-party analytics tools. We rely on this data only in aggregate; we do not use it for advertising, and we never sell it.

  • Umami, an open-source, privacy-focused analytics tool. It is cookieless and collects only aggregated, anonymous usage data (such as page views, referring site, and general device and browser type). It does not set tracking cookies or identify you personally.
  • Microsoft Clarity, a product-analytics tool from Microsoft that helps us see how people navigate the Service through aggregated heatmaps and anonymized session replays (for example, clicks, scrolls, and mouse movement, with typed content masked by default). Unlike Umami, Clarity sets its own cookies, so whether it runs is gated on your location and consent: if you are in the EU, EEA, or UK, Clarity is not loaded and nothing is stored on your device unless you opt in through the consent banner we show you; visitors elsewhere have it on by default. Any choice you make in that banner is remembered on your device, and you can turn Clarity off at any time with your browser's privacy controls or a tracker blocker. Clarity processes this information on Microsoft's servers under Microsoft's privacy statement, and is not used to identify you.

We do not combine analytics data with the content you share to identify you. You can limit this collection using your browser's privacy controls or a content/tracker blocker.

5. Pictures and third-party content

You may add pictures either by uploading a file (which is embedded in your content) or by pasting an image URL. When content that references an external image URL is displayed, the viewer's browser loads that image directly from the third-party server hosting it, and that server may receive the viewer's IP address and request information. We do not control those third-party servers, and this policy does not cover them.

6. How we use information

  • to provide the Service: generating links, opening shared content, running live brackets, and counting visits;
  • to understand and improve how the Service is used, through the aggregated analytics described in section 4;
  • to maintain, secure, debug, and improve the Service and prevent abuse;
  • to comply with law and enforce our Terms of Service.

We do not sell or rent your personal information, including the analytics data described above, and we do not use it for advertising or for automated decision-making that produces legal or similarly significant effects.

7. When information is shared with others

  • By your own action. Anything you turn into a share link is accessible to anyone who obtains that link, and public brackets are listed on our browse page. Treat shared content as public.
  • Service providers. We rely on third-party infrastructure providers that process data on our behalf to run the Service. In particular, we use Cloudflare, Inc. for application hosting, real-time brackets, database storage, image storage, and content delivery; Cloudflare processes shared snapshots, image uploads, bracket registry data, and standard request logs on our behalf, across its global network. We also use analytics providers, Umami and Microsoft Corporation (Microsoft Clarity), which receive the aggregated usage data described in section 4 to help us measure and improve the Service.
  • Legal and safety. We may disclose information if required by law, or where we believe in good faith it is necessary to comply with legal process, enforce our terms, or protect the rights, safety, or property of WBX Digital, our users, or the public.
  • Business transfers. If the Service is involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction.

8. Information about other people

The Service lets users create rankings that may include other people's names and images. If you submit information or images about another person, you are responsible for having any consent or rights required to do so (see the Terms of Service). If you are depicted in shared content and want it removed, contact us using the details below and provide the link or code so we can locate it.

9. Data retention

Content you keep locally remains until you delete it or clear your browser. Shared snapshots and registry records are retained until they are deleted by us, removed at your or a data subject's request, or removed under our routine operational and abuse-management practices. Active bracket data is transient and is discarded when the bracket closes.

10. Your choices and rights

Because there are no accounts, the simplest controls are in your hands: you can clear your local data at any time, and you can decide what, if anything, to share. Depending on where you live, you may have rights under laws such as the EU/UK GDPR or the California Consumer Privacy Act (CCPA/ CPRA), including rights to access, correct, or delete personal information, and the right not to be discriminated against for exercising them. We do not sell or "share" personal information as those terms are defined under the CCPA. To make a request, including to remove shared content, email us at contact@wbxdigital.com and include the relevant link or code. Because we cannot identify individuals from our records, we may be unable to act on a request without that information.

11. Children

The Service is intended for users aged 13 and older and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact us and we will delete it.

12. Security

We take reasonable measures to protect information, but no method of transmission or storage is completely secure, and we cannot guarantee absolute security. Do not share content you consider sensitive or confidential.

13. International users

The Service runs on globally distributed cloud infrastructure, so your information is processed and stored in data centers in multiple countries, including the United States, selected automatically based on network routing. Data-protection laws in those locations may differ from those where you live. Where required, transfers of personal data out of the EEA/UK rely on appropriate safeguards, such as the Standard Contractual Clauses offered by our infrastructure providers. By using the Service you consent to this processing.

14. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above. Material changes may be indicated more prominently. Continuing to use the Service after an update means you accept the revised policy.

15. Contact

Questions or requests? Email contact@wbxdigital.com, or visit wbxdigital.com. This Service is operated by WBX Digital.