Privacy Policy

Last updated: 1 May 2026

1. Who We Are

Grading Panel is operated by TY Kobudo, a sole-trader software business based in New South Wales, Australia.

2. What Data We Collect

Data	Purpose
Session identifier (`gp-session` cookie)	Ties your data to your browser session
Splash-seen flag (`gp-splash-seen` cookie)	Remembers whether you have seen the welcome screen
Event data you enter: event names, candidate names, scores, judge access tokens	Delivering the service
Standard server request logs: IP address, request path, timestamp	Security monitoring and error diagnosis — not linked to session data

No email address, phone number, account credentials, or payment information is collected at this time.

3. Candidate Data & Minors

Grading events may involve candidates of any age, including minors (persons under 18). We store only names and scores — no contact details, photographs, identification numbers, or other personal information. Organisations using the service to record data about minors are responsible for ensuring they have appropriate authority or consent to do so under applicable law.

4. How Data Is Stored & Who Can Access It

Your data is stored in a cloud database operated by Supabase, hosted in the AWS ap-northeast-1 region (Tokyo, Japan). This means your data is stored outside Australia. Supabase acts as a data processor on our behalf under their Data Processing Agreement; they do not use your data for their own purposes.

The application is hosted on Vercel, which processes standard web request data (IP address, request paths, timestamps) as part of serving the application.

Your data is associated with your session identifier and is not accessible to other users of the service. No other third parties receive your data.

5. Cookies

Grading Panel sets two first-party cookies only:

gp-session — your session identifier (required for the service to function)
gp-splash-seen — records that you have dismissed the welcome screen

No advertising cookies, tracking pixels, or third-party analytics are used.

6. Data Retention

Data is retained until you request deletion. No automatic expiry is applied. To request deletion of your data, email admin@tykobudo.com.au with your Session ID. Requests will be actioned within a reasonable time.

7. Your Rights (Australian Users)

Under the Australian Privacy Act 1988 you may:

Request access to personal information we hold about you
Request correction of inaccurate or out-of-date information
Complain to the Office of the Australian Information Commissioner (oaic.gov.au) if you believe your privacy rights have been breached

To exercise any of these rights, contact admin@tykobudo.com.au.

8. International Users & GDPR

This service is operated from Australia and is governed by Australian privacy law. If you are located in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) may apply to you and may grant you additional rights, including the right to data portability, the right to object to processing, and the right to lodge a complaint with your local supervisory authority.

We are not yet actively marketing to EU residents. Before doing so, this Privacy Policy will be updated to fully address GDPR requirements, including lawful basis for processing, appointment of an EU representative where required, and data subject rights fulfilment workflows.

9. Future Account-Based Access

If account registration (such as sign-in with Google or other OAuth providers) is introduced, we will collect email addresses and names as part of account creation. This Privacy Policy will be updated before that feature is launched.

10. Changes to This Policy

The “Last updated” date at the top of this page reflects the current version. We will post a notice on the website when material changes are made.

11. Contact & Complaints

Privacy enquiries and data deletion requests:
admin@tykobudo.com.au

Office of the Australian Information Commissioner:
oaic.gov.au — for complaints about handling of your personal information