Privacy Policy

We collect the minimum we need to run the tournament — your name, your email, and the actions you take on the site. We don’t sell your data, we don’t advertise, and we don’t track you around the web.

KAFCON (the Korea Africa Cup of Nations) is a one-day football tournament organised by Afro Entertainment, founded by Edmond Atemnkeng. We run this website at kafcon.statotec.com and are the data controller for the personal information you submit through it.

Questions about anything on this page? Email us at privacy@kafcon.statotec.com.

We collect the minimum we need to run the tournament platform.

When you sign up with email and password

• Your full name (as you type it).
• Your email address.
• A bcrypt hash of your password — never the password itself.

When you sign in with Google

• The openid, email, and profile scopes from your Google account: your email, name, and profile picture URL.
• We don’t ask for, store, or read your Google contacts, Drive, Calendar, Gmail, or any sensitive data.

When you use the site

• A session cookie set by NextAuth — strictly necessary to keep you signed in.
• If you hold a role beyond “fan” (referee, team manager, organiser, player, press), records of the actions you take through the app: match events you log, news posts you author, squad changes you make. These are attached to your user record so the rest of the platform can credit and audit them.
• Standard server logs (IP, user-agent, request path, timestamp) generated by our hosting provider. We use these for debugging and abuse-prevention only.
• Photos and video clips you or organisers upload to the news feed or the media gallery. These are stored on Cloudinary and served from its CDN.

• Authenticate you and keep you signed in.
• Display your name (and Google profile picture, if any) where you take public actions — as the author of a news post, the ref who logged a goal, the manager who submitted a squad.
• Operate the tournament — manage squads, fixtures, scoring, and the community feed.
• Communicate with you about KAFCON, when you’ve asked us to.
• Protect against abuse, debug issues, and keep the service secure.

We do not sell your personal information, build advertising profiles, or share your data with marketing third parties.

We use these sub-processors. Each handles a narrow slice of the platform, and each is bound by their own data-processing terms:

• Vercel (USA) — hosts the website and runs the application. Sees request metadata and server logs.
• Neon (USA) — hosts our PostgreSQL database. Stores all account, tournament, and content data.
• Google — provides Sign in with Google when you choose it. Sees your sign-in attempt.
• Cloudinary (USA) — stores and serves uploaded images and video clips (news covers, media gallery, profile pictures).
• Resend (USA) — sends transactional email (password resets, role-credential issuance, important notifications).

Data may be transferred to and processed in the United States or other countries where these providers operate. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

Account data is kept for as long as your account is active. If you delete your account, we remove your personal information within 30 days, with two exceptions:

• Tournament match results — scorers, line-ups, cards, final scores — are part of public KAFCON history and stay published. Your player record is dissociated from your user account.
• Audit logs of administrative actions (role changes, edition edits) are retained for one year for accountability.

Server logs are retained by our hosting provider for around 30 days.

Depending on where you live, you may have rights under PIPA (South Korea), GDPR (EU/UK), or similar laws — including the right to:

• Access the personal data we hold about you.
• Correct it if it’s wrong.
• Delete it.
• Object to certain processing, or restrict it.
• Receive a portable copy.
• Withdraw consent at any time (where processing is based on consent).

Email privacy@kafcon.statotec.com and we’ll respond within 30 days. If you’re in Korea and we don’t resolve your concern, you can contact the Personal Information Protection Commission (PIPC).

We only set cookies strictly necessary to operate the site — the session cookie that keeps you signed in, a CSRF protection cookie, and a short-lived cookie that records your acceptance of these terms during sign-up. We don’t use advertising or tracking cookies.

KAFCON is not aimed at children under 14. Players under 14 may participate in the tournament with parental consent, but accounts on this website should be created by an adult on their behalf. If you believe a child has created an account, email us and we’ll remove it promptly.

Passwords are hashed with bcrypt at 12 rounds. Data in transit is encrypted with TLS. Database connections use SSL. Access to production systems is limited to the KAFCON organising committee and audited. We don’t claim perfect security — if you spot a vulnerability, please report it to privacy@kafcon.statotec.com and we’ll respond.

We’ll update this page if our practices change. The “Last updated” date at the top reflects the most recent revision. Material changes will be announced in the news feed.

Afro Entertainment
Pyeongtaek, Gyeonggi-do, South Korea
privacy@kafcon.statotec.com