Privacy Policy

The short version

PODIUM is the competition platform of BFT MENA. We collect only what running the competition needs: account and registration details, registration fee records, exercise scores and results, the minimum security data required to protect sign-ins, and — for the optional gallery face search — an anonymous numerical face print you create yourself. No advertising, no trackers, no analytics, no data selling — the website and the mobile apps run entirely on our own infrastructure and talk to no third-party service.

Who runs this service

The PODIUM platform (this website and its mobile applications) is operated by BFT MENA. For any privacy question or request, contact us at admin@bftmiddleeast.com.

Accounts and sign-in

Accounts are created and invited by the organizing team — there is no open registration. For each account we store the email address, an optional display name, the role (staff or competitor), and the language preference.

There are two ways to sign in, and both are internal to PODIUM:

• Credentials issued by the organizer. Passwords are stored only as salted hashes — never in plain text.
• A one-time code (OTP) sent by email to the account’s own address. Codes are stored hashed, expire within minutes, and each code works once.

We offer no social logins — no Sign in with Apple, Google, or any other provider — so nothing about you is ever shared with a login provider, because none is used.

Sign-in security data

For every sign-in attempt we keep the time, the IP address, and a one-way hash (HMAC-SHA256) of device characteristics. Recognized devices are listed on a “trusted devices” screen with their browser, operating system and device type, and can be revoked by the account owner at any time. These records exist solely to protect accounts from unauthorized access. They are never used for profiling, advertising, or marketing.

Face search in the photo gallery

The event photo gallery offers an optional “find your photos” search: you provide up to three selfies of yourself — front, right side and left side — and the gallery shows you the photos you appear in.

What we store is not a photograph. Each selfie is processed in the phone’s memory and on our own server to produce a numerical vector — a face print — that can say “this face resembles that one” and nothing else. Only that print is stored, linked to your account and to nothing else. The selfie images themselves are never saved to our storage, never shared, and exist only for the seconds the conversion takes.

The camera and photo-library permissions are requested only at the moment you tap the take-selfie or choose-photo control — never at app launch, and never for any other purpose. Photos you download from the gallery are saved to your device’s photo library at your request.

You can erase your face prints at any time with the “Delete my face prints” button on the gallery screen, and deleting your account removes them automatically. Removing the prints changes nothing else: your account, your results and the gallery are untouched.

Competition data, and what is public

Registration records can include names, email addresses, phone numbers, dates of birth, competition categories and studio membership. We use these details to organize participation and manage registrations. Registration fees may apply. Fee records include amounts, currencies, payment status and payment references; we do not store payment card details.

The service records the competition itself: studios, series, waves, teams, competitor names, scores and results. Published results are public by design — that is the product. The public results board (and the mobile applications) show team and competitor names, ranks and scores for competitions that the organizer has finished and published.

Exercise scores record what teams achieved during competition training and compare participating teams. They are fitness competition results; the service does not collect clinical records or provide medical advice. Contact details, dates of birth and fee records are not published on the public results board.

Staff may enter operational notes and announcements. We retain sign-in activity, staff action logs and announcement read receipts to operate the platform, deliver updates and protect accounts.

What we never do

• We show no advertising and do not sell personal data.
• We run no analytics, tracking scripts, or third-party CDNs. The site is fully self-contained.
• We do not sell, rent, or share personal data with any third party.
• Emails are operational only: invitations, password resets, and sign-in codes.

Retention and deletion

You can delete your account yourself, at any time, from Account → Delete account inside the app. No request and no approval: the account is closed immediately, you are signed out on every device, every trusted browser is revoked, and you can no longer sign in.

What a deletion does not erase is the record of competitions already run. Scores, placings and the published results of an event you competed in belong to that event and to everyone else who competed in it, and are kept as part of its result. The same is true of the administrative audit log, which exists so that decisions taken about accounts remain answerable. These records are retained for as long as the organizer keeps the competition on record.

Account data is otherwise kept while the account is active. To access or correct your personal data, or to ask about anything retained after a deletion, contact the organizing team or write to us at the address above, and we will action the request.

Security

Traffic is encrypted in transit (TLS). Passwords and one-time codes are stored only as hashes. Sign-in attempts and staff actions are logged and auditable. Access to production systems is limited to the platform operators.

Changes to this policy

If we change this policy, the updated version will be published on this page with a new date. Material changes will also be announced inside the app.