Last updated 9 September 2026
Headstring is tournament software for pool rooms. This page says what it stores, why it stores it, and who can see it. It describes what the software actually does rather than reserving rights it does not use.
Headstring is in development and is not open for signups. Access is currently limited to a single invited operator. This page will be updated before that changes, and the date above will change with it.
Headstring is run by one person as a personal project. It is not a company. There is no advertising, no data broker, and nothing here is sold or shared for marketing.
Registration details for this domain are held by the domain registrar.
Headstring is not open to the public, so there is no support address on this page yet. One will be published here before that changes.
In the meantime, the person who can act on your data is the operator running the event you played in - they entered your name and they can remove it. If your name is in a tournament and you want it out, ask them.
An operator - the person running a tournament - signs in with Google. Headstring receives and stores:
Headstring never receives a Google password. Sign-in is handled by Google through Firebase Authentication, which means Google sees that you signed in to Headstring.
An operator types in the names of the people playing. So Headstring holds information about people who never signed up for it and may not know it exists. That is worth saying plainly rather than burying.
For each entrant in a tournament, an operator may enter:
Match results are then recorded against that entrant: who won, the game count, which table it was played on, and when. No date of birth, no address, no phone number, no payment details.
A player who does not want their name in Headstring should say so to the operator running the event. What that operator can do depends on when you ask:
Headstring never overwrites a result. Correcting a mistake adds a correction rather than editing the original, which is what lets an operator undo a mistyped score without the bracket quietly disagreeing with itself later.
The consequence for privacy is real: within a tournament that is still running, history is only ever added to, never edited. Withdrawing stops you being drawn against anybody else, but the record that a match happened, and its result, stays in that tournament's history for as long as the tournament does.
Deleting the tournament is what erases that history, and an operator can do it. It removes the entrant list and the whole match log together, permanently. There is no undo, which is why the software makes an operator name the tournament they are deleting before it will do it.
If you turn on notifications, your browser gives Headstring a push subscription for that one device - an address to send to, plus keys to encrypt with. It is stored so the server can tell you that you are up on a table, and it is used for nothing else. Turning notifications off in the browser, or uninstalling the app, ends it.
Headstring uses Google Analytics 4 on the operator console, in the app, and on the public pages of this site - including the page you are reading now. Google receives your IP address, the pages you open, rough location derived from that address, and information about your device and browser, and it sets cookies to recognise the same browser again.
There is one thing Headstring deliberately sends beyond what Analytics collects by itself: which surface you are on - an ordinary browser tab, the app installed to a home screen, the iOS or Android app, or a screen being used as a tournament board on a wall. That is the whole reason analytics is here. Notifications on iPhones only work from the installed app, so knowing how many people actually install it is what decides whether notifications are a real feature or a false promise.
Your name and email address are never sent to Analytics, and neither is anything about a tournament - not an event name, not a venue, not a player, not a result. Analytics is not told who you are; it is told that somebody on an Android app opened a bracket.
It is off unless the server it is running on is configured for it. Development machines and the automated test runs send nothing at all, which is why the measurement identifier comes from the server rather than being built into the app.
Any browser-level “do not track” setting, tracking-protection feature, or content blocker that blocks Google Analytics will simply block it here, and Headstring works exactly the same with it blocked. Nothing on this site depends on Analytics loading.
Today, only the single invited operator and the administrator can see anything. When Headstring opens up, tournament pages are intended to be public - a bracket on a wall in a pool hall is already public - and player profile pages are intended not to be indexed by search engines, because nobody at a Tuesday night agreed to be a permanent search result for one bad match.
Tournament and match records are kept indefinitely, because the point of them is history. Account records are kept while the account exists.
A tournament can be deleted by the operator who ran it, which removes its entrant list and its entire match log for good. An operator can delete their own account, which does the same to every tournament that account ran.
Deleting an account does not delete the venues it entered. A room is a place rather than a piece of anybody's account - two unrelated operators can run in the same room - so the room survives, and simply stops recording who first typed it in.
If this page changes in a way that affects what is collected or who can see it, the date at the top changes too. There is no mailing list to notify.