Privacy Policy

Who handles your data

ChessCompete is operated by Gábor Kökény. For privacy questions and requests, contact [email protected]. This notice covers the marketing website, account services and the current ChessCompete application preview.

We determine how account and service-security data are used. Tournament organizers determine why they collect player and event data and whom they share it with; when we store those records for them, we process them on their behalf. Players should also consult their organizer’s privacy notice.

What data is used and where it comes from

Browsing: connection and security information, such as IP address, requested URL, browser information and request time, can be processed by the web server and Cloudflare. Our marketing pages do not embed advertising pixels or analytics scripts; fonts and images are served with the site.

Account: your email address, verification and session records, linked Google or Apple account identifiers, and any optional name, city or billing details you provide. If you set a password, we store its hash. Google or Apple supplies the sign-in identifier and available email address when you choose that provider; we do not receive your provider password.

Tournament records: information entered or imported by the organizer, including player and team names, FIDE IDs, ratings, federation, club, title, birth date or year, sex, pairings, results and change history. Player-directory data can come from public FIDE rating lists. Optional event finances and invoices may contain payer names, addresses, contact details, tax or bank details, fees and payment records. Enter only data needed for your event.

Feedback and bug reports

When you send feedback, we store the report type, subject, message, optional reproduction steps and reply email, app version, platform, report ID and submission time so we can review the report and contact you if requested. No sign-in is needed. Tournament records, credentials, screenshots and logs are not attached. Unsent drafts stay on your device until sent or application storage is cleared. Submitted reports have no automatic expiry in this preview; contact us using the address above and include the report ID for a deletion request.

Why data is processed

We use account and synchronization data to provide the service you request (GDPR Article 6(1)(b)). Security, abuse prevention and troubleshooting serve our legitimate interest in keeping the service reliable (Article 6(1)(f)). Where a legal record-keeping obligation applies, its basis is Article 6(1)(c). Optional profile fields can be left blank; an email address and verification are needed for an online account. The demo can be explored without an account.

Organizers must establish their own legal basis for player data, including children’s data, and provide the required information to participants. Pairings and standings are calculated from tournament inputs and settings for organizer review; they are not advertising profiles.

Local storage and cookies

The app stores tournaments, settings and offline access information on your device. Signing in can start synchronization; synchronized records are also stored on our server. Signing out does not remove local tournaments. Export a backup before clearing browser or application data; clearing local data does not erase server copies.

Social sign-in uses a short-lived security cookie and temporary browser session storage to complete authentication. Access sessions last up to 24 hours; client credentials are kept in memory, so closing or reloading requires a new sign-in. These mechanisms support requested features. External sign-in and payment pages have their own cookie practices, described in the provider notices below.

Service providers and sharing

Our server stores synchronized records. Cloudflare handles website traffic and security; Resend receives the email address and message content needed to send sign-in codes. Google or Apple participates only when you use its sign-in option.

Stripe handles the subscription checkout and billing portal. ChessCompete receives customer and subscription identifiers and status, rather than full card details. Payments currently use test mode: use test payment details only. Provider processing can take place outside the European Economic Area. Their linked notices describe international processing and safeguards; contact us for information about the arrangements applicable to your data.

Exporting or sharing reports is controlled by the organizer. Synchronizing a tournament does not itself publish it. Disclosure may also be required by a lawful request from an authority.

Retention and deletion

Local records remain until you remove them or clear application storage. In the current preview, account records, synchronized tournaments and their revision history have no automatic expiry. Removing a tournament from the workspace does not immediately erase its server history. There is no self-service account deletion yet; request account closure or erasure using the contact address above.

Email codes expire after 10 minutes and social sign-in attempts after 5 minutes. The service cleans up email challenge records older than two days on later requests, old social sign-in attempts after one hour, and expired sessions on subsequent sign-ins. Expiry and physical deletion are different. Log and backup retention is separate; contact us for the applicable retention details. A deletion request may be limited by applicable record-keeping duties or the need to establish, exercise or defend legal claims; we will explain any such restriction.

Your rights and requests

Where the GDPR applies, you can request access, correction, erasure, restriction and, where applicable, portability, and object to processing based on legitimate interests. If processing relies on consent, you can withdraw it without affecting earlier lawful processing. Write to [email protected]; we may need proportionate information to verify your identity. We normally respond within one month and will explain any lawful extension.

For player records controlled by a tournament organizer, contact that organizer first; we can help route a request. You may lodge a complaint with the data protection authority where you live, work or where an alleged infringement occurred. See the European Data Protection Board’s authority directory.

Changes to this notice

We update this page when data handling changes and show the revision date above. Material changes will be communicated through the service or account contact where appropriate. This notice describes data handling; it is not a request for blanket consent.