1. Who we are (data controller)
| Detail | Information |
|---|---|
| Trading name | ChessTing |
| Legal entity | Rhys Morgan trading as ChessTing |
| Company number | Not applicable — UK sole traders are not registered with Companies House |
| Registered address | 17 Highcroft Road, Newport, NP20 5EG |
| ICO registration | Not required to launch — operator will publish an ICO registration number if/when a data protection fee applies |
| General contact | support@chessting.com |
| Privacy contact | support@chessting.com |
We are the data controller for personal data described in this notice. Where coaches use student portals involving minors, coaches may act as separate controllers for data they upload about their students — see section 15.
2. Scope
This notice applies when you use the ChessTing website, API, ChessTing Discord Bot, browser extension (where applicable), and related services. It covers visitors, registered users, subscribers, coaches, and community participants. Static GitHub Pages mirrors provide limited features without account sign-in; fewer categories of data apply there.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity & account | Email, username, display name, date of birth, avatar | You / Clerk auth |
| Profile & social | Bio, linked handles, public activity, follows, comments, forum posts | You |
| Discord integration | Discord user ID, username, display name, avatar URL, guild ID during linking, link status | Discord / you |
| Usage & quotas | Scout/review/self-analysis counters, Style Bot daily usage | Generated by use |
| Billing | Stripe customer ID, plan, subscription status (not full card numbers) | Stripe / you |
| Coach marketplace | Lesson packages, session holds, disputes, Connect account IDs, payout/refund ledger events | You / Stripe / coaches |
| Coach workspace | Student names, reports, homework, portal tokens you save | You (coach) |
| Coach messages & inquiries | Message bodies, dispute narratives, inquiry details | You |
| Prep data | Watchlist, linked accounts, cached scout snapshots (Pro) | You / service |
| Clubs & groups | Memberships, channel messages you author, message reports you file, owned club invite codes, guardian community consent timestamps | You |
| Technical | IP address, browser type, session logs, error reports | Automatic (hosting) |
| Analytics (owner-only) | Anonymous page views, country, session length, feature usage | First-party analytics |
4. How we use data & lawful bases (UK GDPR Article 6)
We must have a lawful basis for each processing activity. The table below is our primary record (similar to ICO privacy notice checklist items).
| Purpose | Lawful basis | Notes |
|---|---|---|
| Provide accounts, profiles, forums, notifications | Contract (Art. 6(1)(b)) | Necessary to deliver the service you sign up for |
| Link Discord to ChessTing and provide bot commands | Contract / legitimate interests | Optional integration you initiate; prevents impersonation and keeps account entitlements authoritative |
| Process subscriptions & invoices | Contract + legal obligation (tax/accounting) | Stripe handles payment card data under its own privacy notice |
| Process coach marketplace payments, holds, refunds, Connect payouts | Contract + legal obligation | Ledger and Stripe events retained for disputes/accounting |
| Refund/chargeback abuse scoring | Legitimate interests (Art. 6(1)(f)) | Protect marketplace integrity; human appeal via contact below |
| Enforce quotas, security, fraud prevention | Legitimate interests (Art. 6(1)(f)) | Protect the service and other users; balanced against your rights |
| First-party product analytics (owner dashboard) | Legitimate interests | Improve features; no ad-tech; aggregated where possible; browser opt-out under Settings → Product analytics + DNT |
| Optional weekly notification digests | Consent (Art. 6(1)(a)) | Off by default; enable under Settings → Email digest |
| Marketing emails (if ever sent) | Consent (Art. 6(1)(a)) | We do not currently send promotional email without opt-in |
| Legal claims & regulatory compliance | Legal obligation / legitimate interests | Records retained as required by law |
| Moderation of community & coach content (may use OpenAI Moderation API) | Legitimate interests / contract | User-authored text may be sent to OpenAI when moderation is configured |
Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental rights. You may object (see section 12). We do not routinely use automated decision-making with legal or similarly significant effects.
5. Four analysis modes (data minimisation)
ChessTing handles data differently by feature. See also our methodology page.
| Mode | Where it runs | What we store |
|---|---|---|
| Free browser scout / review | Your browser (Stockfish WASM + public APIs) | Nothing on our servers unless you sign in and save |
| Signed-in saved reports | Browser analysis; metadata when you save | Report metadata, notebook entries, profile activity you post |
| Pro server cache | Our servers cache public scout snapshots | Cached analysis tied to your account; expires on schedule |
| Coach workspace | Cloud database (Neon) | Students, reports, homework you explicitly save |
6. Cookies & similar technologies
We use cookies and local storage as described in our separate Cookie Policy (required under UK PECR for non-essential cookies). Essential Clerk session cookies are necessary for sign-in and do not require consent.
7. Who we share data with (processors & recipients)
| Recipient | Role | Location |
|---|---|---|
| Clerk | Authentication, MFA, session management | US / EU (see Clerk DPA) |
| Stripe | Payment processing, Connect identity & payouts for coaches | US / EU (see Stripe DPA) |
| OpenAI | Optional text moderation API for user-authored content | US (see OpenAI DPA) |
| Discord | Hosting and delivery of ChessTing Bot interactions, commands and server actions | See Discord privacy documentation |
| Vercel | Hosting, edge functions | US / EU |
| Neon | PostgreSQL database | US (AWS regions) |
| Chess.com / Lichess | Public game APIs — you initiate fetches | Third-party platforms |
| Upstash (if configured) | Optional Redis cache | EU/US depending on config |
We require processors to protect data under written terms (Data Processing Agreements where applicable). We do not sell personal data to data brokers or advertisers. You may appeal automated moderation or marketplace abuse decisions by emailing support@chessting.com.
7a. ChessTing Discord Bot & Discord data
The ChessTing Discord Bot is optional. If you use it without linking an account, Discord supplies the identifiers and interaction data needed to receive and respond to your command. If you choose to link Discord to ChessTing, the bot creates a short-lived one-time claim and you complete the connection while signed in on chessting.com.
| Discord data | Why we use it | How it is handled |
|---|---|---|
| Discord user ID | Stable account linking, command authorization, abuse prevention | Stored with the linked ChessTing account until unlinked or deleted |
| Username / display name | Show you which Discord identity is being linked and make bot responses understandable | Stored with link metadata and refreshed when linking |
| Avatar URL | Optional identity display during linking/account views | Stored as link metadata; may change when Discord changes it |
| Guild/server ID | Associate a link claim with the server where it was initiated and support server-specific bot behavior | Used only where needed for the command/configuration |
| Command interaction data | Execute the command, enforce permissions, troubleshoot abuse/security issues | Processed only as needed for bot operation and ordinary server logs |
| ChessTing tier/usage returned to the bot | Show your own account status and synchronize configured ChessTing roles | Read from ChessTing as the source of truth; not used to recreate billing in Discord |
The bot does not receive your Discord password, bot token, payment card details, Clerk session cookie, or ChessTing database credentials. Our baseline bot does not request the privileged Message Content intent and is not designed to ingest your private DMs or maintain a server-wide archive of message content. If a future feature materially expands Discord data access, we will update this notice and request any permissions required by Discord before using it.
Where a server enables ChessTing-managed roles, the bot can add or remove only the role IDs that server operators explicitly configure for ChessTing. You can unlink your Discord account from ChessTing through the Discord linking controls; deletion requests are handled under section 11. Discord independently processes information under its own terms and privacy policy when you use Discord itself.
8. International transfers
Your data may be processed outside the UK (primarily the United States). Where we transfer personal data to countries without an adequacy decision, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) / UK Addendum to EU Standard Contractual Clauses, or the processor's equivalent transfer mechanism. Contact support@chessting.com for a copy of relevant safeguards.
9. Retention
| Data type | Retention period |
|---|---|
| Account & profile | While your account is active, then deleted or anonymised within 90 days of deletion request unless legal hold applies |
| Discord account link | While linked; removed when you unlink or delete your ChessTing account, subject to limited security/audit retention where required |
| Billing records | 7 years (UK tax/accounting requirements) |
| Marketplace transactions, disputes, finance audits | 7 years (tax/accounting) / dispute lifecycle |
| Coach messages & dispute evidence | While accounts active; moderated copies may be retained for safety investigations |
| Pro scout cache | Rolling expiry (typically 30–90 days per cache entry) |
| Forum posts & comments | Until you delete, we moderate/remove, or you delete your account |
| Club/group channel messages | 180 days (rolling purge), or sooner if you delete your account / we moderate |
| Community join & moderation audit logs | Up to 180 days (invite prefixes only — never full invite codes) |
| Server logs | Up to 90 days |
| Analytics aggregates | Up to 24 months in anonymised/aggregated form |
| Coach student data | Until coach deletes or account closes; minors — see section 15 |
10. Security
We use HTTPS, access controls, hashed credentials via Clerk, database encryption at rest (hosting provider), and staff role restrictions for moderation. Discord account linking uses short-lived, high-entropy one-time claims and stores only a cryptographic hash of the raw claim token on ChessTing. Service credentials used between ChessTing and the bot are kept out of public source code. No method is 100% secure; report suspected breaches to support@chessting.com.
11. Your rights (UK GDPR)
Subject to exceptions, you have the right to:
- Access — obtain a copy of your personal data.
- Rectification — correct inaccurate data (also via Settings).
- Erasure — request deletion ("right to be forgotten").
- Restrict processing — in limited circumstances.
- Data portability — receive data you provided in a structured format.
- Object — to processing based on legitimate interests or direct marketing.
- Withdraw consent — where processing is consent-based (e.g. optional marketing).
Prefer self-serve: download or delete from Settings → Your data. You can also email support@chessting.com with your request. We respond within one month (extendable by two months for complex requests). We may need to verify your identity.
12. Complaints to the ICO
You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
We encourage you to contact us first so we can try to resolve your concern.
13. Public profiles & community
- Your vanity profile is separate from opponent Scout — Scout reports are never auto-posted.
- Content you post publicly (feed, forums, comments) may be visible to other users.
- Clubs and groups store membership roles, channel messages, and optional prep-room notes. Account export includes prep rooms you created; deletion/pseudonymisation clears those notes. Channel message bodies are purged on a rolling 180-day schedule. Creating, joining, or posting in clubs/groups currently requires a date of birth on file showing age 18+ while under-18 guardian consent remains disabled (
COMMUNITY_GUARDIAN_ENABLEDoff). - Moderators may hide or remove content per our Community Guidelines.
- You can disable your public profile in Settings.
14. What we do not do
- Sell personal data to advertisers or data brokers.
- Use Google Analytics, Meta Pixel, or similar ad-tech.
- Permanently store full game databases from anonymous browsing.
- Access Chess.com/Lichess accounts except via public APIs you initiate or OAuth you authorise.
- Use the ChessTing Discord Bot to read private DMs or collect server-wide message history by default.
- Log full club invite codes in staff audit trails (prefixes only).
15. Children & coach portals
ChessTing is not directed at children under 13. We do not knowingly collect data from under-13s without appropriate consent. Coach student portals may involve minors; the coach is responsible for lawful basis and parental consent where required. Contact us to request deletion of a minor's portal data. Adult date-of-birth gates already apply to club/group create, join, and post while community guardian consent and coach-minors marketplace features remain disabled until legal/ops enablement. Until then, coaches must not use the marketplace to target under-13s.
15a. Messaging & content moderation
We process coach–student messages, listing text, ratings, and homework notes to enforce safety policies (profanity, hate, harassment, sexual content, threats, and off-platform payment solicitation). Processing may use automated filters and, when configured, third-party moderation APIs. We retain moderation decision logs for abuse investigation and appeals. See the Coach marketplace Terms for suspension rules.
16. Automated processing
Engine analysis, scout statistics, and drill recommendations are algorithmic but do not produce legal or similarly significant effects about you. They are educational tools only.
17. Changes to this notice
We update this page when practices change. Material changes appear in the changelog with a new "Last updated" date. Continued use after the effective date may constitute notice where permitted by law.
18. Contact
Privacy: support@chessting.com
General: support@chessting.com