1. Who we are (data controller)
| Detail | Information |
|---|---|
| Trading name | ChessTing |
| Legal entity | ChessTing (sole trader / project owner — company details pending incorporation) |
| Company number | Not yet incorporated (UK Companies House pending) |
| Registered address | United Kingdom — registered office address to be published upon incorporation |
| ICO registration | ICO registration pending (required when acting as a UK data controller) |
| General contact | support@chessting.com |
| Privacy contact | privacy@chessting.com |
We are the data controller for personal data described in this notice. Where coaches use student portals involving minors, coaches may act as separate controllers for data they upload about their students — see section 15.
2. Scope
This notice applies when you use the ChessTing website, API, browser extension (where applicable), and related services. It covers visitors, registered users, subscribers, coaches, and community participants. Static GitHub Pages mirrors provide limited features without account sign-in; fewer categories of data apply there.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity & account | Email, username, display name, date of birth, avatar | You / Clerk auth |
| Profile & social | Bio, linked handles, public activity, follows, comments, forum posts | You |
| Usage & quotas | Scout/review/self-analysis counters, Style Bot daily usage | Generated by use |
| Billing | Stripe customer ID, plan, subscription status (not full card numbers) | Stripe / you |
| Coach workspace | Student names, reports, homework, portal tokens you save | You (coach) |
| Prep data | Watchlist, linked accounts, cached scout snapshots (Pro) | You / service |
| Technical | IP address, browser type, session logs, error reports | Automatic (hosting) |
| Analytics (owner-only) | Anonymous page views, country, session length, feature usage | First-party analytics |
4. How we use data & lawful bases (UK GDPR Article 6)
We must have a lawful basis for each processing activity. The table below is our primary record (similar to ICO privacy notice checklist items).
| Purpose | Lawful basis | Notes |
|---|---|---|
| Provide accounts, profiles, forums, notifications | Contract (Art. 6(1)(b)) | Necessary to deliver the service you sign up for |
| Process subscriptions & invoices | Contract + legal obligation (tax/accounting) | Stripe handles payment card data under its own privacy notice |
| Enforce quotas, security, fraud prevention | Legitimate interests (Art. 6(1)(f)) | Protect the service and other users; balanced against your rights |
| First-party product analytics (owner dashboard) | Legitimate interests | Improve features; no ad-tech; aggregated where possible |
| Marketing emails (if ever sent) | Consent (Art. 6(1)(a)) | We do not currently send promotional email without opt-in |
| Legal claims & regulatory compliance | Legal obligation / legitimate interests | Records retained as required by law |
| Moderation of community content | Legitimate interests / contract | See Community Guidelines and Terms |
Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental rights. You may object (see section 12). We do not routinely use automated decision-making with legal or similarly significant effects.
5. Four analysis modes (data minimisation)
ChessTing handles data differently by feature. See also our methodology page.
| Mode | Where it runs | What we store |
|---|---|---|
| Free browser scout / review | Your browser (Stockfish WASM + public APIs) | Nothing on our servers unless you sign in and save |
| Signed-in saved reports | Browser analysis; metadata when you save | Report metadata, notebook entries, profile activity you post |
| Pro server cache | Our servers cache public scout snapshots | Cached analysis tied to your account; expires on schedule |
| Coach workspace | Cloud database (Neon) | Students, reports, homework you explicitly save |
6. Cookies & similar technologies
We use cookies and local storage as described in our separate Cookie Policy (required under UK PECR for non-essential cookies). Essential Clerk session cookies are necessary for sign-in and do not require consent.
7. Who we share data with (processors & recipients)
| Recipient | Role | Location |
|---|---|---|
| Clerk | Authentication, MFA, session management | US / EU (see Clerk DPA) |
| Stripe | Payment processing | US / EU (see Stripe DPA) |
| Vercel | Hosting, edge functions | US / EU |
| Neon | PostgreSQL database | US (AWS regions) |
| Chess.com / Lichess | Public game APIs — you initiate fetches | Third-party platforms |
| Upstash (if configured) | Optional Redis cache | EU/US depending on config |
We require processors to protect data under written terms (Data Processing Agreements where applicable). We do not sell personal data to data brokers or advertisers.
8. International transfers
Your data may be processed outside the UK (primarily the United States). Where we transfer personal data to countries without an adequacy decision, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) / UK Addendum to EU Standard Contractual Clauses, or the processor's equivalent transfer mechanism. Contact privacy@chessting.com for a copy of relevant safeguards.
9. Retention
| Data type | Retention period |
|---|---|
| Account & profile | While your account is active, then deleted or anonymised within 90 days of deletion request unless legal hold applies |
| Billing records | 7 years (UK tax/accounting requirements) |
| Pro scout cache | Rolling expiry (typically 30–90 days per cache entry) |
| Forum posts & comments | Until you delete, we moderate/remove, or you delete your account |
| Server logs | Up to 90 days |
| Analytics aggregates | Up to 24 months in anonymised/aggregated form |
| Coach student data | Until coach deletes or account closes; minors — see section 15 |
10. Security
We use HTTPS, access controls, hashed credentials via Clerk, database encryption at rest (hosting provider), and staff role restrictions for moderation. No method is 100% secure; report suspected breaches to privacy@chessting.com.
11. Your rights (UK GDPR)
Subject to exceptions, you have the right to:
- Access — obtain a copy of your personal data.
- Rectification — correct inaccurate data (also via Settings).
- Erasure — request deletion ("right to be forgotten").
- Restrict processing — in limited circumstances.
- Data portability — receive data you provided in a structured format.
- Object — to processing based on legitimate interests or direct marketing.
- Withdraw consent — where processing is consent-based (e.g. optional marketing).
Prefer self-serve: download or delete from Settings → Your data. You can also email privacy@chessting.com with your request. We respond within one month (extendable by two months for complex requests). We may need to verify your identity.
12. Complaints to the ICO
You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
We encourage you to contact us first so we can try to resolve your concern.
13. Public profiles & community
- Your vanity profile is separate from opponent Scout — Scout reports are never auto-posted.
- Content you post publicly (feed, forums, comments) may be visible to other users.
- Moderators may hide or remove content per our Community Guidelines.
- You can disable your public profile in Settings.
14. What we do not do
- Sell personal data to advertisers or data brokers.
- Use Google Analytics, Meta Pixel, or similar ad-tech.
- Permanently store full game databases from anonymous browsing.
- Access Chess.com/Lichess accounts except via public APIs you initiate or OAuth you authorise.
15. Children & coach portals
ChessTing is not directed at children under 13. We do not knowingly collect data from under-13s without appropriate consent. Coach student portals may involve minors; the coach is responsible for lawful basis and parental consent where required. Contact us to request deletion of a minor's portal data.
16. Automated processing
Engine analysis, scout statistics, and drill recommendations are algorithmic but do not produce legal or similarly significant effects about you. They are educational tools only.
17. Changes to this notice
We update this page when practices change. Material changes appear in the changelog with a new "Last updated" date. Continued use after the effective date may constitute notice where permitted by law.
18. Contact
Privacy: privacy@chessting.com
General: support@chessting.com