Privacy

Who is responsible

Chesslord is the controller of the personal data described here: we are the ones who decide what is held and for what.

For anything in this notice, whether a question, a request or a complaint, write to us at the address below.

[email protected]

What personal data we hold

Your account

The email address and password you sign in with, any other sign-in method you chose, and the first and last name you gave when you arrived. The password and the sign-in methods are held by our sign-in provider and our own pages never read them; your email address we do read, to show it back to you in your settings.

What you upload and what you save

Whatever you send us is held as you sent it, including the metadata your camera or device wrote into it, which for a photograph can include the location it was taken. What you choose to save is held with the name you gave it. Nothing is filed here unless you ask for it.

Accounts you declare elsewhere

The username you declare on another chess service, and the games that service publishes under it. A declaration is not a proof: we do not check that the account is yours. A game also carries the person you played against, their username and their rating, because that is how the service publishes it. A game you paste in yourself is held the same way, and is the only copy there is.

Your settings

The choices you make about how the service looks and behaves, and which language you are served. They follow your account rather than the browser you happen to be using.

What we work out from what you gave us

Judgements, figures and measurements derived from the games and the material above. They are held with what they were derived from and go when it goes.

Fault reports

When something breaks, a report that carries an internal account identifier, a value that means nothing outside our own systems, and never your email address.

Why we hold it, and on what legal basis

To provide the service you asked for

Holding your account, working on what you send us, keeping what you choose to save, reading what another service publishes under a username you declared, and remembering your settings. Legal basis: performance of our contract with you, Article 6(1)(b) GDPR.

To look into a result that came back wrong

What you sent is held together with what we made of it, so that a wrong result can be investigated and the service measured against real material rather than test material. Legal basis: our legitimate interest in a product that works, Article 6(1)(f).

To keep the service up and defend it

Carrying requests to the service, turning away abuse of it, and receiving a report when something breaks. Legal basis: our legitimate interest in a service that stays available, Article 6(1)(f).

To meet an obligation the law puts on us

Where a law requires us to hold something, or to hand it over, we do. Legal basis: compliance with a legal obligation, Article 6(1)(c).

Where the basis is a legitimate interest, you have the right to object to it. What that means in practice is under your rights, below.

Who else receives it

The provider that signs you in

Handles signing in and holds the credentials that go with it.

The provider that hosts the service

Runs the application, the database and the file storage, in the European Union.

The provider in front of the service

Carries every request to it, which means it sees the network address your request comes from.

The provider that receives fault reports

Receives a report when something breaks, carrying an internal account identifier and never your email address.

Each of them acts on our instructions and may not use what it sees for its own ends. Nothing about you is sold, and nothing is handed to anybody for purposes of their own. We name any of them to you on request; they are described by what they do here so that this notice does not go out of date the day one of them changes.

A chess service you declared an account on is read from, never written to. We ask its public interface for the games published under that username, and it is told nothing about you in return.

Some of the work happens on your own machine and never reaches us at all. Where it does reach us, it reaches our own infrastructure in the European Union before it reaches anybody else.

One more person is owed a word here. A game read from another service carries whoever you played against, and they never came to this site. Their username and rating are already published by that service as part of a public record of the game; we hold them to measure the game, we do not contact them, and nothing here is indexed by their name. The basis is our legitimate interest in a record that is already public, Article 6(1)(f), and they have the same rights as anybody else at the address below.

Some of these providers are established outside the European Economic Area, so some of your data may be processed there. Where that happens it rests on the safeguards Chapter V of the GDPR requires, and you can ask us which one applies to a given provider.

How long we keep it

For as long as you have an account

Your account details, what you uploaded and what you saved, the games read under a username you declared, everything derived from them, and your settings.

Until you withdraw a declaration

A username you declared elsewhere, and the games read under it, go when you withdraw it from your settings.

When you delete your account

All of the above is erased from our database and our file storage when the deletion runs, together with the account. There is no waiting period and no grace period. If a step of it fails we retry until it is done, and a fault report already sent to our fault-reporting provider runs out on that provider’s own period rather than on ours.

Work waiting to run

A queued piece of work carries your internal account identifier and is pruned about two weeks after it is scheduled, or thirty days after it is set aside for having failed. Pruning runs while the service is in use, so a quiet stretch can hold a row past that.

Fault reports

Held for the period our fault-reporting provider applies. You can ask us what it is.

Where the law requires longer

Where we have to keep something to meet a legal obligation or to defend a claim, we keep that for as long as the law requires, and no longer.

Your rights, and how to use them

Access

You can ask what we hold about you and receive a copy of it. We put that copy together by hand and send it to you.

Rectification

You can ask us to rectify personal data that is wrong or incomplete. Your name and your settings you can change yourself, from your settings.

Erasure

Your settings carry a control that deletes your account and everything held under it, at once and with no way back. You can also ask us to erase something in particular.

Restriction

You can ask us to keep something on hold, without using it, while a question you have raised about it is open.

Objection

Where we rely on a legitimate interest, you can object. We then either show a reason that outweighs yours, or stop.

Portability

You can ask for the data you gave us in a form you can take somewhere else.

To use any of them, write to the address below. We answer within one month; if a request genuinely needs longer than that, we tell you so, and why, inside the month.

None of this costs anything, and we do not ask you for a reason.

If our answer does not satisfy you, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali, or to the authority of the country you live in.

[email protected]

Cookies, and what your browser keeps

There is no analytics on this site, no advertising, and nothing that follows you once you have left it. Nothing measures where you came from or what you looked at.

The cookies that do exist are the ones our sign-in provider sets to keep you signed in. They are necessary for the service: turning them away means not being able to hold an account, and an account is the only way the site can be used at all.

Your browser also keeps two small values of its own, which stay on your device: whether this device makes a sound when a piece moves, and which offers to switch language you have already turned down.

Each of these is either necessary to provide the service or a preference you set yourself.

No automated decisions

No decision with a legal or similarly significant effect on you is taken here by automated means, and nothing about you is profiled to advertise to you, to score you, or to follow you. What we work out is how you play, for you to read.

Age

Chesslord is for people aged sixteen and over. We do not verify it, and nothing here is built to hold a child’s data. If you believe an account belongs to somebody under sixteen, write to the address above and it will be removed.

Changes to this notice

This notice changes when what we hold changes, and there is no version history to consult: what is written here is what applies today. If a change adds a purpose, a recipient, or a longer period, we say so on the site.