Who we are
ChessOff is operated by Strauven Jean-Marc, based in Belgium. For the personal data described here, we act as data controller within the meaning of the GDPR (Regulation (EU) 2016/679). Contact: hello@chessoff.tech.
What personal data we collect
- Account: your name, email address and password (stored only as a hash), and optionally an avatar and your birth year. Your Elo rating and game statistics (games played, wins, losses, draws) are computed as you play.
- Ranking display preferences: your name is shown in public rankings only if you opt in; otherwise an anonymous identifier (such as
chess_A1B2C3) is shown instead. Your birth year is shown next to your name only if you choose to show it.
- Games and moves: the players, every move, the result and timing of each game, and the hints you used.
- Chat messages you send in a game, visible to your opponent.
- Invitations and challenges: when you invite someone by email, we store their email address to send the invitation; an invitation expires after 7 days. Challenges between players may include an optional message.
- Notifications: your email notification preferences (move notifications, delay, move reminders) and the in-app notifications we show you.
- Sessions and server logs: your IP address and browser user agent are stored with your login session while you are signed in, and in our web server logs, kept for up to 60 days for security and troubleshooting.
Why we process it (legal basis)
- Performance of the contract (GDPR art. 6(1)(b)): running your account, your games, chat and invitations, and sending the notifications you enable.
- Legitimate interest (GDPR art. 6(1)(f)): security logs and abuse prevention, and public rankings, which respect your choice to show your name or an anonymous identifier.
- Consent (GDPR art. 6(1)(a)): audience measurement with Google Analytics, according to your choice in the cookie banner (see Cookies below).
Where the data is hosted
ChessOff runs on servers located in the European Union (Hetzner, Germany). Server provisioning and deployment are managed through Laravel Forge.
Sub-processors
We share personal data only with the following sub-processors, strictly for the purposes listed:
- Hetzner (EU, Germany): hosts our servers and database.
- Brevo: sends transactional emails (account verification, password reset, invitations) and the game notifications you enable.
- Google (Google Ireland Ltd / Google LLC): provides Google Analytics 4, used to measure our audience, according to your choice in the cookie banner.
We do not sell personal data and we do not share it with third parties for their marketing.
International transfers
Google (Google Analytics, subject to your choice) may process data in the United States. We rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses for that transfer.
How long we keep it
- Account data: until you delete your account.
- When you delete your account: your account, preferences, avatar, notifications, the invitations you sent or received, your challenges and your chat messages are deleted, and your games in progress are resigned. Your finished games and their moves are kept, but anonymised: you appear as "Deleted player", so your opponents keep their game history.
- Invitations: expired or declined invitations are deleted after 30 days.
- Sessions: deleted after they expire. Server logs: up to 60 days.
Your rights
Under the GDPR, you can:
- Access a copy of your personal data.
- Correct inaccurate data (most of it directly from your profile page).
- Delete your data (right to erasure): you can delete your account at any time from your profile page.
- Restrict or object to processing based on legitimate interest.
- Export your data in a portable format.
- Withdraw your consent to analytics at any time with the "Cookies" link in the footer.
- Lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit, www.dataprotectionauthority.be) or your local supervisory authority.
To exercise any of these rights, email hello@chessoff.tech from the address associated with your account. We respond within 30 days.
Cookies
ChessOff uses essential cookies to keep you signed in and to protect forms: the session cookie, XSRF-TOKEN, and remember_web_* (only if you tick "remember me"). They are required for the site to work.
Subject to your choice, we use Google Analytics 4 to measure our audience (pages viewed, approximate location, device and browser). It sets the cookies _ga and _ga_* (up to 2 years) and Google acts as our processor for this data. In the EEA, the UK and Switzerland, Google Analytics only runs if you accept it in the cookie banner; until then, analytics storage stays denied (Google Consent Mode v2). Elsewhere it is enabled by default and you can refuse it through the same banner. Advertising storage, ad user data and ad personalisation are always denied. You can change your choice at any time with the "Cookies" link in the footer.
If you arrive through one of our campaign links, a first-party cookie (signup_campaign) remembers that campaign for 30 days, only to count how many sign-ups each campaign brings; if you sign up, it is recorded with your account. It is not shared and not used for advertising.
Minimum age
ChessOff is not intended for people under 16 and we do not knowingly collect data from them.
Changes to this policy
Material changes will be announced on this page. The "Last updated" date at the top reflects the most recent revision.