Data Handling & Retention

Last updated: 28 October 2026

This page gives the detail behind our Privacy Policy: what we store, where, for how long, and how it's deleted. "We" means [Company legal name]. The providers named below are listed on our subprocessors page.

Retention table

Data	Purpose	Where stored	How long kept	Deleted when
Discord profile: user ID, username, avatar, email	Sign-in, your account, Discord roles, contacting you	Supabase (database and authentication)	While your account exists	You delete your account
Answers to our former onboarding questions (only accounts that answered them; no longer collected)	None: no longer used	Supabase	While your account exists	You delete your account, or ask us to delete them sooner
License keys	Licensing	Supabase	While your account exists	You delete your account (keys are revoked, then deleted)
License usage: activation time, last check-in time, hardware fingerprint hash	Activating and checking licenses, preventing key sharing	Supabase	While your account exists	You delete your account
Purchase records: product, amount, date, Stripe IDs	Orders, receipts, refunds, tax	Supabase; Stripe keeps its own records	While your account exists	You delete your account, after which only an anonymous sales record remains
Anonymous sales record: date, amount, currency, country	Meeting tax record-keeping laws	Supabase	As long as tax law requires	When the legal retention period ends
Download history	Delivering downloads, support, preventing abuse	Supabase	While your account exists	You delete your account
Security logs: IP address, user agent	Security, preventing fraud and abuse	Our hosting and database providers	A short period	Automatically, at the end of that period
Admin audit log	Accountability for administrator actions	Supabase	As long as needed for security and accountability	When no longer needed for those purposes
Discord roles	Showing your account and plan status in our Discord server	Discord	While you have the matching account or plan	Your plan expires or you delete your account
Sign-in session cookie	Keeping you signed in	Your browser	Until you sign out or the session expires	You sign out, use Sign out everywhere, or the session expires
Support messages	Helping you	Email; Discord	As long as needed to resolve your request	When no longer needed; messages in Discord are also subject to Discord's policies
Card details	Payment	Stripe only; never reach us	Under Stripe's policy	Under Stripe's policy

How account deletion works

You can delete your account in your dashboard under Account → Danger zone → Delete account. Here's what happens:

1. You confirm. You type DELETE. If you signed in a while ago, you also re-confirm with Discord so we know it's really you.
2. Your license keys are revoked and deleted. Chessware stops working on any PC where they were activated.
3. Your Discord roles are removed from our server.
4. Your data is deleted. This includes your profile, any onboarding answers, license usage, download history and all other data linked to your account.
5. Sales records are anonymized. For each purchase, we keep only the date, amount, currency and country, with nothing linking it to you, because tax law requires sellers to keep sales records.

If copies of deleted data exist in routine backups kept by our database provider, they aren't used, and they're removed as those backups expire.

Stripe keeps its own payment records under its own privacy policy.

Deletion can't be undone. You can sign up again later, but you'll start with a new, empty account. Step-by-step instructions are in Deleting your account.

Security measures

• Encryption in transit. Traffic between your browser or Chessware and our services uses HTTPS.
• Access controls. Access to personal data is limited to the people and systems that need it.
• Two-factor authentication for administrators. Administrator access requires a second factor, not just a sign-in.
• Least privilege. Staff and services get only the access they need to do their job.
• Audit logs. Administrator actions are logged so they can be reviewed.
• Data minimization. We store a one-way hash instead of hardware details, keep security logs only briefly, and leave card details with Stripe.

Breach notification

If a personal data breach happens, we will:

• notify the relevant supervisory authority without undue delay and, where the GDPR or UK GDPR applies, within 72 hours of becoming aware of it, unless the breach is unlikely to put anyone's rights at risk;
• tell affected users without undue delay when the breach is likely to put their rights at high risk, explaining what happened, what data was involved, what we're doing about it and what they can do; and
• keep a record of the breach and the steps we took.

We'll contact affected users by email, in the dashboard or through our Discord server.

Questions

Email [support email] with any questions about how we handle your data.