Privacy Policy

Last updated: 28 October 2026

This Privacy Policy explains how [Company legal name] ("we", "us", "our") collects and uses personal data when you use our website at https://chessware.net, your dashboard, Chessware, Chessware Lite and our Discord server (together, the "Services").

We collect only what we need to run the Services. We don't sell your personal data, and we don't use tracking or advertising cookies.

1. Who is responsible for your data

[Company legal name] is the controller of the personal data described in this policy. You can contact us about privacy at [support email].

2. Data we collect

From Discord when you sign in

You sign in with Discord. With your permission, Discord shares:

• your Discord user ID;
• your username;
• your avatar; and
• your email address.

We never receive your Discord password.

Answers to our former onboarding questions

• If you signed up while we still asked onboarding questions, the answers you gave about how you planned to use Chessware and your chess level. We no longer ask these questions or use the answers. They're deleted when you delete your account, and you can ask us to delete them sooner.

When you use Chessware

• License usage: when your key was activated and when Chessware last checked in with our server.
• Hardware fingerprint hash: an anonymous, one-way hash created on your PC and used to lock your license key to that PC. We never see your hardware details, and the hash can't be turned back into them.

When you buy something

• Purchase records: the product, amount, date and Stripe reference IDs.

You enter your card details directly with Stripe. We never see or store your card number.

When you download

• Download history: what you downloaded from your dashboard and when.

For security

• Security logs: your IP address and user agent (information about your browser or app), kept in short-lived logs.

If you're one of our administrators

• Audit log: a record of actions taken with administrator access.

If you contact us

• The messages you send us by email or in our Discord server, and any details you include in them.

Cookies

We use only essential cookies needed to keep you signed in and secure. See our Cookie Policy.

3. How we use your data and our legal bases

Where data protection laws such as the GDPR or UK GDPR apply, we need a legal basis for each use of your data. We rely on:

• Contract: to provide the Services you've signed up for or bought.
• Legitimate interests: where we have a reasonable interest that isn't overridden by your rights, such as keeping the Services secure.
• Legal obligation: where the law requires it, such as keeping tax records.
• Consent: where we ask for your permission. You can withdraw consent at any time.

Purpose	Data used	Legal basis
Creating your account and signing you in	Discord user ID, username, avatar, email	Contract
Assigning your Discord roles	Discord user ID, plan status	Contract
Selling plans and issuing license keys	Purchase records	Contract
Activating and checking licenses, and preventing key sharing	License usage, hardware fingerprint hash	Contract; legitimate interests in preventing misuse
Delivering downloads and helping with problems	Download history	Contract; legitimate interests
Keeping the Services secure and preventing fraud and abuse	IP address, user agent	Legitimate interests
Providing support	Your messages and account details	Contract; legitimate interests
Keeping administrators accountable	Admin audit log	Legitimate interests
Keeping sales and tax records	Purchase records	Legal obligation
Contacting you about your account, purchases or important changes	Email address	Contract; legitimate interests
Anything we ask your permission for, such as optional cookies in future	As described when we ask	Consent

We don't send you marketing emails unless you've agreed to receive them.

4. Sharing your data

We don't sell your personal data, and we don't share it for advertising.

We share personal data only:

• With our service providers ("subprocessors"), who process it on our behalf to run the Services: Supabase (database, authentication and file storage), Vercel (website hosting), Render (hosting our Discord bot), Stripe (payments) and Discord (sign-in and community). See our subprocessors list.
• With Discord and Stripe in their own right. When you sign in with Discord or pay through Stripe, they also process your data under their own privacy policies.
• When the law requires it, for example to respond to a valid legal request, or where needed to protect the rights, safety and security of our users, the public or us.
• In a business transfer. If [Company legal name] or the Services are sold or merged, your data may be transferred, and we'll make sure it stays protected in line with this policy.

5. International transfers

Our subprocessors are United States companies that run infrastructure in several countries. Your data may therefore be processed outside your own country, including in the United States.

When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards. These include the European Commission's Standard Contractual Clauses and the UK equivalent, or a provider's certification under the EU–US Data Privacy Framework and its UK and Swiss extensions, where that applies. Contact us for more information about these safeguards.

6. How long we keep data

We keep personal data only for as long as we need it:

• Account, license and download data, and any answers to our former onboarding questions, are kept while your account exists, and deleted when you delete your account.
• Security logs are short-lived and deleted automatically.
• When you delete your account, we keep only an anonymous sales record (date, amount, currency and country) for each purchase, because tax law requires sellers to keep sales records. Nothing in it links it to you.

For full details, see Data Handling & Retention.

7. Your rights

Depending on where you live, you have rights over your personal data. You can:

• Access your data: ask us what we hold about you.
• Export your data: use Account → Download your data in your dashboard.
• Correct your data: your username, avatar and email come from Discord. If anything we hold is wrong, contact us and we'll fix it.
• Delete your data: use Account → Danger zone → Delete account. See Deleting your account.
• Object to our use of your data where we rely on legitimate interests.
• Restrict how we use your data in certain circumstances.
• Withdraw consent where we rely on it. This doesn't affect anything we did before you withdrew it.
• Complain to a data protection supervisory authority.

GDPR and UK GDPR

If you are in the European Economic Area or the United Kingdom, you have the rights listed above, including the right to data portability. You can complain to the supervisory authority in the country where you live or work, or where you think a breach happened. In the UK, this is the Information Commissioner's Office (ICO). We'd appreciate the chance to deal with your concern first, so please contact us at [support email].

California

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to:

• know what personal information we collect, use and disclose, and get a copy;
• delete your personal information;
• correct inaccurate personal information;
• opt out of the sale or sharing of your personal information (we don't sell or share personal information as the law defines those terms);
• limit the use of sensitive personal information (we don't use sensitive personal information in ways that give rise to this right); and
• not be discriminated against for using your rights.

We collect these categories of personal information: identifiers (such as Discord user ID, username, email and IP address); commercial information (purchase records); and internet or other electronic network activity (license check-ins, download history, user agent and security logs). We collect them from you, from Discord, from Stripe and from your use of Chessware, for the purposes in section 3, and disclose them only as described in section 4.

You can use an authorized agent to make a request for you. We may need to verify your identity, and the agent's authority, before acting on it.

How to use your rights

Many of your rights are available directly in your dashboard. For anything else, email [support email]. We may ask you to confirm your identity, for example by signing in with Discord. We'll respond within the time the law requires: normally one month under the GDPR and UK GDPR, or 45 days under California law.

8. Children

The Services are not meant for children under 13, or under the age of digital consent in their country if that is higher, and we don't knowingly collect their personal data. If you believe a child has given us personal data, contact us at [support email] and we'll delete it. Users under 18 need a parent's or guardian's permission to make purchases.

9. Security

We protect your data with measures including:

• encryption in transit (HTTPS) for the website, the dashboard and Chessware's license checks;
• access controls, so only authorized people and systems can access personal data, and only what they need;
• two-factor authentication for administrator access;
• audit logs of administrator actions;
• one-way hashing of hardware fingerprints; and
• keeping card details with Stripe, so they never reach our systems.

No method of transmission or storage is completely secure. If a breach affects your data, we'll notify you and the relevant authorities where the law requires. See Data Handling & Retention.

10. Changes to this policy

We may update this Privacy Policy. When we do, we'll change the "Last updated" date at the top of this page. If a change is significant, we'll tell you before it takes effect, through the website, your dashboard, our Discord server or by email.

11. Contact

For privacy questions or requests, email [support email]. You can also reach us in our Discord server at https://discord.gg/kCTeGtzywj, but please don't post personal details in public channels.