Privacy Policy

1. Controller and privacy contact

The ChessPeak service is currently operated by a natural person based in Brazil. The operator's verified legal name and formal correspondence details must be added before final adoption of this policy.

Privacy inquiries, access requests, correction, account deletion and concerns may be sent to official.chesspeak@gmail.com. Any later transfer of operation to a registered company will be explained through an updated notice identifying the new responsible entity.

2. Data provided when creating an account

The full account registration form requests first name, last name, username, email, password, nationality, date of birth and a sex field. The date of birth supports the current 18+ eligibility rule. Account creation also records acceptance of the Terms and acknowledgement of the Privacy Policy.

Authentication credentials are processed using Supabase Auth; ChessPeak is not intended to display a password to other players or administrators. Accounts may also have profile display names, avatars, country indicators and other preferences. Some less detailed authentication flows may request only email and password.

Before the Public Beta is opened, the operator must confirm whether all required registration fields, including sex and exact birth date, are necessary for the stated purposes and reduce collection where possible.

3. Gameplay, social and service information

Depending on features used, ChessPeak may process game moves, game clocks, game history, rating and ranking data, tournament participation, puzzles or training progress, friend invitations, chat and community messages, player preferences, notifications, account activity, reports and moderation records.

Public-facing features may display usernames, chosen profile information, game results, ratings, leaderboard positions, tournament standings, public chats and profile images. Email addresses, legal names, birth dates and Beta feedback are not intended to be displayed publicly by those features. Avoid posting private information in public community areas.

4. Public Beta feedback and rewards

The Beta Rewards form stores the logged-in account ID, feedback category (bug, suggestion, positive or general), feedback text, submission time, review status and, where applicable, a response and administrator review metadata. A participant can view their own submissions; authorized administrators can assess submissions in a restricted inbox.

If a participant qualifies, the system records the campaign, user ID, permanent Legacy award date, VIP grant date and applicable VIP expiration date. Administrative review and award actions are logged for accountability. A public cosmetic indicator may reveal that a user holds a Legacy or VIP badge, but not the private feedback text.

Feedback is used to investigate bugs, improve the experience, communicate about submissions, administer eligibility and prevent duplicate or fraudulent awards. Positive and negative comments are treated equally for eligibility, subject to genuine participation and anti-abuse checks.

5. Purposes and legal grounds

Data is used to register and authenticate accounts, provide chess and community features, maintain ratings and rewards, respond to support requests, prevent abuse and security incidents, comply with applicable legal obligations and improve the service based on user feedback.

Depending on the specific processing operation, legal grounds under the Brazilian LGPD may include performing a requested service, compliance with law, legitimate interests assessed against individuals' rights, and consent where law requires it. Accepting the Terms or acknowledging this Privacy Policy does not by itself create unlimited consent. The operator must finalize a purpose-by-purpose data inventory and legal-basis mapping before public launch.

6. Providers and recipients

Supabase is used for authentication, database storage and related backend services. Railway hosts the web application. Resend is used to send transactional account emails. Cloudflare Turnstile helps protect registration and authentication from automated abuse, and may process browser/network signals necessary for verification.

Providers may receive only the data necessary for their functions, such as account email for message delivery, authentication and account records for Supabase, or technical connection information for security and hosting. Authorized ChessPeak administrators can access Beta feedback and moderation data to perform their duties. Providers' own privacy notices and contracts may also apply.

According to the operator's current deployment settings, the Supabase Beta project's primary region is us-east-1 (Northern Virginia, United States), and the Railway web application runs in US East (Virginia, United States). These configuration locations do not establish that all provider processing or subsequent transfers are confined to Virginia. Other providers' processing regions, roles, subprocessors, contractual terms and recipients still require verification before this policy is finalized.

7. International data transfers

Some infrastructure, authentication, message-delivery or anti-abuse services may process personal data outside Brazil. International data transfers must have an appropriate legal mechanism and transparency safeguards under applicable law, including Brazil's LGPD and ANPD Resolution CD/ANPD No. 19/2024 when applicable.

The United States is a currently identified destination for the Supabase Beta primary project and Railway application deployment. Primary account, authentication and gameplay database services are hosted through the selected Supabase region; web application traffic is processed through Railway's configured deployment, potentially passing through other network locations. The operator must still verify contractual international transfer mechanisms, additional recipient countries and processing locations (including Resend, Cloudflare and subprocessors), purposes, transfer duration and the transparency information required by applicable regulations. Hosting location alone does not prove LGPD compliance.

8. Cookies, browser storage and security

ChessPeak uses authentication session cookies or tokens and may store site preferences, including language and game settings, in the browser. Hosting and security providers may process network, device and request information to deliver the site and respond to abuse.

Access controls, database row-level security, administrative authorization and anti-bot verification help protect data. No online service can guarantee absolute security. Users should protect their credentials and report suspicious activity to the privacy contact. Any nonessential analytics or advertising technologies must be audited and disclosed before deployment.

9. Retention and deletion

ChessPeak retains the information needed to operate active accounts, provide requested games and community features, maintain ratings and rewards, respond to users, and keep the service secure. Once an account is deleted, data should be erased or irreversibly anonymized where possible, unless there is a justified legal, security, contractual or dispute-related reason to retain specific records.

Public community chat messages are cleared by a database trigger when new messages arrive and by a scheduled cleanup every 15 minutes after they become older than two hours. In practice, physical deletion may occur up to approximately 15 minutes after the two-hour mark during inactivity. Separate reports, security evidence and provider backups may follow different justified retention periods.

For the free Public Beta campaign, the database now schedules deletion of resolved (approved or dismissed) private feedback and administrative replies after 12 months have passed since a closed campaign's recorded end time, except records explicitly placed on retention hold. Pending reviews and held records are preserved for further assessment. Administrative audit events are scheduled for deletion after 24 months unless held or related to a held feedback. Legacy and VIP reward records are retained while necessary to maintain the account's benefits.

These specific Beta and public-chat cleanup routines are implemented; that does not mean every category has automatic deletion. Actual hosting/access logs, account and game records, provider backups, external copies, legal preservation duties and full account deletion processes still require verification and human review. A deletion request may be subject to lawful preservation duties, which will be explained in the response.

10. Your rights

Subject to applicable law, individuals may request confirmation of processing, access to their personal data, correction, portability where available, information about sharing, anonymization, blocking or deletion of unnecessary or unlawfully processed data, and review of qualifying automated decisions. Where processing relies on consent, withdrawal may be available.

Send a request free of charge to official.chesspeak@gmail.com, preferably from the email linked to the account. State whether you seek access, correction, export, account deletion or another privacy right. We may verify that the requester controls the account before disclosing or deleting data; never send your password or authentication codes. We will respond in accordance with the applicable legal requirements, explaining any preservation exception. Account deletion is currently handled through a reviewed support procedure, not an instant automated button. You may contact the Brazilian ANPD where appropriate.

11. Age restrictions and sensitive information

ChessPeak's current registration policy is 18+. Do not register if you are under 18. Do not put passwords, financial data, medical details or other sensitive personal information in feedback, public profiles or chat messages.

If the operator becomes aware of an account created in breach of the age rule, access may be limited and the account assessed for appropriate action under applicable law.

12. Policy updates and contact

Material updates will be posted with an updated revision date and, where required, notified to affected users. This preparatory edition is not a substitute for validating the operator's identity, data flows, legal bases, service-provider agreements and retention procedures.

Contact: official.chesspeak@gmail.com. Related information: Terms of Service and Feedback & Beta Rewards pages.