Privacy & Cookies

Last updated: October 14, 2026

Welcome to chessy.uk! We are a small, independent online chess platform based in the United Kingdom. We've written this privacy policy in plain English to explain exactly how we handle your data. We don't display ads, and we don't sell your personal data to advertisers or anyone else.

Who is responsible for your data: chessy.uk is run by Dan Alexandrescu, in the United Kingdom, who is the data controller for the personal data described here. You can reach him about anything in this policy at chessy.uk@gmail.com.

If you have any questions after reading this, please reach out!

1. What data we collect and why

We collect the minimum amount of data necessary to run the platform and provide you with a great chess experience.

Account Data: When you sign up using Google, we collect your name, email address, and profile picture URL from your Google account. When you sign up with your email instead, we store your email address and a securely scrambled password, never the password itself. We also store the username you choose for chessy.uk.

Game Data: We store the history of the games you play on our platform (including the moves, results, and your ratings), your puzzle-solving history, your saved game analysis, your tournament participation, and your server-side opening training progress.

Payment Data (Pro Subscribers only): If you upgrade to our Pro subscription, your payment is processed securely by Stripe. We do not store or even see your credit card details. We only store your subscription status, your current tier, and the expiry date.

Local Storage Data: Your browser stores some data locally on your device to remember your preferences. This includes your sound volume, engine mode, premove settings, local puzzle/opening progress, and a cache of your game history. This data stays on your device unless a specific feature requires sending it to our servers.

Technical Data: Like almost all websites, our servers automatically log basic technical information (such as IP addresses, request paths, and timestamps) to help us find bugs and prevent abuse. These logs also record the website you came from, and each night we count visits per source from them; the count keeps only daily totals, and the logs themselves are deleted as section 6 says. We do not use any external analytics trackers (like Google Analytics).

Where visitors come from: When you arrive through a link with a tag in it (like chessy.uk/?src=reddit) or from another website, your browser remembers the tag or the website's name (just the name, such as google.com, never the page). If you create an account, it is sent with your sign-up and we add one to that source's count of new accounts (signing in with Google sends it too, but nothing is counted for an account you already had). Once you are signed in, your browser deletes it. We keep only totals per day, such as "reddit: 5 visits, 1 new account", and never record which source brought which person. Until you choose on the cookie banner your browser keeps it only until you close the tab; with "Accept All", for up to 30 days; with "Essential Only", not at all.

Fair Play Data: Chess is easy to cheat at with an engine, so during games we record a few signals about how each move was made: how long you took, how far your mouse moved and how often you clicked, how long the mouse sat idle, whether you used a premove, and whether the game tab lost focus (and for how long). We use this only to detect engine assistance. It is stored alongside the game record, is never shown to other players, and is not used for advertising or profiling of any other kind.

2. How we use your data

We use your data purely to operate chessy.uk:

To create and manage your account.
To match you with opponents and calculate your ratings.
To provide training features like puzzles and opening repertoires.
To process your Pro subscription payments.
To keep the platform secure, enforce our Fair Play rules, and fix technical issues.

3. What other people can see

Chess is played against other people, and a game record belongs to both players. Like other online chess platforms, parts of your account are public by default so that ratings, opponents and results are meaningful. Please read this section before you sign up.

Publicly visible (to other users, and in some cases to anyone visiting the site, without needing an account):

Your profile: your username, avatar, your Bullet, Blitz, Rapid and Puzzle ratings, your win/draw/loss record, and the date you joined.
Your finished games: the moves, the result, the time control, the date, and the username of your opponent. These appear on your public profile and can be replayed and analysed by other users.
Games in progress: while you are playing, your game can be watched live by other users, showing both usernames, ratings, clocks and moves as they are played.
Leaderboards: if your rating places you on a leaderboard, your username and rating are shown there.
Community forum: anything you post, including your username.
Shared analysis: when you analyse a game played here on Chessy, that analysis is private to you unless you choose to share it to the community feed. Two kinds of game are shared to the feed automatically: games you import from a public archive such as Chess.com or Lichess, because they are already published on those sites under the same player names; and engine-versus-engine games from the Engine Arena and tournaments, which have no human player in them at all. Either way, sharing shows the moves, the analysis and the player names to other signed-in users, and you can unshare any game at any time from your saved games.

Never made public:

Your email address and password.
Your payment details (these are held by Stripe, not by us).
Your private messages and friend list.
Anything you send us through the contact form.
Your puzzle history and opening training progress.

Your in-game chat is private between you and your opponent. It is not shown to people watching the game, and we do not store it on our servers — a copy is kept only in your own browser, as described in section 7.

Because a completed game is a shared record between two players, we can't delete a game you played without also deleting your opponent's record of it. If your account is deleted, your games stay but your name in them is replaced (see section 8).

4. Legal basis for processing

Under UK and EU data protection law (GDPR), we must have a "legal basis" for collecting your data. Here is what we rely on:

Contract: We process your Account Data (including signing you in with Google, if you choose to), Game Data, and Payment Data because it is necessary to fulfill our contract with you (i.e., providing the chess platform and your Pro subscription).
Legitimate Interests: We process Technical Data and Fair Play Data to protect the security and integrity of our servers, and to keep rated games honest. We think players have a clear interest in not being cheated, and these signals are the least intrusive way we can check. We also have a legitimate interest in counting visits and new accounts per source, to decide where to tell people about Chessy.
Consent: We rely on your consent to store "Functional" preferences on your device (via local storage). You can withdraw this consent at any time.

5. Data sharing and third parties

We are hosted in the United Kingdom, and we only share your data with a few trusted service providers that help us run the platform:

Oracle Cloud (UK): Our servers and databases are hosted securely on Oracle Cloud in the London (UK South) region. Your data does not leave the UK for hosting purposes.
Google: We use Google Sign-In for authentication; with "Accept All", Google's sign-in script also loads on our pages. Our own mailbox is Gmail, so emails you send to chessy.uk@gmail.com and messages from our contact form are held by Google. Their processing is subject to Google's Privacy Policy.
Stripe: Payments are processed by Stripe (a US-based company, operating under standard contractual clauses for data transfers). They handle your payment data subject to their Privacy Policy.
Cloudflare: We use Cloudflare Turnstile to tell real people apart from bots on the contact form, the sign-up page, the password reset page and wherever you can ask for a new verification link. Cloudflare receives basic technical information from your browser, including your IP address, in order to run that check.
Resend: Our emails (account verification, password resets, and messages from the contact form) are delivered by Resend, which receives the recipient's email address and the email itself. Resend is a US-based company, so these emails pass through the United States.
Brevo: If Resend cannot deliver an email, the same email is sent by Brevo instead (a company based in France, in the EU), which receives the same information. Links in emails Brevo sends pass through its redirect service on links.chessy.uk, and as part of its service Brevo records whether each email it sends was delivered and opened and whether its links were clicked.
Chess.com and Lichess: when you look up a player or import games from these sites, your browser asks them directly, so they see your IP address.
Wikimedia: a few pictures (some chess pieces, and an illustration on the Chess History page) are loaded from upload.wikimedia.org, which sees your IP address.

Data sent outside the UK: Resend, Stripe, Cloudflare and Google may handle your data in the United States. Each of them is certified under the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge"), which UK law recognises as protecting data sent to them. Brevo is in the EU, which UK law also recognises. Ask us at chessy.uk@gmail.com if you would like more detail.

We will never sell your data to third parties. We would only disclose your data to law enforcement if legally compelled to do so.

6. Data retention periods

We don't keep your data forever. Here is how long we keep it:

Account & Game Data: Kept until you ask us to delete your account. Your games and forum posts are then kept under a replacement name, as section 8 explains.
Fair Play Data: Kept with the game record it belongs to, and deleted with it.
Server Logs: Kept for up to 30 days, then deleted. Besides IP addresses and pages, they can include usernames and the email addresses we send account emails to.
Emails and contact messages: Kept in our mailbox only as long as we need them to answer you or deal with your request.
Backups: Our database is backed up every night. A backup keeps a copy of the data as it was, including an account deleted since, for up to 60 days before it is itself deleted.
Payment Records: Kept for 7 years to comply with tax and accounting laws.

7. Cookies and local storage

We use a few tiny files stored on your device to make the site work. We divide these into two categories:

Strictly Necessary: Used to keep you logged in and securely verify your Google authentication. The site cannot function without these, and they do not require consent.
Functional: Used to remember your local preferences (like sound volume and engine mode) and cache some local progress. We will only store these if you click "Accept All" on our cookie banner.
Where you came from: the tag or website name described in section 1, kept only to count your new account for its source. Before you choose on the cookie banner it lasts until you close the tab; with "Accept All", up to 30 days; with "Essential Only" (or if you later turn off functional cookies on this page) it is not kept, and anything kept is deleted.

You can view a full list of what we store and change your preferences at any time at the top of this very page.

8. Your rights under UK/EU GDPR

You have the right to:

Access: Request a copy of the personal data we hold about you.
Rectification: Ask us to correct anything we hold that is wrong.
Erasure: Ask us to delete your account and personal data (there is no delete button yet; email us).
Restriction: Ask us to limit how we process your data in certain circumstances.
Portability: Receive your data in a standard machine-readable format.
Objection: Object to processing we carry out under legitimate interests, such as our Fair Play checks.
Withdraw Consent: Change your cookie preferences at any time.

To exercise any of these rights, email chessy.uk@gmail.com from the address on your account (or use the contact form on our website). We will respond within one month, and we may ask you to confirm the request from that address so we know it is really you.

What deleting your account does: we delete your email address, password, Google link, picture, messages, friends, puzzle history, saved analyses, training games and the fair-play signals from your moves. Some records are shared with other people, so we keep them but replace your name with a code such as "deleted_123": the games you played (your opponents' results and ratings depend on them) and anything you posted in the community forum. If you would like your forum posts removed as well, say so in your request.

We don't make decisions about you by automated means alone: fair-play checks only flag games, and a person reviews them before any action is taken against an account.

9. Age requirement

chessy.uk is not aimed at children under 13, and you should not create an account if you are younger than that. If we find out that we hold data belonging to a child under 13, we will delete it.

10. Complaints and contact info

If you have a question or concern, please reach out to us first, at chessy.uk@gmail.com or via our website's Contact page, so we can fix it.

If you are a resident of the UK and you feel we haven't resolved your issue, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. EU residents may contact their local data protection authority.

11. Changes to this policy

If we make major changes to how we handle your data, we will update this page and, if the changes are significant, we will notify you (e.g., via a site banner or email).

We value your privacy