Legal

Privacy Policy

Last updated: August 2026. This policy explains how Chessclub collects, uses, and protects your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

Chessclub is a mobile application that helps people find chess opponents, book venues, and play competitive league chess in their city. Chessclub is operated by Snackability Ltd, and Snackability Ltd is the data controller for all personal information processed through the Chessclub app and website (chessclubhq.com).

What data we collect

We collect the following categories of personal data when you use Chessclub:

Account and identity data

• Your name and email address, provided via Google Sign-In or Sign in with Apple (Sign in with Apple may provide a private relay email address)
• Your date of birth, entered when you create your profile. Chessclub is an 18+ service because matches are played in licensed venues, so we use your date of birth for one purpose only: to check that you are 18 or over. It is never shown to other users, it is not used for marketing or any other purpose, and you cannot see it again once your account is created. We do not verify identity documents.
• Profile photo (optional, uploaded by you)
• Biography and availability text (optional, added by you)

Location data

• Your postcode, entered during profile creation
• Approximate latitude and longitude derived from your postcode (not precise GPS location)
• This is used to show nearby players and venues

Chess and activity data

• Your ELO rating, match history, and league results
• Milestone badges and weekly streak information
• Matches you post, join, or cancel
• Messages sent within the app (direct messages and league group chats)

Payment data

• Payment is processed by Stripe. We do not store your card number, CVV, or full card details
• We retain the Stripe PaymentIntent ID associated with each transaction for accounting and dispute resolution
• Transaction amounts and dates are stored for up to 7 years as required by UK financial regulations

Device and notification data

• If you grant permission, we store an Expo push notification token to send you alerts about matches and league activity
• You can withdraw push notification permission at any time through your device settings

Safety reports

• If you block, mute, or report another user, we store that information to keep the community safe

How we use your data

We process your personal data for the following purposes and on the following legal bases:

• To provide the service (contract performance): account creation, finding nearby players, booking venues, posting and joining matches, league management, messaging
• To check you are old enough to use Chessclub (legitimate interests): Chessclub arranges in-person matches at licensed venues, so accounts are restricted to people aged 18 and over. Your date of birth is used solely to apply that restriction
• To process payments (contract performance): venue bookings, league entry fees, annual membership
• To send notifications (legitimate interests / consent): match reminders, result confirmations, league updates. You can opt out at any time via device settings
• To keep the community safe (legitimate interests): processing block, mute, and report actions; reviewing safety reports
• To maintain financial records (legal obligation): retaining payment records for 7 years
• To improve the service (legitimate interests): understanding how features are used to fix bugs and improve the experience

Who we share your data with

We do not sell your personal data. We share data only with the following service providers, who process it on our behalf:

• Supabase: our database and authentication infrastructure. Your data is stored on Supabase servers. Supabase operates within the EU/EEA.
• Stripe: payment processing. Stripe receives payment card details and transaction information. Stripe is certified to PCI DSS Level 1.
• Resend: transactional email delivery. Your email address is shared to send booking confirmations and other service emails.
• Expo: push notification delivery. Your device's push token is shared to deliver notifications to your device.
• Google: sign-in via Google OAuth, and (on Android) map display via the Google Maps SDK. Google receives your app access request; we receive your name and email from your Google account.
• Apple: sign-in via Sign in with Apple (on iOS). Apple may provide us with your name and an email address (which can be a private relay address).
• PostHog: privacy-focused product analytics, to understand how the app is used and improve it. We send app-usage events identified by your Chessclub user ID. We do not send your name, email, or precise location to PostHog.
• Sentry: crash and error reporting, to detect and fix bugs. Sentry receives technical error data. We do not attach your personal profile to Sentry reports.
• postcodes.io: postcode geocoding. When you enter your postcode, it is sent to postcodes.io to look up an approximate area (latitude/longitude) so we can show nearby players and venues.

Your match results, ELO rating, milestone badges, and profile information (name, approximate location, bio) are visible to other Chessclub users as part of the core service. Your email address, push token, and payment details are never visible to other users.

How long we keep your data

• Account and profile data: retained while your account is active. Deleted within 30 days of an account deletion request.
• Date of birth: retained while your account is active, as the record that the 18+ check was carried out. Erased as soon as your account is deleted. It is never part of the anonymised match record we keep.
• Match history and league results: retained while your account is active. These form part of your chess record.
• Messages: retained while your account is active.
• Payment records: retained for 7 years as required by UK financial regulations, even after account deletion.
• Safety reports: retained for up to 3 years to identify patterns of harmful behaviour.
• Push tokens: removed when you sign out or delete your account.

Deleting your account

You can delete your Chessclub account and personal data at any time in two ways:

• In the app: go to Profile → Settings → Delete my account and confirm. This signs you out immediately and permanently removes your personal data.
• By email: if you can't access the app, email ollie@chessclubhq.com from your registered address with the subject "Delete my account", and we will delete it within 30 days.

When your account is deleted, we permanently remove your personal data: your name, email, profile photo, approximate location, and messages. Your past match results remain on the leaderboards in anonymised form so other players' records aren't affected. Payment records are kept only for as long as UK law requires (up to 7 years). Deletion is irreversible.

Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right of access: you can request a copy of the personal data we hold about you
• Right to rectification: you can correct inaccurate data (most profile data can be updated directly in the app)
• Right to erasure: you can request deletion of your account and personal data, subject to legal retention obligations (e.g. payment records)
• Right to data portability: you can request your data in a structured, machine-readable format
• Right to restrict processing: you can request that we limit how we use your data in certain circumstances
• Right to object: you can object to processing based on legitimate interests. For product analytics specifically, you can opt out at any time in the app: Profile → Settings → Privacy → Share usage data
• Right to withdraw consent: where processing is based on consent (push notifications), you can withdraw at any time via device settings

To exercise any of these rights, contact us at ollie@chessclubhq.com. We will respond within one month.

Automated decision-making

Chessclub uses automated calculation to determine your ELO rating, league division placement, and milestone badge level based on your match results. These calculations follow defined rules set out in our app documentation. No decision with a significant legal effect on you is made solely by automated means without a human review option.

Children's privacy

Chessclub is an 18+ service and is not intended for children or under-18s. Matches are played in person at licensed venues, so we restrict accounts to adults.

We ask for a date of birth during profile creation and refuse to create an account for anyone under 18. Where an account is refused on age grounds, no date of birth and no Chessclub profile are stored. The refusal happens before anything is written, and no account is created.

One thing does exist by that point, and we would rather tell you than imply otherwise: signing in with Google or Apple creates a sign-in record before we are able to ask your age, and that record holds the email address your provider gave us. It contains no profile, no date of birth, and no other information about you. If you were refused an account and want that record deleted, email ollie@chessclubhq.com and we will delete it and confirm that we have. We are also working to make that deletion automatic at the moment an account is refused.

We do not knowingly collect personal data from anyone under 18. If you believe an under-18 has an account or has provided us with personal data, contact us at ollie@chessclubhq.com and we will close the account and delete the data promptly.

International transfers

Your data may be processed by our service providers in countries outside the UK, including the United States (Stripe, Expo, Resend, PostHog, Sentry). Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO).

Security

We take reasonable technical and organisational measures to protect your personal data, including encrypted connections, row-level security on our database, and restricted access to sensitive functions. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Analytics, cookies and tracking

The Chessclub mobile app does not use cookies. It uses PostHog to collect pseudonymous product-analytics events (such as which features are used), identified by your Chessclub user ID but never by your name or email, to help us improve the app. We rely on our legitimate interests for this analytics, which is never used for advertising and is never sold. We do not use any advertising cookies or advertising networks, and we do not share your data with advertisers. The chessclubhq.com website may use cookies for basic analytics.

You can turn analytics off at any time in the app: Profile → Settings → Privacy → Share usage data. Turning it off stops all product-analytics collection on your device immediately.

Changes to this policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you via the app or by email. The date at the top of this page shows when the policy was last updated. Continued use of the app after changes constitutes acceptance of the updated policy.

How to complain

If you have concerns about how we handle your personal data, please contact us first at ollie@chessclubhq.com and we will do our best to resolve it.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Contact us