Privacy

Who we are

Check-mates is an over-the-board chess meetup service based in Belgium. This website is our public information site and venue directory; the app is where the product lives.

This website

Browsing this site does not require an account. We don't set advertising or tracking cookies. Our hosting provider processes standard server logs (IP address, request time) to keep the service secure and running.

How we count visits to club pages

We count how often club pages and their posters are viewed and where visitors come from, so clubs can see what their page brings them and we can see how the site is used. Our legal basis is our legitimate interest in that (GDPR Art 6(1)(f)); we wrote down the balancing test.

We count on our server, from the request your browser sends anyway. No script runs for it and nothing is read from or stored on your device: no cookies and no local storage. Search engines and other bots are left out.

To count a visitor only once per club per day, we combine your IP address and your browser's user-agent string with a random value (a "salt") that we replace every day, and keep only a one-way hash (HMAC-SHA256) of them. The old salt is overwritten when it is replaced; it can still exist for up to 7 days in our database provider's backups used to restore the database after a failure. These daily marks are deleted after 2 days. We don't store your IP address for this.

Of the page that sent you, we keep only the site's name (for example google.com or the club's own website), never the full address, and only as a daily count per club. Clicks on a page's links (website, map, calendar) and shares from the app are counted too, as plain totals.

Because we can't tell which hash belongs to whom, we can't link a mark to you (GDPR Art 11). That means requests to access, delete or object can't be applied to an individual mark; the marks disappear by themselves after 2 days, and you can always ask us about this processing at privacy@check-mates.app.

Public club pages and the club directory

Every active club on Check-mates has a public page on this website (check-mates.app/club/…), and the club directory (check-mates.app/clubs) lists clubs by country and city. These pages are public: anyone can read them without an account, and search engines may index them. The same rules apply to every club; a club can't opt out of search engines, but we may hide a page in exceptional cases.

A club page shows information about the club, not about its members: the club's name, description and city, where and when it plays (its club nights, venues and public events), its website and federation number when it has given them, how many members it has and since when it is on Check-mates. It never shows members' email addresses, usernames, ratings or locations.

If you use "Near me" in the directory, your browser asks for your location. It is rounded to about 10 km in your browser before it is sent, used only to answer that search and not stored by us (beyond the standard server logs mentioned above).

Club ladders

A club's ladder is visible to its members in the app. Outside the club (to people who aren't members, and through our public interfaces) a member's name appears on the ladder only if that member has agreed to it, and then only as first name and initial (for example "Anna D.", or your display name as it is, if it is a single word), never with a rating or username, and only once they have played at least one ladder game. Everyone starts without that consent. You can withdraw it at any time by writing to privacy@check-mates.app; your name then disappears from the public ladder. Leaving a club also ends your consent for it.

Clubs and Check-mates as joint controllers

For a club's public page and its public ladder, the club and Check-mates decide together how members' data is used, so we are joint controllers. In short: the club decides to publish its page and what it says about itself; Check-mates runs the pages, collects the ladder consents, keeps the data secure and handles your requests. You can exercise your rights with us at privacy@check-mates.app, whichever of us you contact first. The club officer who manages the page accepts this arrangement for the club, or personally if the club has no legal personality (for example an informal group).

A club's contact address

A club's contact email appears on its public page only if the club chose to show it. Even then it is not written into the page: a visitor presses "Show email" to see it, which keeps it away from simple address harvesters.

Reporting a club page

Anyone can report a club page they believe is illegal or against our terms ("Report this page"). We store the page address, the type of report, your explanation and, if you give them, your name and email address. Name and email are required for reports of illegal content, except reports of child sexual abuse material, and optional for reports against our terms. We use them to handle the report, to confirm that we received it and to tell you our decision. Your name and email are deleted six months after the decision. The club's officers are told what we decided about their page, but not who reported it.

To stop abuse of the report form, the "Show email" button and the club search, we limit how often one IP address can use them. For the report form we store only a keyed hash of the IP address that can't be turned back into the address; it counts for one hour and is deleted by our daily clean-up. For the "Show email" button and the club search we keep the IP address only briefly in the server's working memory, never in our database.

The app

When you create an account in the app we store what you give us: your email, a display name and handle, and — only with your explicit consent — an approximate home location so we can show games near you. Your exact coordinates never leave our server: other players only ever see a rounded distance or a venue you picked, and place search sends our geocoding provider only what you type and a location rounded to about 1 km. If you link a chess.com or Lichess account we read its public ratings to seed your OTB rating. A profile photo is optional: if you add one (or sign in with Google, whose profile picture we use until you change or remove it), every player in the app can see it. We store it shrunk to a small square; removing it or deleting your account deletes the file.

Using the app also creates the data the service is made of: games you create or join and their results, your OTB rating and its history, events and tournaments you attend, friends and blocks, messages you send in conversations and game or event chats, and reports you file. Messages are visible to the people in that conversation and to our moderators when a report is made.

Check-mates is for people aged 16 or older. When you accept our terms and this policy in the app, we record when you accepted and which version you accepted.

Sign-in

You sign in with a one-time code sent to your email, with Sign in with Apple, with Google, or with a passkey. From Apple and Google we receive only a verified email address (which may be an Apple private relay address) and an account identifier; we never see your password. A passkey stays on your device — we store only its public key. The app keeps a session token in your phone's secure storage.

Location in the app

The app asks for your device location only while you use it (never in the background), to show nearby games, players and venues and — when you choose to — to share an "available now" beacon. A live beacon location is kept only until the beacon expires. You can refuse the permission and set your area by hand instead.

Push notifications

If you allow notifications, we store a push token for your device so we can tell you about challenges, join requests, results to confirm, messages and upcoming games. Notifications are delivered through Expo's push service and Apple (APNs) or Google (Firebase Cloud Messaging). You can turn categories off in the app or disable notifications in your phone's settings. Push tokens are deleted when you delete your account.

Crash reports

When the app crashes it may send a technical report (device model, OS version, app version, the error and the screens leading up to it) to Sentry, our crash-reporting provider. Reports carry no name, email or account identifier, are used only to fix bugs, and expire after 90 days.

No ads, no tracking

The app shows no advertising, contains no advertising or analytics SDKs, and does not track you across other companies' apps or websites. We don't sell or share your data for advertising.

Who processes your data

We use a small set of processors, each only for running the service: Vercel (hosting, API and profile-photo storage), Neon (database), Resend (sign-in and service emails), Expo, Apple and Google (push delivery and sign-in), Photon by komoot (place search, queried from our server), and Sentry (crash reports). Data is stored in the European Union where the provider allows it; transfers outside the EU rely on the providers' standard contractual clauses.

How long we keep it

Account data is kept while your account exists. Sign-in codes expire after 10 minutes, app sessions after 90 days, and availability beacons when they end. Daily visit-counting marks on club pages are deleted after 2 days. When you delete your account, personal data is erased immediately; played games stay without your name so opponents' ratings remain correct, and abuse reports are kept for at most 2 years for safety. Notifiers' names and email addresses on reports of club pages are deleted six months after the decision. Details: deleting your account.

Your rights

Under the GDPR you can access, correct, export or delete your data at any time. In the app, Profile › Account & data lets you download a copy of your data and delete your account. Deleting your account scrubs your personal details while preserving the integrity of games other players took part in. Contact privacy@check-mates.app. You may also lodge a complaint with the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be).