Effective 2026-07-16
Pilot privacy notice
This notice covers the 1chess.online website and verified pilot list. The current pilot does not create playing accounts, public profiles, matchmaking, or community spaces.
1. Who is responsible
The data controller is the operator of the 1chess.online domain and pilot (the “Operator”). Send data requests to privacy@1chess.online. The Operator's legal name and registered address must be added to this notice before public production registration opens.
2. Data we process
- Pilot signup: normalized email, locale, selected feature interests, consent time, and pending, verified, or unsubscribed status.
- Acquisition: landing path, content cluster, and UTM values supplied by the URL. We do not place email or verification tokens in URLs.
- Abuse prevention: one-way hashes derived from IP and email for rate limiting. They are used for security, not player profiling.
- Optional analytics: only after you choose Allow, GA4 may receive page views, content type, locale, and funnel events. Email, form answers, and tokens are never sent to GA4.
3. Purposes and legal basis
We use data to send verification, administer the pilot list, provide access when the pilot opens, understand feature demand, measure acquisition, and prevent abuse. Pilot email and optional analytics rely on your consent. Minimal anti-abuse processing relies on legitimate interests where permitted. Withdrawing consent does not affect processing that was lawful before withdrawal.
4. Storage, recipients, and transfers
Signup data remains in the website database and is available only to maintainers who need access. Production hosting/database and transactional email providers may process it under the Operator's instructions. Google receives analytics only after consent. We do not sell personal data.
Some providers may process data outside Vietnam. Before production, the Operator must identify each provider and region here and complete any safeguards required for cross-border transfers.
5. Retention
| Data | Planned retention |
|---|---|
| Verification token | Stored as a hash, expires after 24 hours, and cannot be replayed after use. |
| Unverified signup | Deleted within 30 days if verification is not completed. |
| Verified signup | Until unsubscribe or pilot close, then deleted or de-identified within 90 days unless law requires otherwise. |
| Rate-limit records | Hashed values are pruned within 24 hours. |
| Optional analytics | Up to 14 months in GA4; aggregate reports may remain longer but do not contain email. |
6. Your rights and choices
You may ask to access, correct, delete, or restrict data; withdraw consent; object where applicable; and request information about processors or transfers. Email privacy@1chess.online from the registered address. We may verify control of the email before acting.
Every pilot email includes unsubscribe. Analytics choices can be reopened from the footer; declining analytics does not affect reading or signup. You may also complain to the competent data-protection authority where you live.
7. Children
The pilot does not set an age limit for playing chess and does not ask for date of birth. We do not knowingly seek children's data without an appropriate basis and authorization. A parent or representative can contact us to request review and deletion. If accounts, public profiles, or community features launch later, a dedicated minors workflow and notice will be introduced first.
8. Security and changes
Email is normalized and unique; verification and unsubscribe tokens are hashed; operational access is limited; and the production database must be backed up off-server. No system is perfectly secure, but suspected incidents will be contained, assessed, and notified as required.
If purposes, providers, or data categories change, we will update the effective date and provide a prominent notice where the change materially affects your choices.