What we collect, and why

Last updated: 16 July 2026

This policy explains what personal data chess-report processes, why, on what legal basis, and the rights you have under the EU General Data Protection Regulation (GDPR). We’ve written it to describe what the service actually does — nothing more.

Who is responsible

The data controller is QI Investment S.à r.l., Luxembourg. For any privacy question or to exercise your rights, contact us at hello@chess-report.com.

What we collect

Chess usernames you enter

When you run a scan, we use the public Chess.com or Lichess handle you type to fetch that account's publicly available games. We keep a cached copy of that public profile and its games so repeat scans are fast.

A hash of the scanned handle

For an anonymous count of how many scans have run, we store a one-way SHA-256 hash of the handle (not the handle itself) together with the platform and how many games were read.

Aggregate scan statistics

Anonymous, aggregate metrics from a scan (e.g. rating band, win rate, top pattern) so we can build honest per-rating benchmarks over time. No move-by-move or identifying content.

Your email address

Only if you choose to join the waitlist or create a coach account. We use it to contact you about the product or waitlist, and — for an account — to sign you in.

Account & session data

If you create an account, your login credentials and profile are handled by our authentication provider. We set essential cookies to keep you signed in.

Basic usage analytics

Privacy-friendly, aggregated page analytics (via Vercel Analytics) that do not use tracking cookies and do not build a profile of you.

Legal basis

We rely on: your consent when you submit your email to the waitlist or create an account (Art. 6(1)(a)); the performance of a contract to provide an account you asked for (Art. 6(1)(b)); and our legitimate interest (Art. 6(1)(f)) in running, securing, and improving a free tool — including the anonymous scan counter and aggregate analytics, which are designed to be non-identifying.

Who processes data on our behalf

We keep the list of third parties deliberately short, and we only use ones we actually rely on:

Supabase

Our database and authentication provider. Hosts scan data, waitlist emails, and accounts. We use EU-region hosting.

Vercel

Our hosting platform and the provider of the privacy-friendly usage analytics. Vercel Inc. is US-based; data may be processed in the US under Standard Contractual Clauses / the EU–US Data Privacy Framework.

Chess.com & Lichess

We query their official public APIs to read the games of the handle you enter. We send only that public username — never your email, account, or any personal data about you as a chess-report user.

We do not use any AI/LLM service to process your personal data, and we do not sell your data or share it for advertising. We do not currently process any payments; if that changes, this policy and our Terms will be updated before any payment feature goes live.

International transfers

Where a processor (such as Vercel) processes data outside the European Economic Area, that transfer is covered by an appropriate GDPR safeguard — Standard Contractual Clauses and/or the EU–US Data Privacy Framework. Supabase data is hosted in the EU.

How long we keep it

Cached public scan data and aggregate/anonymous metrics are retained while they remain useful for the service and its benchmarks. Waitlist emails are kept until you ask us to remove them or the waitlist closes. Account data is kept for as long as your account exists and is deleted on request. You can ask us to delete any of your data at any time.

Cookies

We use only essential cookies needed to keep you signed in and to secure the service. Our usage analytics are cookieless. We do not use advertising or cross-site tracking cookies.

Your rights

Under the GDPR you have the right to:

Access — get a copy of the personal data we hold about you.
Rectification — correct inaccurate or incomplete data.
Erasure — have your data deleted (“right to be forgotten”).
Restriction — limit how we process your data.
Portability — receive your data in a portable, machine-readable format.
Objection — object to processing based on our legitimate interest.
Withdraw consent — withdraw consent at any time, without affecting prior processing.

To exercise any of these, email hello@chess-report.com. You also have the right to lodge a complaint with a data protection supervisory authority — for example the Luxembourg Commission nationale pour la protection des données (CNPD, cnpd.lu), or the authority in your own EU country of residence.

Changes

We may update this policy as the product evolves (for example, when accounts or payments go live). We’ll change the date at the top when we do.