Privacy Policy

1.1 Information You Provide

• Account Information: Name, email address, username, and password when you register.
• Profile Information: Optional profile details such as display name and avatar.
• Wallet Address: Your Solana public wallet address when you connect a wallet (e.g., Phantom, Solflare).
• Lichess Account: Your Lichess username and OAuth-authorized profile data when you link your Lichess account.
• Communications: Messages sent through contact forms, support requests, or community channels.
• Two-Factor Authentication: TOTP secret keys (encrypted) when you enable 2FA.

1.2 Information Collected Automatically

• Usage Data: Pages visited, features used, puzzles solved, games played, tournaments entered, and referral activity.
• Device Information: Browser type, operating system, device type, screen resolution, and language preferences.
• Log Data: IP address, access timestamps, referring URLs, and error logs.
• Cookies and Similar Technologies: Session cookies, authentication tokens, and analytics data. See our Cookie Policy for details.

1.3 Blockchain Data

When you interact with the Solana blockchain through our Platform (e.g., presale purchases, token claims, tournament entries), the following data is recorded on-chain and is publicly visible:

• Your wallet public address.
• Transaction amounts and timestamps.
• Token balances and transfer history.
• Smart contract interaction records.

Important: Blockchain data is permanent and immutable. We cannot delete, modify, or control data recorded on the Solana blockchain.

We use the information we collect for the following purposes:

We do not sell your personal information. We may share your information in the following limited circumstances:

• Service Providers: Third-party services that assist with hosting (cloud providers), email delivery (SMTP), database management (MongoDB Atlas), and blockchain RPC nodes (Helius/QuickNode). These providers are bound by confidentiality obligations.
• Lichess: When you link your Lichess account, we share your ChessChain account association with Lichess via OAuth. Lichess's privacy policy governs their use of your data.
• Blockchain Network: Transaction data submitted to the Solana blockchain is publicly visible. Your wallet address and transaction history can be viewed by anyone on the blockchain.
• Legal Requirements: When required by law, regulation, legal process, or governmental request.
• Protection of Rights: When necessary to protect the rights, property, or safety of ChessChain, our users, or the public.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the successor entity.

We implement industry-standard security measures to protect your information:

• Encryption: Passwords are hashed using bcrypt (10 rounds). 2FA secrets are encrypted at rest.
• Transport Security: All data is transmitted over HTTPS/TLS encryption.
• Access Controls: Role-based access control (RBAC) for admin functions. Account lockout after failed login attempts.
• Input Validation: All user inputs are validated with Zod schemas to prevent injection attacks.
• Security Headers: CSP, HSTS, X-Frame-Options, and Referrer-Policy headers are enforced.
• Session Management: JWT-based sessions with secure, HTTP-only cookies.

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

We retain your personal information for as long as necessary to provide our services and fulfill the purposes described in this policy. Specifically:

• Account Data: Retained for the duration of your account and a reasonable period after account deletion for legal and operational purposes.
• Game and Puzzle Data: Retained for leaderboard integrity and platform analytics.
• Transaction Records: Retained for a minimum of 5 years for compliance purposes.
• Log Data: Retained for up to 90 days for security and debugging purposes.
• OTP Tokens: Automatically deleted after use or expiration (typically 10 minutes).
• Blockchain Data: Permanent and immutable. Cannot be deleted.

Depending on your jurisdiction, you may have the following rights regarding your personal information:

To exercise any of these rights, contact us at support@chesschain.club. We will respond within 30 days.

Note: We cannot delete data that has been recorded on the Solana blockchain, as it is publicly accessible and immutable by design.

Your information may be processed and stored in countries other than your country of residence. By using the Platform, you consent to the transfer of your information to countries that may have different data protection standards than your jurisdiction. We ensure appropriate safeguards are in place for international transfers in compliance with applicable data protection laws.

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that a child under 18 has provided personal information, we will take steps to delete such information promptly. If you believe a child has provided us with personal information, please contact us at support@chesschain.club.

The Platform may contain links to third-party websites and services, including Lichess, Solana Explorer, wallet providers, and social media platforms. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Material changes will be communicated via email or prominent notice on the Platform. Your continued use of the Platform after changes constitutes acceptance of the updated policy.