Privacy policy

Chess Report makes reports on chess games played on chess.com and lichess. It's run by yafla Inc.. This policy says what we collect, why, who else sees it, and the choices you have.

What we collect

• Your Google account details. When you sign in with Google, Google tells us your account's ID, your email address and your name. We use them to know you when you come back and to show who you're signed in as. We never see your Google password, and we ask Google for nothing else: not your contacts, your email or your files.
• What you order. The chess.com or lichess username you ask about, how many games, the time control, and your time zone. Your browser gives us the time zone, so the report can show the times of day you play. When you buy credits, you also tell us where you live (your province or territory, or outside Canada), so we charge the right sales tax.
• Games. To make a report, we fetch the player's recent games, and the public profiles of the player and their opponents (such as their ratings), from chess.com's or lichess's public archives. We use them to make the report you ordered, and we keep copies of the public games and our analysis of them, so later reports on the same games are quicker. Those copies are kept by player, not linked to you or your account.
• Payments. Stripe takes payments. Stripe collects your card details and billing address, and we never see your card number. Stripe tells us whether a payment went through, the amount, the tax and the country of your billing address, and we keep a record of each order and of the report credits on your account.
• Invitations. If you came to the site by a friend's invitation link, we note whose it was when you make your account, so we can give you both a free report when you first buy. A cookie remembers the link for up to 60 days, until you sign in. Your friend sees how many people joined by their link and how many bought, never who.
• Cookies. One cookie keeps you signed in, for up to 30 days or until you sign out. If you pick a light or dark theme, your browser remembers the choice on your device and doesn't send it to us. We use no advertising or analytics cookies, and no tracking scripts.
• Connection details. Like any website, the servers and network that deliver the site see your IP address and the pages you ask for. We use these only to run the site and protect it from abuse. The country your IP address is in shows you prices in your own currency too; we don't keep it.

How we use it

To sign you in, make your reports and keep them for you, take payment, give back a credit when a report can't be made, answer your messages, keep the records that tax law requires, and keep the site secure. We don't sell personal information, use it for advertising, or share it beyond what this policy describes. We use the details Google gives us only to sign you in.

Who else sees it

• Google, when you sign in with your Google account.
• Stripe, which takes payments. We give Stripe your email address to fill in on its payment page.
• chess.com and lichess, which we ask for games. We send them only the username to look up, never your details.
• Our hosting providers, which run the servers and network the site uses.
• Authorities, if the law requires it.

Your reports are private: only you, signed in, can open them.

Where it's kept

We and the companies above may store and process information in Canada, the United States and other countries, whose privacy laws may differ from those where you live.

How long we keep it

• Your account: until you ask us to delete it.
• Your reports: 180 days after they're made, and then we delete them. You can save a copy of a report to keep for yourself.
• Sign-ins: 30 days at most.
• Orders and payment records: as long as tax and accounting law requires (in Canada, generally six years), even after you close your account.
• Connection details: only as long as we need them to run and protect the site.
• Copies of public games and our analysis of them: as long as they're useful for making reports.
• Backups, kept to recover from a failure: what we delete is gone from them within 30 days.

Your choices

• You can ask to see the personal information we hold about you, have it corrected, or have your account and reports deleted. Write to support@yafla.com, and we'll answer within 30 days.
• You can remove the site's access to your Google account at any time, under third-party connections in your Google account.
• Depending on where you live, you may have other rights over your information, and you can complain to your privacy regulator. In Canada, that's the Office of the Privacy Commissioner of Canada.

Security

The site is served only over encrypted connections. We keep sign-ins as scrambled (hashed) tokens rather than as they're sent to your browser, and your reports open only for you.

Children

Chess Report isn't meant for children under 13. If you think a child has given us personal information, write to us and we'll delete it.

Changes

When we change this policy, we'll update the date at the top. If a change matters to how we use your information, we'll say so on the site first.

Contact

Questions about privacy, or requests about your information: support@yafla.com.