Privacy notice
This notice explains which personal data ChessLivo (chesslivo.com) processes, why, for how long and what rights you have. It is written for the Turkish Personal Data Protection Law No. 6698 (KVKK) and also covers visitors from the EU.
Who is responsible
The data controller is ChessLivo, chesslivo.com. Contact: [email protected].
What we process
Every visitor
- Server logs: IP address, time, requested page, browser (user agent) and referring page. They keep the site running and secure and help with errors and abuse.
- Usage statistics: Cloudflare Web Analytics counts page views without cookies. Google Analytics runs only if you accept it in the cookie banner; it then sets cookies and receives your IP address and device information.
- Your settings: language, light / dark theme and board preferences, stored in your own browser (see "Cookies and browser storage").
- Analysis board: a position or game you load on
/analysisis stored only as a fingerprint (hash) with a counter, without any link to you.
Account holders
- Email address, username and your password, which is stored only in a one-way protected (hashed) form.
- Account status, dates of sign-up, email confirmation and changes.
- The privacy notice you acknowledged at sign-up (its fingerprint, language and the time).
- Short-lived links we send by email (email confirmation, password reset) and counters of sign-in attempts per IP address and per email address (to stop password guessing).
- Your roles in chess clubs (owner, admin, arbiter) and club invitations sent to or by you.
People who write to us
If you write to us through the contact form (/contact), we receive your name, your email address, the topic you chose and your message, together with the language of the page and the time. The form sends them as an email, through our email provider, to [email protected], which Cloudflare Email Routing forwards to the mailbox of the site's operator; your address is the one we reply to, and the website does not keep a copy. To prevent abuse, the form uses the bot check (Cloudflare Turnstile) and counts messages per IP address and per email address (the email address only in a one-way protected form); these counters are deleted after they expire. We keep your message in our mailbox as correspondence for as long as we need it to answer you and to follow up on your request. Please do not send special categories of personal data (KVKK Art. 6, for example about health, religion or criminal records) through the form.
Club players and tournament participants
Club organizers can enter players who have no account: first and last name, a nickname and starting ratings, then their pairings, results and club ratings. Organizers can also run their own tournaments with names they type in. Public club pages show the nickname; full names are shown only when the club's owner turns that on after confirming the players agreed. Organizers should only enter players who agreed to it.
Public chess tournament data
For live and finished tournament broadcasts we show players' names, FIDE IDs, titles, federations, ratings, games and results. This data comes from public sources: Lichess broadcasts, chess-results.com and FIDE's public rating lists.
Community broadcasts
Account holders can broadcast their own tournaments (/broadcast). For that we keep the broadcast's details (name, description, city, dates, time zone, links and the round schedule) with the organizer's account, the push key only in a one-way protected form, and a log of what each round received (time, counts and error messages; for games sent with the push key, also the IP address they came from, to trace misuse of a key). The PGN games an organizer uploads, pushes or lets us fetch from a source they name are public tournament data: we show them to everyone, with the players' names in them, and keep them with the tournament. Players who want a name corrected or removed can ask the organizer or write to us. A public broadcast's card on the homepage and on /tournaments names the organizer by their username. Anyone can report a broadcast through the contact form (topic "Report a community broadcast"); our moderators can hide or unlist a broadcast and record each such action (which broadcast, which moderator, the reason code and the time).
Why and on what legal basis
| Purpose | Legal basis (KVKK Art. 5) |
|---|---|
| Running the site, security, preventing abuse (logs, sign-in limits, bot check) | our legitimate interest (Art. 5/2-f) |
| Creating and running your account, sending the emails it needs | performing the service you asked for (Art. 5/2-c) |
| Answering the messages you send through the contact form | questions about our service: performing that service (Art. 5/2-c); requests about your personal data under KVKK: our legal obligation (Art. 5/2-ç); anything else: our legitimate interest in answering you (Art. 5/2-f) |
| Club tournaments, standings, ratings and their public pages | performing the service for the club (Art. 5/2-c) and legitimate interest (Art. 5/2-f) |
| Showing public chess tournament data | data made public by the person or the organizers (Art. 5/2-d) and legitimate interest (Art. 5/2-f) |
| Community broadcasts: running the organizer's broadcast, showing its games, moderation | performing the service for the organizer (Art. 5/2-c), data made public by the organizers (Art. 5/2-d) and legitimate interest (Art. 5/2-f) |
| Usage statistics without cookies (Cloudflare Web Analytics) | legitimate interest (Art. 5/2-f) |
| Google Analytics | your explicit consent (Art. 5/1), which you can withdraw at any time under "Cookie settings" |
| Legal obligations and claims | Art. 5/2-ç and 5/2-e |
Cookies and browser storage
Strictly necessary:
- Session cookie (
PHPSESSID): keeps you signed in during a visit. _csrf: protects forms against forged requests._identity: only if you tick "Keep me signed in"; lasts 30 days.ca-lang: the language you chose.ca-consent: remembers whether you accepted or rejected Google Analytics; 180 days.
Stored only in your browser and never sent to us: ca-theme (light / dark), ca-watch-prefs and ca-watch-settings (board and engine preferences), and similar display choices.
Third parties:
- Google Analytics (
_ga,_ga_*cookies): usage statistics, only after you accept them in the cookie banner. You can change your choice at any time with "Cookie settings" at the bottom of every page; rejecting removes these cookies. - Cloudflare Turnstile: checks for bots on sign-up, password reset and the contact form and processes technical data of your browser.
- Images and scripts: flag images come from flagcdn.com and some scripts from cdnjs.cloudflare.com, so your browser connects to them.
Who receives data, and transfers abroad
We do not sell personal data. These providers process it for us:
- Contabo GmbH (Germany): the server.
- Cloudflare, Inc. (USA): network, security, the bot check, usage statistics, backup storage and forwarding mail sent to our addresses (Email Routing).
- Sendinblue SAS / Brevo (France): sending our emails.
- Google (USA / Ireland): Google Analytics.
Using them means data is transferred outside Turkey (KVKK Art. 9). Public authorities receive data only where the law requires it.
How long we keep data
| Data | Kept for |
|---|---|
| Server logs | 14 days |
| Database backups | 7 days on the server, 30 days in backup storage |
| Your account | until you delete it |
| Email confirmation / password reset links | 24 hours / 1 hour |
| Sign-in attempt and contact form counters | deleted after they expire |
| Messages sent through the contact form | in our mailbox as correspondence, as long as needed to answer you and follow up on your request |
| A deleted club | 90 days (its owner can restore it until then); then its players are anonymized and its members and invitations removed |
| Tournament results and club ratings | kept as the club's sports record; a club owner can anonymize a player at any time |
| Community broadcasts and their games | kept with the tournament as its public record; on account deletion, as you choose (see below) |
| Round logs of a broadcast (with the push IP addresses) | the last 200 entries per round, kept with the broadcast |
| Usage statistics | according to Google Analytics' retention settings |
When you delete your account (/account/delete) we remove at once your email address, username, password, sessions, links, club roles and invitations, and the tournaments you created without a club. We keep the account number, the time of deletion and the privacy notice you acknowledged. Results of club tournaments you organized stay. If you broadcast tournaments, the deletion page lets you choose: keep them under an anonymous owner (the default: their cards say "Community broadcast" without a name, the broadcasts still running are ended and their push keys stop working) or delete them with their rounds, games and logs. Deleted data disappears from backups when they expire (at most 30 days).
Your rights
Under KVKK Art. 11 you can ask whether we process your data and for information about it, its purpose and who received it. You can also ask us to correct or delete it, to tell the recipients about that, to object to a result reached only by automated processing, and for compensation of damage caused by unlawful processing.
You can delete your account yourself at /account/delete. For anything else, write to [email protected] or use the contact form with the topic "Privacy / KVKK request"; we answer within 30 days. If you are a club player without an account, you can also ask the club's owner to anonymize you. You may complain to the Personal Data Protection Authority (KVKK).
Changes
We update this notice when what we do changes. The date at the top shows the latest version. When you sign up we record which version you acknowledged.