Privacy Notice
Last updated: 17 October 2026
This notice explains what personal data Chess Quiz collects, why, and your rights. The data controller is Chess Duello Yazılım ve Oyun Teknolojileri A.Ş., KINIKLI MAHALLESİ HÜSEYİN YILMAZ CAD., PAMUKKALE ÜNİVERSİTESİ NO: 67 İÇ KAPI NO: 2, Denizli, Türkiye, TIN 2091870049 ("we"). Contact for privacy matters: info@chessduello.com. We act under the Turkish Personal Data Protection Law (KVKK No. 6698) and, for users in the EEA/UK, the GDPR/UK GDPR.
1. What we collect
| Who | Data | Purpose / legal basis |
|---|---|---|
| Players (no account) | Nickname, chosen avatar, answers, moves, times and scores during a game; a random session token kept in your browser so you can reconnect. | Run the game and show results to the host and other players. Contract / legitimate interest. |
| Hosts with an account | Email address, password (stored hashed by our authentication provider), display name, plan, account creation date. | Create and secure your account, provide the Service. Contract. |
| Saved games (signed-in hosts, and signed-in players) | Game settings, date, player count, each participant's nickname, avatar, final score and rank, and per-question detail (moves played, correct/incorrect, time taken, points). Per-question detail is kept on the server and is not displayed to users. | Show your game history; improve puzzle selection and difficulty and develop the Service. Contract / legitimate interest. |
| Paying customers | Subscription status, plan, renewal/cancellation dates and identifiers from Paddle. Paddle collects your name, email, billing address, tax details and payment details itself; we do not receive your full card number. | Provide paid plans, accounting and legal obligations. Contract / legal obligation. |
| Everyone | IP address and technical data (browser, device type, timestamps) in server and security logs. | Security, abuse prevention, troubleshooting. Legitimate interest. |
| Anyone who contacts us | Your message, email address and any details you provide. | Respond to you. Legitimate interest / contract. |
Anonymous players are only identified by the nickname they choose. Please do not use your real full name or other personal details as a nickname. We do not ask for or intentionally collect special-category data.
2. Cookies and similar storage
We use only essential browser storage (localStorage): to keep you signed in, and to let you rejoin a game after a refresh. We do not use advertising or analytics cookies or trackers. Because this storage is strictly necessary for the Service, no consent banner is shown. Paddle's checkout may set its own cookies when you pay.
3. Children
Chess Quiz is often used in classrooms and clubs. Players only enter a nickname and pick an avatar; no account, email or real name is required. Accounts and purchases are for people aged 16 or over. Teachers, parents and organisers who host games with minors are responsible for ensuring this use is appropriate and permitted, and for telling participants not to enter real names. If you believe a child has given us personal data without proper authorisation, contact us and we will delete it.
4. Who we share data with
We do not sell personal data. We share it only with service providers acting on our behalf, and when required by law:
- Supabase – database and authentication (accounts, saved games). Data is stored in the European Union.
- Fly.io – hosting of the game server and website (Frankfurt, Germany).
- Paddle.com Market Limited – merchant of record for payments, invoicing and taxes; Paddle acts as an independent controller for payment data under its privacy policy.
- RevenueCat and app stores – only if/when mobile subscriptions are offered.
- Professional advisers, authorities or courts where legally required.
Within a game, the host and other players can see nicknames, avatars, scores and rankings.
5. International transfers
Some providers may process data outside Türkiye or the EEA/UK (for example in the United States). Where this happens we rely on appropriate safeguards such as standard contractual clauses, adequacy decisions or, under KVKK, the mechanisms the law provides.
6. How long we keep data
- Active games exist in memory and are discarded when the game ends or after inactivity; anonymous games are not saved.
- Account data and saved game history: until you delete your account (or, if you are inactive, up to 24 months). Deleting an account removes your profile and history; where you appeared as a signed-in player in someone else's game, your record is anonymised.
- Billing records: as long as tax and accounting law require (generally 10 years in Türkiye).
- Server logs: up to 30 days.
7. Your rights
Under KVKK Art. 11 and the GDPR you can ask to: know whether we process your data and get a copy; have inaccurate data corrected; have data deleted; restrict or object to processing based on legitimate interests; receive your data in a portable format; withdraw consent where we rely on it; and be informed of recipients. Email info@chessduello.com; we answer within 30 days. You may also complain to the Turkish Personal Data Protection Authority (KVKK) or, if in the EEA/UK, your local supervisory authority. For subscription data held by Paddle, you can also contact Paddle directly.
8. Security
We use HTTPS, access controls and row-level security so users can only read their own data; plan changes are made only by verified payment webhooks; passwords are hashed by our authentication provider. No system is perfectly secure, and we will notify authorities and affected users of a breach as the law requires.
9. Changes
We may update this notice and will change the date above. For material changes we will notify you in the app or by email.