Legal

Privacy Policy

Last updated: May 2026 · Effective from: May 2026

    Summary (plain language)
    QueenDash does not sell your data, does not show ads and does not track you across other websites.
    You can use the entire platform without creating an account. If you do register, we only store what
    you provide (email, username) and you can delete your account at any time.
  

1. Who we are

QueenDash (queendash.com) is an independent chess data platform. For the purposes of the GDPR and applicable data protection law, the data controller is:

QueenDash
Email: [email protected]

2. Data we collect

2.1 Visitors without an account

If you use QueenDash without registering, we do not collect any personal data. Our server (Hetzner, Nuremberg, Germany — EU) records standard HTTP access logs (IP address, browser, pages visited) for security and debugging purposes. These logs are automatically deleted after 7 days and are never used for profiling or marketing.

2.2 Registered users

When you create an account, we collect and store:

Email address — used to identify your account and for password reset.
Username — chosen by you, displayed in the interface.
Password — stored as a salted bcrypt hash. We never store your plain-text password.
Optional platform usernames — Chess.com, Lichess and/or FIDE ID that you voluntarily link to fetch your stats.
Preferences — display language, UI theme (dark/light), puzzle ELO. Stored to personalise your experience.

We do not collect payment information, phone numbers, location data or any special category data (health, ethnicity, etc.).

3. How we use your data

We use registered-user data exclusively for:

Providing and maintaining your account.
Fetching your chess stats from Chess.com and Lichess APIs (only if you link those accounts).
Saving your preferences so they persist across sessions.
Responding to support requests you initiate.

Legal basis (GDPR Art. 6): contract performance (Art. 6(1)(b)) for account features; legitimate interest (Art. 6(1)(f)) for server logs; consent (Art. 6(1)(a)) for optional platform linking.

4. Data sharing and third parties

We do not sell, rent or share your personal data with third parties for marketing.

Data is shared only with the following infrastructure providers under GDPR-compliant agreements:

Hetzner Online GmbH (Germany, EU) — server and database hosting.
Chess.com / Lichess — we query their public APIs on your behalf only when you link those accounts. We do not send them your QueenDash credentials.
FIDE — we use their publicly published monthly rating lists (XML). No personal data is sent to FIDE.

5. Data retention

Server logs: 7 days, then automatically deleted.
Account data: retained while your account is active. Deleted within 30 days of account deletion request.
Preferences and linked platform usernames: deleted with your account.

6. Your rights (GDPR)

If you are in the EU/EEA, you have the right to:

Access — request a copy of all data we hold about you.
Rectification — correct inaccurate data.
Erasure ("right to be forgotten") — request deletion of your account and all associated data.
Portability — receive your data in a machine-readable format (JSON).
Restriction — ask us to stop processing your data while a dispute is resolved.
Objection — object to processing based on legitimate interest.
Withdraw consent — at any time for processing based on consent (e.g. platform linking).

To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your national supervisory authority (in Spain: AEPD).

7. Cookies and local storage

See our Cookie Policy for full details. In brief: we use a session cookie for login, and browser localStorage for theme/language preferences. No third-party tracking cookies.

8. Security

All data is transmitted over HTTPS (TLS 1.2+). Passwords are hashed with bcrypt (cost factor 12). The database is not publicly accessible. We apply security updates regularly.

9. Children

QueenDash is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it promptly.

10. Changes to this policy

We may update this policy when we add new features. We will post the updated date at the top and, for material changes, notify registered users by email. Continued use after changes constitutes acceptance of the updated policy.

11. Contact

For any privacy-related question or to exercise your rights:
[email protected]