Privacy Policy

Short version: the tournament app runs on your device and keeps your tournament data there. You do not need an account to use it. We measure how the website and app are used, without names or tournament contents. If you choose to publish results, create an account, or subscribe to a club page, that information is described in full below.

1. Who we are

Chess Caddy is run by Citrusync, which is responsible for (the "controller" of) the personal information described here. This policy covers the website chesscaddy.com, the web app at chesscaddy.com/app, and the Chess Caddy apps for iPhone, iPad and Android, which show that same web app. Contact: support@chesscaddy.com.

2. The app itself

The tournament details you enter — player names, ratings, pairings and results — are saved only in your device's browser storage, which is what lets the app work with no internet connection. That data is not sent to us. You can delete it at any time with "Start over" in the app, or by clearing your browser or app storage.

You can export a tournament to a file to back it up or move it to another device. That file is yours and goes wherever you send it.

3. Analytics and session recordings

We use two tools to understand how Chess Caddy is used, so we can fix what is confusing and build what is missing. Neither is used for advertising, and neither receives player names, tournament contents, or anything else you type into the app.

• Google Analytics 4 counts visits and records anonymous events such as "a tournament was started", "a round was generated" (with the round number and how many players) or "a tournament was completed", plus whether you are using the website, the iPhone app or the Android app. Google Analytics 4 does not store IP addresses.
• Microsoft Clarity records how pages are used — clicks, taps, scrolling and page layout — as heatmaps and replayable sessions. It is set to mask all text on the page before anything leaves your device, so recordings show where people tapped, not what the page said or what was typed.

Outside the places listed below, both tools use cookies or similar storage (Google Analytics: _ga cookies; Clarity: _clck and _clsk) to tell one visit from the next.

If you are in the EU, EEA, UK or Switzerland

We do not ask you for consent, because we do not need it: if your device is set to a time zone in those countries, or Google locates your connection there, Google Analytics runs without cookies and Clarity does not load at all. Google then receives only cookie-free, anonymous measurements.

Opting out anywhere

You can block both tools with any standard content blocker, or use Google's opt-out browser add-on. The app works exactly the same without them.

4. Publishing a tournament

The app has a Publish button. It is never automatic — nothing is uploaded unless you tap it. When you do, a copy of that tournament (player names, ratings, pairings, results) is stored on our server and put on a web page with an unguessable address, for example chesscaddy.com/t/k3f9q2xa. You do not need an account to publish.

• Published pages are unlisted. The address cannot be guessed, there is no public directory of them, and they carry instructions telling search engines not to list them.
• You are given an edit key when you publish. It lets you update or remove the page, and it is the only way to do so. Keep a copy.
• There is an initials-only option that publishes "J. B." instead of full names. It is applied on our server, so full names are never sent to anyone viewing the page.
• You can remove a published page at any time from the same dialog.

Publishing other people's names

When you publish a tournament you are publishing information about the people in it. Please make sure you are entitled to do so. For events involving under-18s we strongly recommend leaving initials-only turned on, and obtaining parental or guardian consent before publishing full names. See section 8.

5. Accounts

You only need an account if you want a club page. To create one we store your email address and the dates you signed up and last signed in. There is no password: to sign in, we email you a six-digit code (and a one-time link) that works once and expires after 15 minutes. Signing in keeps you signed in on that device for up to 60 days.

We use your email address to send sign-in codes and essential messages about your club page or subscription. We do not send marketing email and we do not sell, rent or share your address.

6. Club pages, the free trial and the ladder

When you create a club page we store what you enter about the club (name, description, meeting times, location, contact details, logo) and a club roster — a list of player names built from the tournaments you file under the club, along with the club ratings calculated from their results. We also count how many times the page is viewed (a number only — we do not record who viewed it).

New club pages start with a 60-day free trial that needs no card. When it ends the page becomes private unless you subscribe; nothing is deleted. A club page is public at chesscaddy.com/club/your-club while the trial or subscription is active. Club pages are not listed in search engines unless you deliberately turn that on, and for any club marked as a school or junior club that option is switched off and cannot be enabled.

7. Payments

We never see or store your card details.

• On the web, subscriptions are handled by Stripe. Your card details go directly to Stripe. We keep your Stripe customer and subscription identifiers, which plan you are on, and whether the subscription is active.
• In the iPhone and iPad app, subscriptions are handled by Apple through your Apple ID. Apple tells us a transaction identifier, which plan you bought, and whether it is active. We do not receive your name, Apple ID or payment details.

That is enough to know whether your club page should be switched on, and nothing more.

8. Children's data

Chess Caddy is a tool for tournament organisers, and we expect our users to be adults. School and junior clubs are, however, a normal use of the product, so children's names can end up in a published page.

Because of that:

• Anything marked as a school or junior club defaults to initials only, and its tournament pages inherit that setting.
• School and junior club pages can never be listed in search engines.
• Published pages are unlisted and carry search-engine exclusion instructions by default.
• We will remove a named individual from a published page on request, from anyone with a legitimate interest, without requiring an account. Email support@chesscaddy.com.

We do not knowingly create accounts for anyone under 18. If you believe a child's information has been published without appropriate consent, email us and we will remove it promptly.

9. Who else processes your data

We use a small number of service providers. Each one only receives what it needs to do its job.

Provider	What it does	What it sees
Netlify	Serves the website and app	Standard web request data, such as IP address
Cloudflare	DNS, and the server behind publishing, accounts and club pages	Published tournaments, account emails, club and roster data, IP address
Stripe	Web subscription payments	Your name, email, billing address and card details
Apple	In-app subscription payments on iPhone and iPad	Your Apple ID and payment details (held by Apple, not shared with us)
Resend	Sends sign-in and billing emails	Your email address
Forward Email	Forwards mail sent to support@chesscaddy.com	Whatever you write to us
Google Analytics	Anonymous usage statistics	Pages viewed, device type, approximate location, anonymous feature events (IP addresses are not stored)
Microsoft Clarity	Heatmaps and masked session recordings (not in the EU, EEA, UK or Switzerland)	Taps, clicks, scrolling and page layout with all text masked, device type, IP address

These providers process data in the United States and elsewhere. We do not sell personal information to anyone, and we do not use it for advertising.

10. How long we keep things

• Tournaments in the app — on your device, until you delete them.
• Published tournaments — until you remove them, or until the account they belong to is deleted.
• Account and club data — until you delete your account.
• Sign-in codes and links — they stop working after 15 minutes and are deleted within two days.
• Anti-abuse counters (the email or IP address behind a sign-in or publish request, used to stop spam) — deleted within a day of the hour they count.
• Analytics — Google Analytics keeps event-level data for 2 months and user-level data for 14 months (plain totals, such as visits per day, are kept longer); Clarity keeps recordings for 30 days, and heatmaps and any recording we save for later review for 13 months.
• Payment records — kept by Stripe or Apple for as long as the law requires them to.

11. Your choices and rights

You can, at any time:

• Use the whole app without giving us anything you type — no account, no publishing.
• Remove a published page from the Publish dialog in the app.
• Delete your account — see how to delete your account. This removes your account, your clubs, your ladders and every tournament page you published, and cancels a web (Stripe) subscription first. It cannot be undone. A subscription bought in the iPhone or iPad app is billed by Apple, so cancel it in your Apple ID settings too.
• Ask for a copy of your data, or ask us to correct or delete it, by emailing support@chesscaddy.com.

Depending on where you live you may have additional rights over your personal information — for example under the UK and EU GDPR, or under California law — including the right to object to our analytics and to complain to your local data protection authority. We will honour those requests regardless of where you are. Email us and we will respond within 30 days.

Our lawful bases, for those who need them: running the account, publishing and club features you asked for (contract); keeping the service secure and understanding how it is used, with the protections in section 3 (legitimate interests); and keeping payment records (legal obligation).

12. Security

Everything travels over an encrypted connection. Sign-in codes, session tokens and publish edit keys are stored only as cryptographic hashes, so a copy of our database could not be used to sign in as you or to delete your pages. No system is perfect, and we will tell affected users promptly if something goes wrong.

13. Changes to this policy

If this policy changes, the updated version is posted here with a new "Last updated" date. If a change materially affects how we handle your information and you have an account, we will email you.

14. Contact

Questions, requests, or a takedown: support@chesscaddy.com.