Privacy Policy

Last updated: 4 October 2026

This notice describes how the personal data of users who visit and use the site Chesspuzzle.club is processed, pursuant to Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended.

1. Data controller

The data controller is Davide Dalmonte, author and operator of the Chesspuzzle.club platform.

Privacy contact: [email protected]

2. Data we collect

We collect only the data strictly necessary for the platform to work:

2.1 Users who play (solvers)

Public nickname (chosen by the user)
Nationality (two-letter country code)
Email (required, for password recovery)
Password (stored encrypted with bcrypt — never kept in plain text)
Chess club (optional)
FIDE ID (optional)
Chess.com and Lichess nicknames (optional). If provided, they are shown on the public profile together with the ratings read from those platforms' public APIs.
Profile picture and gallery (optional)
Chess résumé, biography (optional)
Attempt results on puzzles (puzzles solved, times, dynamic Elo)
IP address at sign-up (anti-spam)
Technical cookies to recognise the profile (see Cookie Policy)

2.2 Club managers, instructors, etc.

Club name or public name
First and last name of the person in charge
Email for contact
Phone / contact (optional)
Tax code / VAT number (optional, for issuing accounting documents in the future)
Password (encrypted with bcrypt)
IP address e user agent at sign-up

3. Purposes of processing

Data is processed exclusively in order to:

provide the platform's features (playing, leaderboards, puzzle sharing)
manage user and administrator profiles (authentication, password recovery)
send service messages (e.g. generated credentials, password reset)
moderate the platform and protect it from abuse
produce aggregate statistics (number of players, puzzles, etc.)

4. Legal basis

Processing is based on:

Performance of the service requested by the user (Art. 6(1)(b) GDPR)
Legitimate interest of the controller in the security and operation of the platform (Art. 6(1)(f) GDPR)
Explicit consent for cookies that are not strictly necessary

5. Data retention

Data is kept for as long as the user's profile is active. Users may request deletion of their profile at any time, either from their personal page ("Delete profile") or by writing to the privacy address.

Registration data (IP, user agent) is kept for a maximum of 12 months for security purposes, after which it is deleted or anonymised.

6. Data recipients

Personal data is never sold or transferred to third parties.

For the service to work properly, data may be transmitted to parties acting as "processors" under Art. 28 GDPR:

Cloudflare, Inc. (United States) — CDN and DDoS protection provider, which also serves the chess library used by the board and the Turnstile anti-bot check on the sign-in and sign-up pages. It processes only network metadata (IP, user agent) for the security of the site.
Resend, Inc. (United States) — transactional email service (credentials, password reset). It receives only the email address and the content of the message.
Google LLC (United States) — the site's typefaces are loaded from Google Fonts: during loading, Google receives the visitor's IP address and the technical data of the request. No cookies are set and no profiling is carried out on our behalf.
Lichess (Switzerland) and Chess.com (United States) — only if the user chooses to link their account on those platforms. In that case the nickname provided is sent to their public APIs to verify that it exists and to read the ratings, which are then shown on the public profile. No other data from the Chesspuzzle.club profile is sent to them.

Providers based outside the European Union adhere to data transfer mechanisms compliant with the GDPR (Standard Contractual Clauses).

7. Rights of the data subject

Users have the right to:

Access their personal data
Rectify or update it
Erase it ("right to be forgotten")
Restrict its processing
Receive it in a portable format
Object to the processing
Lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it)

To exercise these rights, write to [email protected].

8. Security

Passwords are stored encrypted (bcrypt). Communications take place over HTTPS. Data is hosted on a dedicated server from Hetzner Online GmbH in the Helsinki data centre (Finland), therefore within the European Union.

9. Minors

The service is intended for users aged 14 or over. Users under 14 are asked not to register without the consent of a parent or guardian.

10. Changes to this policy

Any changes will be published on this page. The date of the last update is shown at the top.