Privacy Policy

This policy covers chess-arbiter.com, the Arbiter web application, the desktop application, and the public registration forms hosted for tournaments. It is issued by the individual operating Arbiter as a sole proprietorship (“we”, “us”).

Which role we play depends on whose data it is, and the distinction decides who you should approach with a request:

Everything below is data the Service actually stores. Some categories exist only if you use the feature they belong to.

About you, as an account holder

Inside your tournaments

Community

Posts, comments, reactions and the display name shown next to them. These are visible to other signed-in users.

What we never hold

• Card and bank details. Subscription payments go directly to our payment provider; we receive only the identifiers and status described above. Entry fees do not pass through the Service at all — candidates pay organisers directly.
• Your account password in readable form.
• Location beyond what an IP address implies, contact lists, or data from other sites you visit.

• From you — when you sign up, fill in your profile, create tournaments and use features.
• From candidates — when they submit a public registration form for a tournament.
• From other organisers — when someone invites your email address to their tournament, or records you as a norm recipient.
• From Google — if you choose Google sign-in.
• From FIDE and AICF — public player records retrieved when you run a membership analysis. We are not affiliated with either body.
• Automatically — technical data generated as you use the Service.

The legal basis column reflects the GDPR framing; under India's Digital Personal Data Protection Act, 2023 the equivalent grounds are your consent and certain legitimate uses.

We do not process your data for advertising, profiling or automated decision-making that produces legal effects, and we do not sell or rent personal data to anyone.

• Authentication cookies — set by our authentication provider to keep you signed in and to refresh your session. Strictly necessary; the Service cannot work without them.
• Theme preference — stored in your browser's local storage so light or dark mode persists. It never leaves your device.
• No advertising or cross-site tracking cookies, and no third-party analytics on the marketing site. Desktop app downloads are proxied through our own server, so the release host does not see your IP address.

Public registration forms set no cookies beyond what is needed to submit the form.

We share personal data only with the processors below, only for the purpose listed, and under contracts requiring them to protect it.

Other sharing

• With FIDE and AICF — running a membership analysis sends the player IDs you submitted to their public services in order to read the corresponding records.
• With your tournament members — everyone you add to a tournament sees its data at the level their role permits.
• With an organiser — if you register for a tournament, your entry goes to that organiser and their members.
• Legal and safety — where we are required by law, or where disclosure is necessary to establish or defend legal claims or to protect the rights and safety of users. We will notify you unless legally barred.
• Business transfer — if the Service is acquired or merged, data may transfer to the successor under this policy. We will notify you before it takes effect.

The Rulebook assistant is the only feature that sends data to AI providers. When you ask a question, the text of that question is converted into a search embedding, matched against the FIDE Arbiters' Manual, and the question plus the retrieved passages and your conversation history are sent to a large language model to compose an answer.

• Your content is not used to train models — ours, our providers', or anyone else's. We use these providers under API terms that exclude training on submitted data.
• Providers may retain submitted content briefly for abuse monitoring in line with their own policies.
• Your conversations are stored in your account so you can return to them, and you can delete a conversation at any time.
• No other feature — membership analysis, entries, prizes, norms — sends data to an AI provider.
• Because the request leaves our systems, do not paste player personal data, disciplinary details or anything confidential into the assistant.

Our providers operate globally, so personal data may be processed outside India — including in the United States and the European Union. Where data leaves the EU or UK, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision, together with the technical measures in section 10. Transfers from India are made in accordance with the Digital Personal Data Protection Act, 2023 and any restrictions notified under it.

You can ask us for details of the safeguards applying to a specific provider.

• Encryption in transit (TLS) and at rest for the database and file storage.
• Row-level security enforced in the database itself, so tournament data is reachable only by that tournament's members — not merely hidden in the interface.
• Role-based access per tournament (owner, editor, viewer), checked on every write and on document generation.
• Private storage buckets. Payment screenshots, prize lists, analysis reports and the manual are not publicly readable; they are served through short-lived signed links only.
• Encrypted FTP passwords — broadcast credentials are encrypted before they are stored and are never returned to the browser in readable form.
• Append-only audit logs, so a change to a tournament cannot be made to disappear.
• Least privilege — administrative database keys are server-side only and never exposed to the browser or the desktop app.
• Webhook verification — billing callbacks are signature-verified and deduplicated against a ledger.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority — including the Data Protection Board of India and, where the GDPR applies, the competent supervisory authority within 72 hours — as the law requires.

Under India's DPDP Act, 2023

• Access — a summary of the personal data we process about you and who it has been shared with.
• Correction and erasure — correct inaccurate or incomplete data, and have data erased where it is no longer needed and no law requires us to keep it.
• Grievance redressal — raise a complaint with our grievance officer (section 16), and escalate to the Data Protection Board of India if you are not satisfied.
• Nomination — nominate someone to exercise your rights if you die or become incapacitated. Email us to record one.
• Withdraw consent — as easily as it was given, where processing rests on consent.

Under the GDPR / UK GDPR

• Access, rectification and erasure.
• Restriction of processing, and objection to it.
• Portability — a machine-readable copy of data you provided. The Service's own Excel and XML exports cover most of this immediately.
• Withdrawal of consent, without affecting prior processing.
• Complaint to your local supervisory authority.

How to exercise them

Email hello@chess-arbiter.com from your registered address, or tell us enough for us to locate your records. We respond within 30 days, and will tell you if we need longer. We may ask you to verify your identity first, and there is no charge for a reasonable request.

Several rights are self-service: edit your profile in settings, export any tournament's data to Excel, delete a Rulebook conversation, remove a community post, or delete your account outright.

You can delete your account from the settings page. It signs you out, removes your authentication record, and cascades to your profile.

• Deletion is immediate and permanent. Export anything you need first — tournament exports, reports and generated documents cannot be recovered afterwards.
• Hand over tournaments first. If you are the sole owner of a tournament your co-arbiters still need, transfer ownership or add another owner before you delete, or their access goes with your account.
• What survives, and why: billing records are kept for the statutory period; audit log entries stay so a tournament's history remains intact for its other members, and norm recipient records keep the name and FIDE ID captured at issue so an already generated form stays reproducible. Community posts may remain visible detached from your profile.
• Backups rotate out within 30 days.

You did not create an account — you filled in an organiser's registration form. That organiser decided what to ask for and is responsible for how your details are used. We store them on their behalf.

• What is held about you: the details you entered (name, email, phone, FIDE and AICF IDs, date of birth, rating, category, answers to custom questions), any payment reference or screenshot you uploaded, and the status the organiser set for your entry.
• Who can see it: the organiser and the members they added to that tournament. Payment screenshots are private and opened only through short-lived signed links.
• What it is used for: processing your registration, verifying your payment, checking your federation membership, seeding the pairing program, and allocating prizes.
• To correct or delete it: contact the tournament organiser. If you cannot reach them, email us at hello@chess-arbiter.com with the tournament name and we will pass your request on and follow up.
• We never use candidate data to market to you, and never share it outside the processors in section 6.

Accounts are for arbiters and organisers and require you to be 18 or over. We do not knowingly let a child create an account; if we learn one has, we delete it.

Junior and age-category events mean tournament data routinely includes children — names, dates of birth and ratings submitted by an organiser or a parent. In that case the organiser is responsible for obtaining verifiable parental or guardian consent as required by the DPDP Act, 2023 and any other applicable law. We never use children's data for tracking, behavioural monitoring or advertising, and we do not process it for any purpose beyond running the tournament it belongs to.

A parent or guardian who wants a child's data corrected or removed should contact the tournament organiser, or us — we will route the request.

We update this policy as the Service changes. The “last updated” date at the top always reflects the current version. For material changes — a new category of data, a new processor, or a new purpose — we will notify you by email or in the app before they take effect. Continued use after that date means you accept the updated policy.

For any privacy question, request or complaint, including as our Grievance Officer under the DPDP Act, 2023 and as the contact for data protection matters under the GDPR:

hello@chess-arbiter.com
Arbiter, [CITY], India

We acknowledge grievances within 7 days and aim to resolve them within 30. If you are not satisfied, you may complain to the Data Protection Board of India or, where the GDPR applies to you, to your local supervisory authority.

See also our Terms of Service.