Privacy policy
Last updated 13 October 2026
We read public Chess.com games to make cards and reports. We don't use accounts, ads or tracking cookies. If you buy, we keep your email to send your report. Anyone can have their card removed by emailing [email protected].
1. Who is responsible
Chess Animal is run by
[OPERATOR_NAME not set],
a sole trader registered in the Netherlands.
Address: [OPERATOR_ADDRESS not set]
KvK (Chamber of Commerce) number: [OPERATOR_KVK not set]
VAT number: [OPERATOR_VAT not set]
Email: [email protected]
We decide how the data below is used, which makes us the "controller" under the GDPR.
2. What we use, why, and on what basis
| Data | Where it comes from | Why | Legal basis (GDPR) |
|---|---|---|---|
| Chess.com username and public games (moves, results, ratings, clock times, opponents' usernames, dates) | Chess.com's public API, not from you | To build the card and report for that username | Legitimate interests (Art. 6(1)(f)): the games are already public, and the result is a light, playful summary |
| Email address | You, at checkout (passed to us by Paddle) | To send your report link and resend it if you lose it | Contract (Art. 6(1)(b)) |
| Payment details | You, at Paddle's checkout | To take payment. We never see your card number | Contract; legal obligation (tax records) |
| Technical data (IP address, browser type, pages requested) | Your browser | To run the site, keep it secure, and limit abuse | Legitimate interests |
| Usage statistics (pages visited, clicks such as Share or Unlock, country, browser type) | Your browser and our server | To see which pages work and where people drop off. No cookies and nothing stored on your device: a visit is counted under a code made from your IP address, browser and a random value that changes daily and is deleted after two days, so we can't recognise you on another day or work back to your IP address. Your IP address is not sent to PostHog | Legitimate interests |
We do not make automated decisions with legal or similar effects. The animal is a game, not an assessment of a person.
3. The card can be about someone else
Anyone can look up any public Chess.com username, so a card or report can be about a player who has never visited us. That's why we only use public Chess.com data, and why any player can have their card and reports removed: email [email protected] with the username. We remove it and stop new cards and reports for that username, usually within a week. Parents or guardians can do this for a child.
4. Cookies
We set no tracking or advertising cookies. The site uses only cookies it needs to work: a one-minute cookie that remembers the username you just searched (to show its loading animation), and a security cookie on forms. Paddle's checkout may set its own cookies when you open it; see Paddle's privacy notice.
5. Who we share data with
- Paddle (Paddle.com Market Ltd, UK) sells the report to you as Merchant of Record: it takes payment, handles tax and fraud checks, and is a separate controller of your payment data (Paddle's privacy notice).
- Railway (Railway Corporation, US) hosts our servers and database, in the Netherlands.
- Cloudflare (Cloudflare, Inc., US) carries traffic to the site and protects it from attacks, so it handles your IP address.
- PostHog (data stored in the EU, Frankfurt) holds the usage statistics above, without cookies or IP addresses.
- Resend (Resend, Inc., US) sends the emails with your report link.
- Chess.com: to read a player's public games, either our server or your own browser asks Chess.com's public API for them. When your browser asks, Chess.com sees that request as it would any visit to its site. We send Chess.com nothing else.
- Authorities, where the law requires it.
We do not sell personal data.
6. Transfers outside the EU
Some of these providers are based in the UK or the US. For the UK we rely on the EU's adequacy decision; for US providers, on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.
7. How long we keep it
| Data | Kept for |
|---|---|
| Raw games fetched from Chess.com | 30 days after anyone last looked at that player, then deleted |
| Cards and purchased reports | As long as Chess Animal runs, so your link keeps working, or until the player asks for removal |
| Order records (email, amount, date) | 7 years, as Dutch tax law requires |
| Server logs | Up to 30 days |
| Removal list | As long as needed to respect the request (only the username) |
8. Your rights
Under the GDPR you can ask to see, correct, delete, restrict or move your data, and you can object to our use of it based on legitimate interests. For a card about you, objecting simply means we remove it. Email [email protected]; we reply within one month. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority where you live.
9. Children
Chess Animal is not aimed at children and shows no ads. Buyers must be 18 or older, or use a parent or guardian's payment. A parent or guardian can ask us to remove a child's card and reports at any time.
10. Security
All connections are encrypted (HTTPS), only the operator can reach the data, and report links are long random codes. No system is perfectly safe; if a breach puts you at risk, we will tell you and the authority as the law requires.
11. Changes
When this policy changes we update this page and its date, and email buyers about important changes.