Privacy policy
JagChess is a platform chess clubs use to run puzzles, events, attendance, tournaments and rewards. This page says exactly what the site collects, where it is kept, who is able to see it, and how to get it deleted.
Who runs JagChess
JagChess is run by the North Creek Chess Club. It is a student-built, student-run project, not a company. The site is hosted on Google Firebase Hosting and its data lives in Google Cloud Firestore.
Each club on JagChess controls its own space — its members, its puzzles, its events and its registration form. When you join a club, that club's admins become responsible for how they use what you give them, alongside us.
What we collect
Your account
You sign in either with an email address and password, or with Google. In both cases we store an account record containing:
- your email address;
- a display name — taken from your Google account or from the part of your
email before the
@, and changeable afterwards; - an account ID issued by Firebase Authentication;
- an avatar colour, picked for you;
- which clubs you belong to and your role in each one;
- when the account was created and when it was last used.
Passwords. If you sign up with a password, it is handled entirely by Firebase Authentication and is never stored by JagChess. We cannot read it. If you sign in with Google, no password reaches us at all.
What you do in a club
Clubs run on activity, so the things you do are recorded against your membership:
- Puzzle attempts — which puzzle, when you finished it, how many moves you used, how long it took, and the points awarded;
- Points and streaks, including your current and longest streak;
- Games and tournaments you take part in, and their results;
- Event attendance, where the club runs attendance through the site;
- Reward orders, if the club runs a points shop;
- Puzzles you build, and the club you publish them to.
Club registration and attendance forms
A club's registration form always asks for your first name, last name and email address. Beyond those three, a club's admins can add up to twenty questions of their own — a grade, a rating, how you heard about the club, and so on. We do not control what a club asks. Answers go to that club, and its admins can read them.
Attendance forms work the same way, and ask for your name and email only if you are not already signed in.
Connected accounts
Two integrations are optional and only ever start when you press the button for them:
- Lichess. If you connect a Lichess account, we store your Lichess username, which permissions you granted, and when you linked it. The access token itself stays in your own browser and is never written to our database or sent to any JagChess service.
- Gmail, for club admins. An admin sending a newsletter connects their own Gmail account, and messages go out from their own address. We store which mailbox is connected. We never read your mail — the permission granted only allows sending.
Analytics
We use Google Analytics to count visits and understand which parts of the site get used. It records ordinary web analytics — page views, session starts, first visits and engagement time — along with the usual technical details a browser sends, such as approximate location by region, device type and referring page. When you are signed in, your account ID is attached to these events so a returning visitor can be told apart from a new one.
How it is used
What we collect is used to run the site and nothing else:
- to sign you in and keep you signed in;
- to show your club its members, leaderboards, streaks and results;
- to score puzzles and award points;
- to let clubs run registration, attendance, events, newsletters and rewards;
- to keep the site working, and to understand how it is used in aggregate.
We do not sell your information, and we do not use it for advertising. There are no advertising trackers on JagChess.
Who can see it
| Who | What they can see |
|---|---|
| Other members of your club | Your display name, avatar colour, points, streaks and position on the club leaderboard. |
| Your club's admins | All of the above, plus your email address, your role, your attendance, your reward orders and your answers to that club's registration form. |
| Anyone on JagChess | Puzzles and collections your club has chosen to share publicly, including the name of the person who built them. Clubs listed on the JagChess Network are public by design. |
| Site operators | Technical access to the database, used for running and fixing the site. |
We do not share your information with anyone else, except the service providers listed below and where we are required to by law.
Google user data
Some of what JagChess handles comes from your Google Account, so this section sets out on its own exactly what we ask Google for, why, what we do with it and where it goes. These are the only Google permissions JagChess ever requests.
Signing in with Google
Requested when you press Continue with Google, and only then. JagChess asks for two things:
openidanduserinfo.email— your email address;- basic profile — your name and profile picture URL.
How it is used. Your email address identifies your account, lets a club match you to an invitation or registration it already holds, and lets your club's admins contact you. Your name becomes your display name on leaderboards and member lists, and you can change it.
How it is stored. Both are stored in our Firestore database against your account, and your email is copied onto your membership record in each club you join.
How it is shared. It is not. Your name is visible to other members of clubs you join, and your email address to those clubs' admins. It goes to nobody else.
Gmail, for club admins who send newsletters
Requested only when an admin presses Connect Gmail in the Newsletters panel. Nobody else is ever asked, and an admin who never sends a newsletter is never asked either. The permissions are:
gmail.send— permission to send a message as you. It does not grant permission to read, search, delete or modify anything in your mailbox, and JagChess does not do those things;userinfo.emailanduserinfo.profile— so the page can show you which mailbox is connected.
How it is used. Solely to send the newsletter you wrote, to the recipients you chose, at the moment you press send. Your club's mail goes out from your own address and against your own Gmail quota rather than a shared platform mailbox.
How it is stored. The access token is held by your browser for the session in which you use it. We store the address of the connected mailbox so the panel can display it. We do not store the contents of your mailbox, because we never receive them.
How it is shared. It is not shared with anyone. You can disconnect at any time, and revoke the permission yourself at myaccount.google.com/permissions.
Limited Use. JagChess's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not transfer it to third parties except as needed to provide or improve JagChess or to comply with the law, and we do not allow humans to read it except with your explicit consent, for security purposes, to comply with the law, or where the data has been aggregated and anonymised.
Other services
JagChess is built on services run by other companies. Using the site means data passes through them, under their own privacy policies:
| Service | What it does here | Policy |
|---|---|---|
| Google Firebase | Hosting, sign-in and the database where everything above is stored. | firebase.google.com |
| Google Analytics | Counts visits and page views. | policies.google.com |
| Google Sign-In | Signing in with a Google account. We receive your email address and name. | policies.google.com |
| Lichess | Optional. Linking a Lichess account, and playing or joining tournaments there. | lichess.org/privacy |
| Google Fonts | Loads the site's typefaces. | policies.google.com |
Cookies and browser storage
JagChess does not use advertising or tracking cookies. What it does keep in your browser is:
- Your sign-in session, held by Firebase Authentication so you are not asked to log in on every page;
- Your theme choice, light or dark;
- Your Lichess token, if you connected Lichess — in your browser only;
- Google Analytics cookies, which count visits.
Clearing your browser's site data removes all of these. Blocking Google Analytics — with an ad blocker or your browser's tracking protection — stops analytics events leaving your browser and does not otherwise affect the site.
How long it is kept
Your account and club records are kept for as long as your account exists. Deleting your account marks it deleted and ends your access; club records such as past attendance, results and registration answers may stay with the club that collected them, because they are part of that club's own history.
When a club is deleted, its members, events, puzzles, attendance and orders are deleted with it. Google Analytics data is kept according to the retention period set on the Analytics property.
Your choices
- See or correct your information. Your display name and avatar are editable in the site. For anything else, ask us or a club admin.
- Leave a club. You can leave a club at any time, which removes you from its member list.
- Disconnect Lichess. The Disconnect button revokes the permission at Lichess and forgets the token.
- Delete your account. Email us at the address below and we will delete it.
- Opt out of analytics. Use your browser's tracking protection or an ad blocker, or Google's opt-out add-on.
Depending on where you live, you may have further rights over your personal information, such as asking for a copy of it or asking for it to be erased. Write to us and we will do what we can.
Students and younger players
JagChess is built for school and scholastic chess clubs, so many of its users are students. Accounts are created by a person joining a club, and clubs are expected to follow whatever rules their school or organisation has about collecting student information and about parental consent where it is needed.
If you are a parent or guardian and you would like to see what we hold about your child, or have it deleted, contact us at the address below and we will act on it.
Security
Sign-in is handled by Firebase Authentication. Access to the database is governed by security rules that decide what each signed-in person is allowed to read and write — for example, only a club's own admins can read that club's registration answers. All traffic to the site is encrypted over HTTPS.
No system is perfectly secure, and we cannot promise that it is. Please use a password you do not use anywhere else, or sign in with Google.
Changes
If this policy changes, the date at the top of this page changes with it. Significant changes will be announced in the site.
Contact
Questions about this policy, requests to see or delete your information, or anything else privacy-related: northcreekchessclub@gmail.com.
If your question is about a particular club — what it asked on its registration form, or what it does with attendance — that club's admins are the fastest people to ask.