Privacy Policy

Your Data, Your Move

Last Updated: The 24th of June 2026 · Effective Date: The 1st of December 2025

Overview

CHESSBIT S.A. (“ChessBit”, “we”, “us”, “our”) operates the website https://chessbit.io (“Site”) and provides the Early Access Waitlist for the upcoming ChessBit platform, a skill-based real-money chess competition system (not gambling). We are committed to protecting your privacy and handling personal data transparently, securely, and in compliance with applicable laws, including Panama Law 81, GDPR, and UK GDPR.

Data Controller

CHESSBIT S.A.
50th Street, PH Plaza 2000, 17th Floor
Panama City, Republic of Panama
Organization No.: 155773499
Email: info@chessbit.io

We do NOT

  • Sell personal data
  • Share data with advertisers
  • Collect financial data or gameplay data on this site

Personal Data We Collect

a) Data You Provide Directly

Email address (required), country, preferred chess formats, chess level, main platform, X handle, age confirmation (18+), marketing consent (optional), invite code, email verification token, resend attempts metadata, and honeypot field (website). If you use our contact form, we also collect the name, email address, subject, and message you submit.

b) Data Collected Automatically

Hashed IP (never stored raw), user agent, Turnstile anti-bot token, timestamps, rate-limit flags.

c) Data Generated by Our System

Email verification status, invite link usage, abuse detection results. We do not collect financial data, passwords, or gameplay data on this site.

d) Analytics & Usage Data (only with your consent)

If you accept analytics cookies, we and our analytics providers (Google Analytics 4 and PostHog) collect how you use the Site: pages and sections viewed, clicks, scroll depth, video engagement, FAQ and tab interactions, approximate device and browser information, and first-touch attribution (referrer and UTM parameters, and whether a Google/Meta click ID or invite link was present). This also includes heatmaps and session replay via PostHog — a privacy-masked recording of on-page interactions in which all form inputs are masked, so what you type (for example your email) is never captured. We do not use this to identify you on this Site, and nothing runs until you consent.

Independently of consent, our hosting provider Vercel counts page views in aggregate (Vercel Web Analytics). This is cookieless: no cookie or other identifier is stored on your device, no cross-site tracking takes place, and the data cannot be used to identify you. We use it only to know how many people visit the Site.

How We Use Your Data

  • Manage the early access waitlist (registration, invite tracking, eligibility)
  • Send transactional emails (verification, early access notifications)
  • Marketing communication (only if you opt-in)
  • Fraud prevention and platform security (Turnstile, IP hashing, abuse detection, rate limiting)
  • Respond to enquiries submitted through our contact form
  • Analytics, product analytics, and session replay (privacy-masked) — to understand usage and improve the Site (only with your consent)

Legal Bases (GDPR)

Waitlist registration: Contractual necessity (Art. 6(1)(b))

Email verification: Legitimate interest (Art. 6(1)(f))

Security & anti-bot: Legitimate interest (Art. 6(1)(f))

Marketing emails: Consent (Art. 6(1)(a))

Analytics & session replay: Consent (Art. 6(1)(a))

Contact form: Legitimate interest (Art. 6(1)(f)) — to respond to your enquiry

Retention

  • Email, preferences, country: Until deletion request or 24 months after inactivity
  • Email verification tokens: 48 hours
  • IP hash & abuse logs: 6–12 months
  • Marketing consent: Until withdrawn
  • Backend logs: 90 days

Sharing

  • Mailtrap (email delivery)
  • Cloudflare Turnstile (anti-bot)
  • Vercel, Render, Cloudflare (infrastructure/security)
  • MongoDB Atlas (database)
  • Google LLC — Google Analytics 4 & Google Tag Manager (analytics; United States), only with your consent
  • PostHog — product analytics, heatmaps & session replay (EU-hosted), only with your consent

Analytics providers only receive data after you consent to analytics cookies. All providers are GDPR-compliant or use SCCs — Google processes data in the United States under Standard Contractual Clauses, while PostHog is hosted in the EU. We never share data with gambling companies, advertisers, or data brokers.

Data Transfers

Data may be processed in Panama, United States, or EU regions. Transfers follow SCCs, GDPR safeguards, and minimal data transfer principles.

Your Rights

Access, correction, deletion, withdraw consent, export, restriction, object, and complain to an EEA authority. Email: info@chessbit.io

Security Measures

  • Cloudflare Turnstile
  • IP hashing (no raw IP stored)
  • HTTPS everywhere
  • MongoDB Atlas encryption
  • Rate limiting and abuse detection
  • Minimal data collection

No system is 100% secure, but we adhere to industry-standard protections.

Children’s Privacy

ChessBit is strictly for users 18+. We do not knowingly collect data from minors. If you believe a minor provided data, contact info@chessbit.io.

Changes

We may update this policy and will post material changes here.

Contact

CHESSBIT S.A.
50th Street, PH Plaza 2000, 17th Floor
Panama City, Republic of Panama
Email: info@chessbit.io