Privacy policy

1. Data controller

1.1. The controller of the data is the owner of EonChess. For any privacy-related matter, the User may contact the support email address shown at the end of this document.

1.2. This policy applies to the Platform's website, applications and Telegram bot.

2. Data processed

2.1. Registration and profile data: username, email address, country, language, profile picture and, if the User links them, their Telegram identifier and TON wallet address. Passwords are stored in hashed form and are never visible to the Platform.

2.2. Activity data: games, moves and time spent, results, ratings, challenges, in-game chat messages, disputes and communications with support.

2.3. Financial data: Balance and transactions, assigned deposit addresses, withdrawal addresses provided, amounts and blockchain transaction identifiers.

2.4. Technical data: IP address, country of connection, device and browser type, and access and security logs.

2.5. The Platform never requests or stores the private keys or recovery phrases of the User's wallets.

2.6. Sign-in with Google: if the User chooses to sign in with their Google account, EonChess receives from Google only their name, email address and profile picture (the "openid", "email" and "profile" scopes). No other Google account data, such as contacts, files, calendar or emails, is accessed.

3. Purposes and legal bases

3.1. Provision of the service: managing the account, organising and settling games, processing deposits and withdrawals and handling support requests. Legal basis: performance of the contract constituted by the Terms of Service.

3.2. Security and fraud prevention: protecting accounts, detecting cheating, multiple accounts and suspicious transactions, and applying territorial restrictions. Legal basis: the legitimate interest of the Platform and other users in a safe and fair environment.

3.3. Regulatory compliance: keeping financial records and responding to requests from competent authorities, including anti-money laundering obligations. Legal basis: compliance with legal obligations.

3.4. Communications: sending verification codes, account notices and, if the User enables them, challenge and activity notifications. Legal basis: performance of the contract and, for optional notifications, the User's consent, which may be withdrawn at any time from Settings.

4. Automated game analysis

4.1. Stake games are analysed with automated tools that compare, among other factors, move accuracy and time spent with the usual patterns of human play. These analyses serve only to flag suspicious cases; sanctions are always adopted after a review carried out by a person.

5. Recipients of the data

5.1. Data are disclosed only to providers of services necessary for the Platform, such as hosting, database, email delivery and messaging, who act on behalf of the Platform and are bound by confidentiality.

5.2. Deposits and withdrawals are recorded on the relevant blockchain, which is public and immutable. It shows the addresses, amounts and date of each transaction, but not the username or email address.

5.3. Data may be disclosed to authorities where there is a legal obligation or a valid request. Personal data are not sold or transferred to third parties for advertising purposes.

6. International transfers

6.1. Some providers may process data outside the User's country of residence. In such cases, the Platform seeks to ensure that appropriate safeguards are applied to protect the data in accordance with applicable regulations.

7. Retention periods

7.1. Account data are kept for as long as the account remains active. When it is closed, they are deleted or anonymised, except for those that must be kept by law.

7.2. The Balance transaction log is immutable and is kept for the period required by applicable accounting and anti-money laundering regulations.

7.3. Technical and security logs are kept for as long as necessary to investigate incidents and prevent fraud.

8. Public profile

8.1. The username, country, rating and finished games may be visible to other players. During a game, the opponent and spectators also see the name, country and rating of both players.

8.2. The User may make their profile private from Settings, in which case their game history is no longer shown to third parties.

9. Information security

9.1. The Platform applies technical and organisational measures to protect data, including encryption of communications, permission-based access control and confirmation of withdrawals by means of one-time codes.

9.2. No system is completely invulnerable. In the event of a security breach affecting personal data, the affected users and, where required by law, the competent authorities will be informed.

10. User rights

10.1. The User may request access to their data, its rectification or erasure, restriction of its processing and its portability, and may object to processing based on legitimate interest.

10.2. Requests should be sent to the support email address from the address associated with the account and are handled within a maximum of 30 days. Some data can be changed directly in Settings, where the account can also be closed.

10.3. If the User considers that their rights have not been properly respected, they may lodge a complaint with the competent data protection authority.

11. Cookies and local storage

11.1. The Platform uses only the cookies strictly necessary to keep the session signed in and to ensure security. Language, appearance, board and practice preferences are saved in the browser's local storage.

11.2. An analytics tool configured without cookies or persistent storage may be used to understand, in aggregate, how the service is used. No advertising or cross-site tracking cookies are used.

12. Minors

12.1. The service is not directed at persons under 18 and no data are knowingly collected from them. If an account belonging to a minor is detected, it is closed and its data are deleted, except for those that must be kept by law.

13. Google user data (sign-in with Google)

13.1. What data is received. Only if the User chooses to sign in with Google, EonChess receives from Google their name, email address and profile picture (the "openid", "email" and "profile" scopes). No other Google account data, such as contacts, files, calendar, emails or history, is requested or accessed.

13.2. How it is used. This data is used solely to create and authenticate the User's account, display their profile within the Platform and communicate with them about their account and its security. It is not used for advertising, to build commercial profiles or to train artificial intelligence models, and no person reads it unless necessary for security reasons, to comply with the law or with the User's consent.

13.3. Who it is shared with. Data received from Google is not sold or disclosed to third parties. It is processed only by the infrastructure providers strictly necessary to provide the service (hosting and authentication), who act on behalf of the Platform, or by authorities when required by law. The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

13.4. How it is protected. Data travels encrypted over HTTPS and is stored in a database with permission-based access control, so each user can only see their own private information. Staff access is restricted to what is strictly necessary.

13.5. Retention and deletion. Data received from Google is kept while the account remains active. The User may close their account from Settings or request its deletion by writing to the support email; personal data is deleted or anonymised within a maximum of 30 days, except what must be kept for legal reasons (for example, the accounting record of Balance movements).

13.6. How to revoke access. The User may withdraw the permission granted to EonChess at any time at https://myaccount.google.com/permissions.

14. Changes to this policy

14.1. This policy may be updated to reflect legal or service changes. The date of the last update appears at the top of the document, and material changes will be communicated on the Platform.