Privacy Policy

1. Controller and contact

MateChess is operated by Individual Entrepreneur DALER ASHRAPOV, identification number 300483527, registered on 14 September 2026 with LEPL National Agency of Public Registry, Georgia.

For enquiries, event cancellations, refund requests, complaints, privacy requests or withdrawal of consent, contact MateChess through Telegram @matechesstbilisi or Instagram @matechess_tbilisi. Please include enough information to identify your account or event and describe your request. Send personal or payment information privately, not in public comments. You may also contact the organiser directly at an event.

2. Information we process

• Account and profile: name, username, email, password hash for email registration, verification status, session information and optional profile details such as an avatar or age. Google sign-in supplies the profile and email information made available through that sign-in.
• Participation: event registrations, games, results, ratings, challenges, social connections and puzzle activity where those features are used.
• Materials and communications: uploaded content, saved games, support requests and information supplied to the organiser.
• Payments outside the website: information needed to confirm and account for an event payment or refund, including transaction details supplied by you or your bank. The website does not collect card numbers or CVV codes.
• Technical information: IP addresses, request and device information, session cookies, browser storage, error and security logs.
• Event photography: recognisable images and records of the purposes you agreed to, and any withdrawal.

Disabled features may have historical records in the database, including previous reward balances or purchases. Their presence does not mean the features are currently available. Do not place identity documents, health information or other sensitive details in a public profile.

3. Purposes and legal grounds

We use account and participation information to provide the services you request and administer our agreement with you. Payment and accounting records are also processed where needed to meet legal obligations. Security, fraud prevention, service maintenance and dispute handling may rely on legitimate interests where necessary and proportionate to those interests and your rights.

Optional photographic publication and advertising use rely on the separate consent you give for those purposes. Direct marketing is not included in service or photographic consent. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. Required account information is necessary to supply the relevant account functions; optional photographic consent is not a condition of participation.

4. Public information

Profiles and event results may be accessible to visitors without an account. Names, usernames, avatars, ratings, results and other information displayed by the relevant public feature can be seen by others. Do not assume that a profile or a public participant list is private. Public information may be copied or shared by other people.

5. Providers, recipients and international processing

The main application and its locally connected PostgreSQL database are hosted on Oracle Cloud Infrastructure in the UAE East (Dubai) region, United Arab Emirates. Local database backups are maintained on that server. Cloudflare supplies DNS for matechess.app; DNS service does not itself mean that Cloudflare hosts the database.

Resend receives recipient addresses and message contents to deliver verification and password-reset emails. Google processes information when you choose Google sign-in. Banks process transfers outside the website. Authorised people assisting with service operation or events may access the information needed for their tasks. Information may also be disclosed where lawfully required by competent authorities.

If you consent to publication or advertising, images are disclosed through the selected Instagram, Telegram or MateChess website channels. Platform providers and their audiences may process information outside Georgia under the platforms' own terms.

Hosting in the UAE and using international providers involves processing outside Georgia. International transfers are subject to applicable Georgian requirements, including a lawful transfer basis and any required safeguards or authorisation. You may request information about the recipients and safeguards applicable to your data through Telegram @matechesstbilisi or Instagram @matechess_tbilisi. Accepting the Terms or this Policy is not a separate consent to unrestricted international transfers.

6. Cookies and browser storage

The website uses session cookies for authentication and security mechanisms for requests. Local storage and session storage hold preferences, such as language, and information needed by the interface. A service worker may cache website files for loading and installed-app functionality.

You can clear cookies and browser storage in your browser settings; doing so may sign you out or reset preferences. Clearing your browser does not delete server-side account information. Any future optional advertising or analytics tracking will be described separately and, where required, enabled only after consent.

7. Retention and security

We retain account and participation records while they are needed to provide the service and maintain an accurate playing history. When data is no longer needed, it should be deleted or anonymised, unless retention is necessary for a legal obligation, a specific dispute or another applicable lawful purpose.

Retention is determined by the purpose, account status, age and relevance of a record, applicable accounting requirements, outstanding disputes and the need to demonstrate consent or honour a withdrawal. Event images are kept and used only while relevant to the agreed purpose and subject to withdrawal; unused images should not be kept merely because storage is available. You can ask for deletion or information about the retention applicable to your records.

Automated local database backups are configured with an approximately 30-day rotation. Deletion from active records may not immediately remove a record from an existing backup. Backups require restricted access and removal through the applicable rotation, with previous deletion decisions reapplied if a backup is restored. We do not promise that every historical or separate copy is automatically erased on an exact day.

Passwords are hashed and access is controlled through authentication and permissions. These measures reduce risk but do not guarantee absolute security.

8. Adults only

MateChess accounts and events are for people aged 18 or older. We do not offer registration or participation for children through their parents. If we learn that an account belongs to a minor, we will consider restricting access and deleting or limiting the processing of the information, subject to applicable requirements. The age restriction does not remove obligations concerning data already received.

9. Photography and promotional use

Our publication channels are Instagram @matechess_tbilisi, Telegram @matechesstbilisi and matechess.app. Before recognisable event photography for publication or promotion, participants are asked to make separate voluntary choices for event reports and advertising. You may accept either, both or neither. Advertising may include promotional posts and paid promotion on the listed platforms, where agreed. No permission to name or tag your personal account is implied.

Refusing does not prevent participation. Attendance, payment, a general photography sign or acceptance of the Terms does not itself constitute photographic consent. Group photographs must respect the choices of all recognisable participants.

You may withdraw consent through Telegram @matechesstbilisi or Instagram @matechess_tbilisi or by telling the organiser directly at an event. We stop new use for the withdrawn purpose and remove or anonymise material on channels we control within the applicable legal period, unless a different lawful basis requires retention. We cannot guarantee removal of independent copies made by other people. Withdrawal does not make earlier lawful use unlawful.

Records of consent and withdrawal may be retained as necessary to respect your choice and demonstrate compliance. Advertising emails and private marketing messages require a separate choice; operational account emails are not that choice.

10. Your rights and complaints

Subject to applicable law, you may request information about processing, access and a copy of your data, correction, deletion, restriction or blocking, withdrawal of consent and other rights available under Georgian law. We may require proportionate verification of identity. We respond within the time required by law and explain any lawful reason for refusing or limiting a request. A missing account-deletion button does not remove your right to make a request.

You may submit a complaint to the competent data-protection supervisory authority in Georgia, the State Audit Office, or seek a remedy in court. You do not have to resolve a complaint with us first.

11. Changes

We publish the date and version of this Policy and communicate material changes through available service communications. Updating a policy does not replace a separate consent where one is required.