Privacy Policy — Chess Baithak

1. Who we are

Chess Baithak ("Chess Baithak", "we", "us") provides a mobile application and website that help chess players find each other and arrange over-the-board matches at public venues in Pakistan.

For the purposes of data protection law, the data controller is ChessBhaitak (PVT) Ltd., 42 Main Rd, Gujjar Arcade, Soan Gardens Block H Extension, Islamabad, Pakistan. You can reach us at any time at [email protected].

This policy covers the Chess Baithak Android application (package com.chessbaithak.app) and the website at chessbhaitak.com. It does not cover the third-party services the app relies on — Google Sign-In, Google Firebase, OpenStreetMap and our hosting providers — which have their own privacy policies. Section 7 sets out what each of them receives.

2. Data we collect

We collect only what the service needs to work. We do not buy personal data from third parties, and we do not sell your personal data.

Category	What it includes	Why we collect it
Account & identity	Email address (used to sign in, either directly or through Google Sign-In), display name, and — if you choose to add them — profile photo, phone number, and the city and area you play in.	To create and secure your account, and to let hosts recognise a confirmed opponent.
Player profile	Your rating, weekly availability, whether you own a chess board, preferred formats and optional rating band.	To match you with suitable opponents and show relevant open invites.
Approximate location	A coarse, approximate position while the app is open. See section 3.	To show players, open invites and venues near you, sorted by distance.
Match activity	Invites you publish or join, check-ins, results, no-shows, Elo history (K=32), and the venues where matches took place.	To run matches, maintain accurate ratings, and keep a reliable player record.
Peer feedback	Ratings other players give you for sportsmanship and punctuality, and the ones you give them.	To maintain community trust and safety.
Support messages	Your name, email address, topic and message when you contact us through the website form or by email.	To answer your question and keep a record of the exchange.
Technical & diagnostic	Crash reports (the error, its stack trace, your device model and operating system version) and app-usage events such as screens opened, sign-in method, and whether a match was created or joined. These are collected by Google Firebase Crashlytics and Google Analytics for Firebase, and are linked to your account identifier. Our hosting providers additionally keep standard request logs — IP address, timestamp and requested URL.	To find and fix crashes, and to understand which parts of the app are used so we can improve them. Not used for advertising.
Safety reports	If you report another player: the category you choose, anything you write, and a record of who you reported. If you are reported: a copy of your profile name, city, area, email address and phone number as they were at that moment.	To review reports of harassment, fraud and child safety concerns, and to report to the authorities where the law requires it. See sections 8 and 12.

What we deliberately do not collect

Your contacts. Chess Baithak never requests access to your address book, and never uploads your contact list.
Background location. We do not track your position when the app is closed or in the background.
Precise home location. Map pins mark public venues, never players' homes.
Special-category data. We do not ask for or knowingly store data revealing health, religion, ethnicity, political opinions or biometric identifiers.

3. Location data

Location is the most sensitive thing the app touches, so we are specific about it.

Location is collected only while the app is in the foreground and you are actively using it. There is no background collection and no location history trail.
We request approximate location permission. Your position is rendered to other users as a soft ring covering a wide area, never a precise dot.
Proximity search runs against venue coordinates, so results tell you how far a venue is — they do not disclose where any player is standing.
Before Android asks for the permission, the app shows you a plain-language explanation of what it collects and why. Declining that explanation means the permission is never requested at all.
When you search for a place to play, your approximate coordinates are sent to the OpenStreetMap Overpass API to find nearby cafés, parks and libraries. This is a third party — see section 7.
When you first set up your profile, the app can use your approximate position to suggest your city and area so you do not have to pick from a list of three hundred. To turn the coordinates into a place name, your device passes them to its own built-in map service, which on most Android phones is provided by Google Play Services.
Only the resulting city and area are saved. The coordinates themselves are used to work out the name and then discarded — your profile stores "Lahore, Model Town", never a latitude and longitude.
The suggestion is only a suggestion. Both fields stay fully editable and searchable, so you can correct them, and you can complete your profile normally if you decline location or your device cannot get a fix.
You can refuse or later revoke location permission in your device settings. The app still works: you can browse venues and invites by area and by name, you simply lose distance sorting.

4. How we use data

To create your account and sign you in, using Google Sign-In or an email address and password.
To show nearby players, open invites and chess-friendly venues.
To publish, book and manage matches, including check-in and results.
To calculate and update Elo ratings and display match history.
To operate the sportsmanship and punctuality feedback system.
To send account emails where you ask for them — confirming a new email sign-up, or resetting a forgotten password. The app sends no match reminders, marketing or push notifications.
To investigate abuse, no-shows, fraud and safety reports, to act on reports you or others file, and to enforce our terms.
To fix problems and improve the product, using crash reports and app-usage analytics collected through Google Firebase. These are linked to your account identifier so that a crash can be traced to the session that caused it.
To comply with legal obligations and respond to lawful requests.

We do not use your personal data for third-party advertising, and we do not run advertising trackers in the app. Google Analytics for Firebase is able to read your device’s advertising identifier; we have not linked Chess Baithak to any Google advertising product, so it is not used to build advertising audiences or profile you. You can reset that identifier at any time in Settings → Google → Ads on your device.

5. Legal bases for processing

Where data protection law requires us to identify a legal basis, we rely on:

Performance of a contract — running your account, matches and ratings, which is the service you asked for.
Consent — location access, and the optional profile details you choose to add such as your phone number, WhatsApp number, Instagram handle and bio. You can withdraw consent at any time by revoking the permission or clearing the field.
Legitimate interests — keeping the platform safe and reliable, preventing abuse, and defending legal claims, balanced against your rights.
Legal obligation — where we must retain or disclose data to comply with applicable law.

6. What other players can see

Identity is withheld by default and revealed only when a match is confirmed.

Before a booking is confirmed: other players see your rating, approximate area, availability, verified badge and reputation summary. They do not see your name, photo or phone number.
After both sides confirm: matched players see the display name and, if you added one, profile photo. Contact details are shared only between matched players, and only where necessary to meet at the venue.
Always private: your phone number is never displayed publicly in the app, and is never shown to players you have not matched with.
Private matches are enforced at the database level with row-level security, so they remain invisible to users who were not invited.

We share personal data only in these circumstances:

With other players, as described in section 6.
With service providers who process data on our instructions under contract — hosting and database infrastructure, and the form provider used by our website contact form. They may use your data only to provide the service to us.
With OpenStreetMap, when the app looks for places to play. To list cafés, parks and libraries near you, the app sends your approximate coordinates and a search radius directly from your device to the OpenStreetMap Overpass API (overpass-api.de). Map tiles are loaded from tile.openstreetmap.org, which receives your IP address and the area of the map you are viewing. Neither request carries your name, account or any other profile data — only a location and, unavoidably, your IP. OpenStreetMap is an independent foundation and its handling is governed by its own privacy policy.
With Google, when the app loads its typefaces from Google Fonts on first launch. Google receives your IP address in order to serve the font files. No account or profile data is sent.
With Google Firebase, which provides our crash reporting (Crashlytics) and app analytics. Firebase receives crash stack traces, your device model and operating system version, app-usage events, and your Chess Baithak account identifier. Google acts as our processor for this and may not use the data for its own purposes. We do not send Firebase your name, email address, phone number or location.
With your device’s map service, when the app names your city during profile setup. Your approximate coordinates are handed to the geocoding service built into your phone — on most Android devices, Google Play Services. This happens on the device through a standard operating-system interface rather than a request we send, but the coordinates do leave your handset, so we name it here rather than leave it implied.
For legal reasons — to comply with a valid legal process, enforce our terms, or protect the rights, safety and property of our users or the public.
In a business transfer — if Chess Baithak is involved in a merger, acquisition or asset sale, we will notify you before your data becomes subject to a different privacy policy.

We do not sell personal data, and we do not share it with data brokers or advertising networks.

8. How long we keep data

Account and profile data — for as long as your account is active.
Match records and ratings you gave others — for as long as your account is active, because they form the integrity of the rating system. After account deletion these are anonymised rather than erased, so opponents' historical ratings stay correct; the anonymised record can no longer be linked back to you.
Ratings and feedback other players left about you — erased on account deletion, because they describe you rather than them.
Approximate location — used transiently to answer a search and never stored against your profile as a location history. Coordinates do appear in our hosting provider's standard request logs, which are kept for security and abuse prevention as described in section 14.
Crash and diagnostic logs — retained by Google Firebase under its own retention schedule: Crashlytics keeps crash reports for 90 days, and Analytics keeps event data for 14 months. Deleting your account stops further collection and unlinks your identifier, but does not retroactively purge reports already sent.
Safety reports — kept for 7 years, and deliberately retained when either account is deleted. This is an exception to everything above, and we make it on purpose: if deleting an account erased the reports made about it, then deleting and re-registering would be a one-tap way to clear a history of harassment or child safety complaints. When an account goes, the report is unlinked from it, but the account holder’s name, city, area, email and phone as recorded at the time of the report are retained within the report itself, together with anything the reporter wrote. Where the law requires us to report to the authorities, these records are what we report from.
Blocks — kept while both accounts exist, and erased as soon as either is deleted. A block is a live preference about who you see, not a record of anything.
Support correspondence — up to 24 months from the last message.
Records we must keep by law — for the period the law requires.

9. Deleting your account and data

In the app: open Profile → Account → Delete account. You will be asked to confirm, and the deletion takes effect immediately.

Without the app: email [email protected] from the address linked to your account. Full instructions are at chessbhaitak.com/delete-account.html.

Deleting your account erases your display name, profile photo, age, gender, occupation, city and area, bio, email address, phone number, WhatsApp number, Instagram handle, approximate location, availability slots, preferred spots, match requests, check-ins and your sign-in credentials. Ratings and feedback other players left about you are erased with them.

In-app deletion happens immediately — the data is gone from our live systems before the confirmation screen closes, and you are signed out. Requests sent by email are actioned within 30 days and confirmed by reply once complete. Backups containing your data are purged within 90 days, and are never used to restore a deleted account.

Match records and the ratings you gave other players are anonymised rather than erased, as described in section 8.

Safety reports are the one thing deletion does not remove. Reports you filed about others, and reports others filed about you, are retained as described in section 8 — including the copy of your profile details captured when the report was made. We explain the reasoning there; in short, an account deletion must not be a way to erase a child safety or harassment complaint.

You may also remove specific data without closing your account — for example clearing your profile photo, phone number, WhatsApp number or Instagram handle from Profile → Edit profile.

10. Your rights

Subject to applicable law, you have the right to:

Access a copy of the personal data we hold about you.
Correct data that is inaccurate or incomplete — most profile fields you can edit directly in the app.
Delete your account and associated personal data, as described in section 9.
Withdraw consent for location, notifications, linked accounts or an optional photo, without affecting processing already carried out.
Object to or restrict processing based on our legitimate interests.
Portability — receive your profile, match history and ratings in a structured, machine-readable format.
Complain to your local data protection authority.

To exercise any of these, email [email protected]. We respond within 30 days. We may ask you to verify control of the account before we act, to stop someone else requesting your data.

11. How we protect data

All traffic between the app and our servers is encrypted in transit using TLS.
Data is encrypted at rest by our hosting provider.
Access rules are enforced in the database itself through row-level security, so a fault in application code cannot expose private matches or another player's contact details.
Access to production data by our team is restricted to those who need it and is logged.
Sign-in is handled by our authentication provider using Google Sign-In or an email address and password. We never see or store your Google password, and email passwords are stored only as salted hashes by that provider.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal data and creates a risk to your rights, we will notify you and the relevant authority as required by law and without undue delay.

12. Children

Chess Baithak is for adults. You must be 18 or over to create an account, because the app arranges games with people you have not met, at public venues. It is not directed at children and we do not knowingly collect personal data from anyone under 18.

When you set up a profile the app asks for your date of birth before anything else. If you are under 18 the sign-up stops there: no name, area, city or other detail is collected, and your date of birth is not sent to us — it is checked on your device and discarded. Our servers independently reject any profile stating an age below 18.

If you believe someone under 18 holds an account, contact [email protected] and we will delete it and its data promptly.

Chess Baithak has zero tolerance for child sexual abuse and exploitation. You can report a child safety concern from inside the app — open any profile or match and choose Report — or email [email protected]. Our full standards, how we respond, and how we report to the FIA Cyber Crime Wing and NCMEC are set out at chessbhaitak.com/child-safety.html.

13. International transfers

We operate in Pakistan, but some of our service providers store or process data on servers outside Pakistan. Where data is transferred across borders, we take steps to ensure it remains protected by a comparable standard, including contractual safeguards with each provider.

14. Website and cookies

The chessbhaitak.com website does not set cookies, does not run analytics, and does not include advertising or social trackers.

Web fonts are loaded from Google Fonts, which means Google receives your IP address and browser user-agent in order to serve the font files. Google's handling is governed by its own privacy policy.
If you submit the website contact form, the name, email, topic and message you enter are transmitted to our form processing provider and forwarded to us by email.
Our hosting provider keeps standard server request logs, including IP address and requested URL, for security and abuse prevention.

15. Changes to this policy

We may update this policy as the app changes or the law requires. The effective date at the top of this page always reflects the current version. If a change materially affects how we handle your personal data, we will give notice in the app or by email before it takes effect, and where the law requires it, ask for your consent.

16. Contact us

Questions, requests or complaints about privacy:

Email: [email protected]
Postal: ChessBhaitak (PVT) Ltd., 42 Main Rd, Gujjar Arcade, Soan Gardens Block H Extension, Islamabad, Pakistan

We aim to acknowledge every privacy enquiry within 5 working days and resolve it within 30 days.