Privacy
Draft stating the facts. A legal review is planned before revenue. Checkup is not open yet. Last updated 13 October 2026.
The data controller is Carmelo Hays, a sole proprietor registered in France. The page has two parts: the waitlist and this site, then the beta account in the app. Where a fact is not known, the page says "not known".
The waitlist and this site
This part covers checkupchess.com. Contact: contact@checkupchess.com.
What the waitlist stores
Your email address, the platforms you ticked on the form, and a random token that builds your unsubscribe link.
Each signup also sends me a notification email. It holds only the platforms you ticked, the source of the signup and the date it was received. It stays in my mailbox until I delete it by hand. Nothing deletes it automatically, and unsubscribing does not remove it.
The request that carries the form also carries your IP address and your browser's user agent. The site does not store them. Our sending tool, which receives the form, records no successful send. A failed send keeps its request data, IP address and email included, for 14 days (assumed, not read on the instance).
Why, and on what basis
To confirm your signup, and to write to you when Checkup opens or to invite you to the beta before that. Legal basis: your consent, given when you submit the form.
How long
Until Checkup opens or until you unsubscribe, whichever comes first. The confirmation email carries an unsubscribe link that deletes your record in one click.
Who receives your address
- Our sending tool receives the form. It runs on the same machine as the app, in the United States. A move is planned, no date set.
- Supabase stores the waitlist record. Region: EU West.
- Resend sends the confirmation email. It keeps the message and its log for 30 days, and backups of them for 7 days, in the United States.
Visiting the site
Every request to this site passes through Cloudflare, which sees your IP address and the pages you request. When a page fails to load, your browser may send Cloudflare a report of the network error. Legal basis: legitimate interest, the security and delivery of the site. Cloudflare processes these requests on the global network operated by Cloudflare, Inc., United States.
The site's own code sets no cookie and loads no analytics script. It reads one cookie that the app sets, cu_signed_in, and only to change the navigation link to "My account". It writes no cookie and sends no request. The fonts are served from this site.
The beta account in the app
This part covers app.checkupchess.com. The app shows the same facts in its own notice before a first analysis (version 8). Contact: contact@checkupchess.com.
What is stored
Your email address, your Chess.com username, your games and their analyses, your interface language, and which version of the notice you acknowledged and when. Opponents' names are replaced by a placeholder before anything is stored. The app asks for no proof that the Chess.com username is yours during the beta.
What the email address is for
Three things only:
- Sign-in: it identifies your account and links it to your invitation.
- Recovery: if you write about a lost access, a changed address, or to see or delete your data, your account is found from it.
- Service messages about your account: the "analysis ready" mail, a change of the notice that you have to acknowledge again, and a problem with your analysis that you have to act on. The last two are not built yet.
The address is not used for marketing, for a newsletter or for analytics. It is not shown to another user, not sent to Modal or Anthropic, not sold, and not shared with anyone other than Supabase, Resend and our sending tool.
When you sign in, you type the address on the sign-in page. It goes from your browser to our sending tool, which sends the login link. The app's server stores the address with your account for as long as the account exists.
Who receives what, and for how long
| Recipient | What it receives | Where | Kept for |
|---|---|---|---|
| Modal Labs, Inc. | Each game, with no name and no header, to be analysed by a chess engine. | United States company, run in EU regions. | Up to 7 days, the input and the result. |
| Anthropic | When you open a game: the position and the engine lines of at most three key moments. It writes one short sentence per moment. | United States. The processing may take place outside the EU. | Up to 30 days, and up to 2 years if the request is flagged. |
| Supabase | Your email address, for the sign-in and the waitlist record. | EU. | Until you delete your account. How long its Auth logs are kept: not known. |
| Our sending tool | Your email address, and the IP address and user agent of your connection, in the request of each send. Successful sends are not recorded. A failed send keeps its request data. | United States, on the same machine as the app. A move is planned, no date set. | Successful sends: not recorded. Failed sends: 14 days (assumed, not read on the instance). |
| Resend | The messages sent to you and their logs. | United States. | Up to 30 days. Backups of them: 7 days. |
| The server's host | The app's database: your email address, username, games and analyses. Web logs. | The same machine as our sending tool, in the United States. A move is planned, no date set. Whether its disk is encrypted: not known. | Backups of the database: 7 days. Web logs: not known. |
Your username and your analyses are held on the app's server and by none of Supabase, Resend and our sending tool.
Cookies
The app sets two cookies. Neither comes from a third party.
| Name | Purpose | Duration | Set by | Third party |
|---|---|---|---|---|
sid | Keeps you signed in to the app. | 30 days, or until sign-out. | app.checkupchess.com | None |
cu_signed_in | Lets checkupchess.com show "My account" to a signed-in person. Its value is 1. It holds no identifier. | 30 days, or until sign-out. | app.checkupchess.com, for .checkupchess.com | None |
Both cookies serve only to sign you in and to adapt the navigation link. Neither tracks you, and no consent banner is shown.
Backups
The app's database is copied every day to the same server, and the last 7 copies are kept. The copies are plain files. They are not encrypted.
Deleting your account
Open the Account page of the app and use the "Delete all my data" button. You confirm by typing the word DELETE (SUPPRIMER on a French page).
The deletion removes:
- your account on the app's server, with your email address, your username, your games and their analyses, in one step;
- your session, and the
sidandcu_signed_incookies of your browser; - your email address at Supabase and your waitlist record, through a workflow that the app calls with your account number only.
The deletion does not reach:
- The daily backups of the app's database. A deleted account, and an address you replaced by another, stays in them for up to 7 days.
- The copies at Modal and Anthropic. They expire after the durations in the table.
- The messages already sent to you, and the records that Resend keeps of them, and the request data of a failed send. They expire after the durations in the table, and after 14 days (assumed) for a failed send.
- The host's web logs and the Auth logs of Supabase. Their durations are not known.
If a backup is restored, the accounts deleted after it was taken come back. The record of deletions that would delete them again is not built. Planned.
For both parts
Transfers outside the EU
Data processed in the United States is transferred under the providers' Standard Contractual Clauses.
Your rights
You can ask for a copy of your data or for its deletion by writing to the contact address of the part that concerns you. Unsubscribing from the waitlist withdraws your consent. You can also lodge a complaint with the CNIL, the French data protection authority, at cnil.fr.