Privacy Policy

Grassroots Chess is a community initiative founded and personally operated by Jon Pastorizo.

Organizers sign in with Google through Neon Managed Better Auth. Authentication processes your Google account identifier, email, profile and session information. The app uses a verified session to identify you, display your email and restrict access to your own tournaments. Grassroots Chess does not ask for or store your Google password.

The tournament database stores an internal organizer identifier, the authentication provider and account identifier, and the time that organizer record was created. Your email is used to show which account is signed in; tournament ownership is tied to your account identifier.

Saved records contain the event details and rules, team and participant display names, board categories, player pools and assignments, pairings, scores, standings and tournament history. Save records also include account identifiers, revisions, timestamps and information used to recover interrupted requests.

This information supports tournament administration, scoring, corrections and recovery. Correction reasons, earlier scores and player names can remain in the history. Editing a current name or reopening a round does not remove those earlier entries.

Enter only information needed for the tournament. Do not enter passwords, identification documents, contact details or sensitive personal information in player names or correction notes. Practice events and unsaved edits are held in the current page and are not a durable offline backup.

Saved tournaments are private to their organizer unless the organizer enables a spectator link. Anyone with an enabled link can see the shared event details, rules, assigned player and team display names, pairings, results and standings. Account details, unassigned player pools and private history are excluded from that view.

Disabling the link blocks new public requests. It cannot recall screenshots, printouts or downloaded copies. An already open page may retain its last loaded results until it receives the updated access status.

Organizers are responsible for explaining their event's information practices to participants and having appropriate permission before entering or publishing names. Take particular care with children and obtain parent or guardian permission where required. A spectator-sharing confirmation is not a substitute for that permission.

Necessary authentication cookies support Google sign-in and session verification. They can contain authentication and account information returned by the provider. Signing out ends the app session; it does not delete your account or saved tournaments.

Browser session storage keeps account-scoped recovery identifiers and a fingerprint of a create or restore request so the app can find a save after an interrupted response. These entries do not contain rosters or backup contents. Recovered entries are cleared; unresolved entries may remain when accounts are switched. A separate random browser-storage signal helps other tabs respond to sign-out and account changes.

The current website has no installed advertising trackers or audience analytics. Clearing browser storage may interrupt sign-in or recovery and does not delete records held by the service.

Railway hosts the application. Neon provides the PostgreSQL database and managed authentication, and Google provides sign-in. The testing application's hosting and database are configured in Singapore. These providers process information needed to run and secure their services; that setting does not mean all provider processing occurs only in Singapore.

The application records technical errors for troubleshooting. Infrastructure and authentication providers also handle connection and security information under their own arrangements. This notice does not assign a verified retention period to their logs or backups.

Contact links open your email application. Messages you choose to send include your address and message contents. The contact address routes to the operator's Google Workspace inbox. There is no website contact form or newsletter signup.

Provider information: Railway privacy policy, Neon provider privacy notice and Google privacy policy. These do not replace this notice or the service agreements governing hosted data.

Saved tournament records, account mappings and history currently have no automatic expiry. The preview has no self-service account or tournament deletion. Signing out, removing Google access or changing the current tournament information does not erase the stored records or their history.

Tournament records are retained while the organizer needs them. Jon Pastorizo will manually review whether continued retention is necessary at least annually and when a removal request arrives. This review does not automatically delete records. Processes covering authentication accounts, history and recovery copies still require completion before production use. Do not use this preview to store real participant information while those arrangements are incomplete.

Organizers can download a tournament backup and standings. A tournament backup includes private player pools and tournament history, but it is not a full account-data export: authentication records and the separate server activity log are not included. Keep downloaded backups private. Copies held by recipients are outside the app's control.

You can ask about information relating to you, request access or a correction, raise an objection, or request review of removal. A participant can also contact the organizer responsible for entering their information. Describe the relevant event and the request without sending passwords, sign-in codes or identity documents in an initial message.

Requests may require proportionate verification of identity and authority to protect other participants' information. The preview does not offer automatic removal or a complete account export. Any applicable rights and complaint routes remain available; this notice does not waive them.

Public contact: jon@grassrootschess.com.

Read about privacy rights from the Philippines' National Privacy Commission.

The application uses encrypted connections, verified sessions, server-side ownership checks and restricted database access. These measures reduce risk; they do not guarantee that every incident can be prevented.

This notice will be updated when the service or its information practices change. The date above identifies this version. New features such as public archives, analytics or additional contact forms require a further privacy review before introduction.