Privacy policy

Last updated: 2 October 2026. This is a courtesy translation. The German version is legally binding.

1. Controller

The controller for data processing on this website and in Schatu is:

We have not appointed a data protection officer because we are not legally required to. For any privacy question, contact us at the email address above.

2. Hosting and server logs

Schatu is hosted by Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA ("Railway"). The website, API and database run in Railway's Europe region, in a data centre in the EU.

When you visit the website, our servers necessarily process your IP address, the date and time, the requested address, the response status code and your browser's details (user agent). These are kept in logs that Railway deletes after a short period set by the provider. We only use them to detect and fix outages and attacks.

The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). We have a data processing agreement with Railway under Art. 28 GDPR. Because Railway is based in the USA, access from the USA cannot be ruled out. Such transfers are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

3. Cookies

We set exactly one cookie, and only when you sign in: __Host-schatu_session. It contains a random session ID, your user ID and its issue and expiry times, signed against tampering. JavaScript cannot read it, it is only sent over encrypted connections and only to our own domain, and it expires after 12 hours. We delete it as soon as you sign out.

This cookie is strictly necessary to keep you signed in, so no consent is required (§ 25(2) no. 2 TDDDG). The legal basis for the related processing is the performance of our contract with you (Art. 6(1)(b) GDPR). We do not use cookies for tracking, statistics or advertising.

4. User account

When you register, we store:

• your email address and display name,
• your password, only as a salted hash (Argon2id), so nobody, including us, can read it in plain text,
• whether your email address is verified, and when you created the account,
• your club memberships and roles,
• your active sign-in sessions and when they expire.

We need this data to provide Schatu to you (Art. 6(1)(b) GDPR). You cannot register without an email address and password. Your display name is visible to members of the clubs you belong to.

We keep your account data for as long as your account exists. Sessions end after 12 hours, when you sign out, or when you revoke all sessions. You change your display name, email address and password yourself under "Konto" (account); a new email address only applies once you confirm the link we send to it. You can also delete your account there, or email us at mail@schatu.com. We then delete it together with your memberships, sessions, open sign-in links and export presets. If you are the only admin of a club with other members, appoint another one first or email us. Clubs and tournaments you created remain, because they belong to the club. They are no longer linked to your account. Security log entries are deleted after 90 days, as described in section 6.

5. Sign-in and security emails (Resend)

We only send emails your account needs: links to confirm your registration, sign-in links, password reset links, links to confirm a new email address, and notices about new sign-ins, password and address changes and account deletion. A sign-in notice includes the time and IP address of the sign-in so you can spot access by someone else. We do not send newsletters or advertising.

We send these emails through Resend, a service of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend receives your email address and the message content. Until they are sent, messages are stored encrypted in our database. Once a message is sent or expires, we delete its content and keep only its delivery status and time. Links in these emails work once and expire after 15 or 30 minutes.

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). Security notices are also based on our legitimate interest in protecting your account (Art. 6(1)(f) GDPR). We have a data processing agreement with Resend. Transfers to the USA are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

6. Abuse prevention

To protect accounts against automated sign-in attempts, we count requests per IP address and per email address in 15-minute windows. We do not store the addresses themselves for this, only hashes computed with a secret key.

We log security-relevant events with the time, IP address and, where applicable, your user ID. These include sign-ins, password changes, session revocations, changes to memberships and roles, tournament administration, platform administrators viewing clubs they hold no role in, and rejected or rate-limited requests. These entries help us detect and investigate attacks and abuse. We delete them automatically after 90 days. We delete the sign-in attempt counters as soon as their window has ended.

The legal basis is our legitimate interest in keeping Schatu and our users' accounts secure (Art. 6(1)(f) GDPR).

7. Club and tournament data

Clubs use Schatu to manage their members, roles and tournaments. This involves in particular the names and roles of club members; the name, rating, club and, where applicable, DSB member number of tournament players (including people without an account); and pairings and results.

The respective club is the controller for this data. We process it on the club's behalf and only on its instructions, under a data processing agreement pursuant to Art. 28 GDPR that every club concludes with us (DPA). Member lists and a club's tournaments, including player names, ratings and results, are visible only to members of the club, unless the club publishes them on its public club page (below). In addition, Schatu's platform administrators (currently the operator alone) can view all clubs with their member lists and tournaments, but only for the purposes set out in the DPA, such as operation, support and security; these accesses are logged. When a club deletes a tournament or a player, the related data is deleted. If you are a member or tournament player with a question or want to exercise your rights, please contact your club. We forward any such requests we receive to the club.

Public club pages

Every club can run a public page at schatu.com/verein/… that anyone can view without an account. Whether it exists and what it shows is decided by the club admins alone: besides the club's description and contact details, optionally the number of members, the club admins' display names and tournaments the club releases, optionally with player names, pairings, results and standings and with players' ratings and clubs. Everything about people is switched off at first. Member lists, DSB member numbers and email addresses cannot be published.

The club named on the page is the controller for the publication. It needs a legal basis, usually its legitimate interest in informing about its chess activities (Art. 6(1)(f) GDPR) or your consent (Art. 6(1)(a) GDPR), and must inform you beforehand. We publish only what the club has switched on and do not use the data for our own purposes. If you want to object to the publication of your data (Art. 21 GDPR) or exercise other rights, please contact the club; we forward requests we receive. Unless the club expressly allows it, we ask search engines not to index the page. Public club pages set no cookies and contain no tracking; viewing them only creates the server logs described in section 2.

When a club admin concludes the AVV for their club, we store the club, the version, the time and who concluded it. We are the controller for this record and need it as evidence that the agreement was concluded (Art. 6(1)(f) GDPR). If that person's account is deleted, the record no longer refers to them; the record itself remains as evidence for the club.

8. DWZ data from the German Chess Federation

So that clubs can register players for tournaments quickly and accurately and seed them by their current rating, Schatu queries DWZ data live when needed through the public REST interface of the rating portal (Wertungsportal). The source of this data, and at the same time the recipient of our queries, is the Deutscher Schachbund e. V. (DSB, German Chess Federation), Hanns-Braun-Straße, Friesenhaus I, 14053 Berlin, Germany; the rating portal is run for the DSB by nu Datenautomaten GmbH. We did not collect this data from you directly (Art. 14 GDPR).

Schatu keeps no copy of the DWZ data. We do not import the DSB's data, neither in full nor in part, and do not regularly synchronise any data set with it.

When we query the rating portal

Only on request within Schatu, namely when

• an authorised club user (anyone who may manage tournaments or members in a club) searches for players or clubs,
• an authorised club user registers a player for a tournament, links a member to a DSB member number, or updates a tournament's ratings,
• a club member opens their club's member list, or a user opens their own account, and the current rating of people already linked is shown there.

We send only the search term entered (such as a name), the DSB member number or the DSB club number. The requests come from our server, not your browser, so the DSB receives our server's IP address, not yours, and does not learn which user asked. The DSB receives no display names, email addresses, roles or tournament data from Schatu.

Which data we use from the answers

• DSB member number, first and last name,
• DWZ rating with index,
• club membership (club number, club name, active or passive).

Other fields the rating portal returns, such as year of birth, gender, FIDE ID or club membership number, are discarded as soon as they arrive. Only the authorised club users named above can search the data; it is not public in Schatu.

What is stored

Only what a club creates itself is stored: when a club links a member or tournament player to a DSB entry, we store the reference this needs, i.e. the DSB member number (for the club itself, the DSB club number), with that member or tournament record. For tournament players, the name, rating and club also belong to the start list, as taken over at registration or later updated by the club (see section 7). We process these on the club's behalf; they stay until the club changes or deletes them.

The current rating for a stored DSB member number is fetched afresh from the rating portal whenever it is needed. So that not every page view asks the DSB again, our server keeps answers about individual players in memory for at most 15 minutes, and the club directory (club numbers and names, no people) for up to six hours. After that, and whenever the server restarts, they are discarded; they never reach the database, disk or backups. Corrections to your rating or club data are made by the DSB or your regional federation; Schatu shows them within 15 minutes.

Legal basis

The legal basis is our legitimate interest, and that of the clubs, in running tournaments with correct, current ratings (Art. 6(1)(f) GDPR). The DSB provides this data through its public interface precisely so that clubs and tournament organisers can use it. For your right to object, see section 12.

Information under Art. 14 GDPR at a glance

This information is addressed to all chess players whose data is held in the DSB's rating portal, including those who do not use Schatu themselves and have no account with us.

• Controller: Johannes Müller, contact details in section 1, email mail@schatu.com.
• Source of the data: the publicly accessible rating portal of the Deutscher Schachbund e. V. (DSB), queried through its public REST interface.
• Categories of data: DSB member number, first and last name, DWZ rating with index, club membership (club number, club name, active or passive). We do not process special categories of personal data (Art. 9 GDPR).
• Purpose: searching for and registering players for tournaments, linking members to their DSB entry, and seeding and evaluating tournaments with current ratings.
• Legal basis and legitimate interest: Art. 6(1)(f) GDPR; the clubs' interest and ours in running tournaments with correct, current ratings without typing them in by hand.
• Recipients: only authorised club users in Schatu (anyone who may manage tournaments or members in a club) and, for people already linked, members of the club concerned; technically our hosting provider Railway (section 2). The data is not shown publicly and not shared with any other third parties.
• Transfers outside the EU: processing takes place in a data centre in the EU; for Railway as a US provider see section 2.
• Retention: answers about individual players are kept in memory for at most 15 minutes, with no copy in the database or backups. Links and start lists created by clubs remain until the club changes or deletes them.
• Your rights: access, rectification, erasure, restriction, objection and a complaint to a supervisory authority (section 12). An email to mail@schatu.com is enough.
• Automated decisions: we do not use automated decision-making, including profiling.

9. Contact by email (Tuta)

When you write to mail@schatu.com, we process your email address, your name and the content of your message to answer you. The legal basis is Art. 6(1)(b) GDPR where your request concerns your use of Schatu, and otherwise our legitimate interest in replying (Art. 6(1)(f) GDPR). We delete the correspondence once it is settled, unless statutory retention obligations apply.

Our mailbox is hosted by Tuta, a service of Tutao GmbH, Deisterstraße 17a, 30449 Hannover, Germany. Tuta stores emails encrypted on servers in Germany. We have a data processing agreement with Tuta.

10. Domain and DNS (Namecheap)

Our domain is registered with Namecheap, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA, which also runs its name resolution (DNS). Namecheap usually only receives the IP address of the DNS server your device uses (such as your internet provider's), not your own. No website content passes through Namecheap.

11. Recipients and transfers outside the EU

We only share personal data with the service providers named above, and only as far as each purpose requires. Another recipient is the Deutscher Schachbund e. V. (DSB), whose rating portal we query for DWZ data (section 8): it receives search terms, DSB member numbers and club numbers, but no email addresses, display names, roles or tournament data from Schatu. The DSB is also the source of the DWZ data. We do not sell data or share it for advertising. Transfers to the USA happen only on the bases named in the respective sections. We do not use automated decision-making, including profiling (Art. 22 GDPR).

12. Your rights

You have the right to

• access the data we hold about you (Art. 15 GDPR),
• have inaccurate data corrected (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing (Art. 21 GDPR, see below).

Just email us at mail@schatu.com. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany (baden-wuerttemberg.datenschutz.de).

13. Data security

All connections to Schatu are encrypted with TLS. We store passwords only as Argon2id hashes and sign-in links only as hashes, and outgoing emails are encrypted in the database until they are sent. Access within Schatu depends on your roles in each club.

The database is backed up automatically at Railway so that we can restore it after an outage or error. Backups are deleted automatically after at most 90 days. Data we delete remains in older backups until then. We use it only for restoring and delete it again afterwards.

14. Changes

We update this privacy policy when Schatu or the law changes. The version published here always applies.