Privacy

TechLeague (techleagueesports.com) is an independent community project, run by one person from Israel. There is no company behind it. That person decides what data is collected and why, which under the GDPR makes them the data controller for everything described here.

Anything on this page — a question, a correction, a request to delete your account — goes to feedback@techleagueesports.com. It is a monitored mailbox and it reaches a person, not a ticket queue.

When you register:

• Your first and last name.
• Your work email address. We require an employer address and reject public providers like Gmail, Outlook and iCloud, because company identity is the whole basis of the platform.
• Your password. It is stored only as a salted hash by our authentication provider and is never visible to us.

Your name, work email and password are required: without them we cannot open an account or place you with your employer. Everything else on this page is optional, or happens only when you use the feature it belongs to.

What else is on your profile: your job title, your department and a link to your LinkedIn profile. All three are optional, are not asked for at signup, and can be added, changed or cleared at any time in your settings.

Your employer. We work it out from the domain of your work email — we never ask you to type it. If you are the first person from that domain, a company record gets created. If you change jobs, update your work email and your company changes with it.

Linked game accounts, if you choose to link them:

• Riot Games (League of Legends, EUNE): your Riot ID, an internal Riot account identifier, your ranked tier, division and league points for Solo/Duo and Flex, your win/loss counts, and your profile icon.
• chess.com: your username, your ratings, your win/loss/draw counts, and your avatar.

What you do here. Teams you belong to, invitations you send or accept, challenges and duels you take part in, results you report, and whether we could verify those results against the game's own records.

Diagnostics. Which pages you visit inside the app and when, recorded against your account. When something breaks we record the error and the page it happened on; error reports sent from your browser carry no account identifier at all. They do carry the same daily-rotating hash described under Audience measurement below, for one reason only: the endpoint that receives them is open to anyone, and without a way to count reports per sender it could be flooded. It is never used to work out who you are.

Audience measurement. Separately from all of the above, and for everyone who loads a page whether or not they have an account, we record the page, the time, the site or campaign tag that referred the visit, and the country our hosting provider reports. We do not store your IP address and we put nothing in your browser. To count visitors rather than page loads we store a one-way hash of your IP address and browser, mixed with a secret value and the current date. Because the date is part of it, the hash is different tomorrow — it cannot be used to recognise you on a later day or to build up a history of you. That is a deliberate trade: it means any multi-day visitor number is really a count of visit-days, not people.

On the same terms, and under the same daily hash, we record what happens on a page: which of our buttons you press, whether a sign-up attempt was refused and the reason (for example that the address was a personal one, never the address itself), how many seconds the page was open and visible, and how far down it you scrolled. Each page view gets a random number that exists only while the page is open, so its time can be sent more than once and counted once. Nothing you type is recorded, and nothing is stored in your browser.

Playing Codele without an account. The daily game is open to everyone, and we record how a play goes whether or not you are signed in. That means which puzzle it was, how many guesses it took, what was guessed, whether it was solved or the answer was revealed, and how long it took. We use it for one thing, which is working out which puzzles are too easy and which are too hard. If you are not signed in it is attached to no name, no account and no email address, and it scores nothing. If you then register or sign in in the same browser on the same day, that day’s guesses are moved to your account and scored as if you had made them signed in.

To tell one person’s day of puzzles apart from several people’s one puzzle, your browser makes a random number for that day and keeps it next to its record of your guesses. It is not built from your IP address, your device, or anything else about you. It is thrown away with the rest of that day’s game and the next day gets a fresh one, so it cannot be used to recognise you on a later day or to build up a history of you. Clearing your browser storage removes it at once.

Code written in Codele, until 29 September 2026. Until that date one Codele puzzle was answered by writing a short function, in JavaScript or Python, which our server ran in an isolated sandbox against the puzzle’s tests. For each submission we kept only the outcome: whether it passed, or which test it failed and what it returned, and which of the two languages it was written in. The code itself was never stored. The per-hour counts of runs we kept to stop anyone running code without limit were deleted when the puzzle was withdrawn.

How you found us. If you arrive from a link we can identify — a LinkedIn post, say — we record that one value on your account when you sign up. It is recorded once, never updated, never shared with the site that referred you, and never used to target anything at you. It is the one exception to "audience measurement is not linked to your account", and it is called out again in section 8.

Things you send us. Feedback, bug reports and messages sent through the in-app widget, plus the page you were on and your browser version — those last two only if you leave the "include page and browser info" box ticked.

Enquiries from the partners page. If you write to us there, we keep your name, email address and message so that we can reply. The enquiry also carries the same daily-rotating hash described under Audience measurement below, for one reason only: the form is open to anyone, and the hash is how we limit how many enquiries one sender can make in an hour.

Messages you send another player. On the page of a tournament match, a chess duel or a League scrim you can message the other side, so you can arrange the game. We store what you write, who wrote it and when. Everyone in that game can read the conversation (in a scrim, both teams), and so can we. We look when a result is disputed or someone reports behaviour, because that conversation is usually the only record of what happened. Each page says this next to the box. Messages are deleted with the game they belong to. Do not put anything in there you would not want an organiser to read.

Almost all of it comes directly from you. The exception is your ranked and rating data, which we fetch from the public Riot Games and chess.com APIs using the account identifiers you gave us, and refresh every few hours.

If you connect chess.com by signing in on chess.com, chess.com sends us your basic chess.com profile. We keep only your username, which is how we know the account is yours. We do not ask chess.com for your email address, and we do not keep the sign-in tokens chess.com gives us.

Where the GDPR applies, these are the bases we rely on:

• Performance of a contract — running your account, placing you in a company, operating teams, challenges, duels and leaderboards, and sending the emails that make those work (verification, invitations, notifications).
• Legitimate interests — keeping the platform working and worth trusting: fixing errors, seeing which features get used, preventing duplicate and fake accounts, and checking reported results against the game's own records so the competition means something. We keep this to what is necessary, and it never involves selling anything.
• Legitimate interests, for audience measurement — knowing how many people visit and which link brought them, so we can tell whether anyone is finding the platform at all, and knowing how a Codele puzzle went so we can tell which ones are too easy or too hard. We rely on this rather than asking for your consent precisely because the measurement is built not to identify you: no cookie, no IP address kept, and an identifier that stops working after the day it was made. Audience measurement stores nothing in your browser at all; Codele stores that day’s random number and deletes it with the day. You can object to either — see section 9.
• Consent — linking a Riot or chess.com account, and adding optional profile details like LinkedIn. You choose these, and you can undo them.
• Legal obligation — where we have to keep or hand over information to comply with the law.

On emails specifically: we email you about games and events you are part of. That means someone challenging you to a game, and your Chess Open registration and matches. We only send one if you have not already seen it on the site. A colleague from your company joining is shown on the site only. Never about results, never marketing. These emails are on by default, because each one is about something you signed up for or something another person did that involves you. Every one of them carries a one-click unsubscribe, and one switch in your settings turns them all off. Emails your account needs, such as confirming your address or resetting your password, are sent either way.

Anyone on the internet, without signing in, can see the following once you link a game account:

• Your name, chess.com username and chess.com avatar (for chess), or your Riot ID (for League of Legends).
• Your employer's name.
• Your rank, rating and competitive standing.
• Your team's name and roster, and the results of challenges and duels you take part in.
• The moves of your finished duels. We analyse them with a chess engine, and a duel can be shown on the homepage as the best game of the week, with both players' names and companies and the two players' average accuracy.

The Chess Open is streamed. If you enter it, your games may be shown live on the TechLeague channel on Twitch, and on our public broadcast pages, with your name, your company and your chess.com username, and talked about by a commentator. Twitch may keep a recording of the stream after it ends, under Twitch’s own terms. If you do not want that, do not register for the event.

In a League scrim, the players of the other team see your first name next to your Riot ID and rank once the scrim is agreed, so the ten of you can find each other in the game. They do not see your surname.

Your employer's name also appears in the aggregate company standings. Your email address, job title, department and LinkedIn URL are never shown publicly.

Your colleagues can see more. The Colleagues page exists so people at the same employer can find each other, so anyone registered with the same work-email domain as you can see your name, your job title, your LinkedIn link if you added one, your linked game accounts and ranks, and which team you are on. Your work email address is shown only to the members of your own team. Nobody outside your email domain sees any of that, and signed-out visitors see none of it. If you would rather your colleagues did not have your LinkedIn or your job title, clear those fields in your settings — your name and rank are structural and cannot be hidden while your account exists, and neither is your work email to your own team.

Whether you are online, to other members. While you have a TechLeague page open, we record a single timestamp saying you were here. It is used in two different ways. Signed-in members see a count of how many people have TechLeague open right now, which includes you and names nobody. They see your name in the list of people to challenge only if you have linked a chess account. That is what lets two people who are free at the same time start a game instead of arranging one. We keep one timestamp per person and overwrite it on every update. There is no history of when you were online, only whether you are now. Signed-out visitors see none of it. The timestamp keeps updating for about five minutes after you switch to another tab, because playing a duel means opening chess.com in one. After that it stops, and you drop off within three minutes. If you would rather not be named there, don't link a chess account.

If you would rather not appear publicly at all, don't link a game account — or unlink it and ask us to remove the data that came with it.

We do not sell personal data and we do not use it for advertising. It is handled only by providers who process it for us:

• Supabase: database and authentication.
• Vercel: hosting and delivery.
• Resend: sending email.
• Google: the mailbox that receives what you write to us, and the website's font, which your browser downloads from Google and which tells Google your IP address.
• GitHub: it holds our code and runs our scheduled jobs. The daily error summary it stores contains no names, emails or game accounts.
• Twitch: the Chess Open stream, as described in section 5.

Pictures you see on the site come from where they live: chess.com avatars from chess.com, and League profile icons from Riot Games' image service, or from CommunityDragon, a public archive of League images, when Riot's does not have the icon yet. Your browser asks those sites for them directly, so they see your IP address.

Riot Games and chess.com are sources rather than recipients. We read your public competitive data from their APIs using the identifiers you gave us. If you connect chess.com by signing in there, chess.com also knows that you connected your account to TechLeague. What they do with your account on their side is governed by their privacy policies, not this one.

We may also hand over information where the law requires it, or to establish or defend a legal claim.

TechLeague is run from Israel, which the European Commission recognises as providing an adequate level of data protection, so data reaching us from the EEA needs no additional safeguard.

Our providers may process data elsewhere, including in the United States. Where that happens and the GDPR applies, the transfer is covered by an approved safeguard — typically the European Commission's Standard Contractual Clauses. Ask at feedback@techleagueesports.com if you want the specifics.

Your account data stays while your account does. Ask us to delete your account and we remove your profile, your linked game accounts and your personal identifiers — including the "how you found us" value from section 2.

Two things can outlive that. Competitive records — match and duel results — may be kept in a form that no longer identifies you, so past standings still add up. And error and usage logs are kept for as long as they are useful for fixing problems; to be straight with you, there is currently no automatic expiry on them, so if you want yours cleared out, ask and we will do it.

Audience-measurement records are not linked to your account at all, and the daily hash described in section 2 stops identifying anyone the moment its day is over — so deleting your account has no effect on them, and there is nothing in them to retrieve. They are deleted after about 400 days. The same is true of a Codele play made without an account: the day’s random number is the only thing tying one play to another, it is gone the next day, and there is no way for us to find yours among them.

Wherever you are, you can ask to see the data we hold about you and to have it corrected or deleted. That is your right under Israel’s Privacy Protection Law (sections 13 and 14), which applies to everything here because TechLeague is run from Israel.

If you are in the EEA or the UK, you also have the right to see your data, to have it corrected, to have it deleted, to restrict or object to how we use it, to get a portable copy, and to withdraw consent where consent is what we relied on. Withdrawing consent does not undo processing that already happened.

You can delete your account yourself, in Settings. For everything else, email feedback@techleagueesports.com and it gets done by hand, within one month.

You can also complain to a data protection authority: in Israel, the Privacy Protection Authority at the Ministry of Justice. If you are in the EEA or the UK you may also complain to the authority in the country where you live.

No advertising cookies, no third-party trackers, no Google Analytics, and nothing here for you to consent to for marketing. We do not sell or share any of this.

We do use strictly necessary storage. Our authentication provider keeps your session token in your browser so you stay signed in. And we store one value for the lifetime of a browser tab recording where this visit came from — so one arrival isn't counted several times, and so an account created later can record how you found us. When you register, the same value is added to the link in your confirmation email, because that link opens a new tab. It is deleted when you close the tab, is never sent anywhere else, and cannot be used to recognise you on a later visit. Clearing your browser storage signs you out.

Codele keeps three things in your browser for the day you are playing: the guesses you have made and the clues you have opened, so the game survives a reload, and the random day number described in section 2. All three are stored under that day’s date and are deleted when you next open the game on a later day. The replay of a finished chess game remembers whether you turned its move sounds on or off, and the notification bell remembers the same for its sound.

A few more small values, each about this browser only and none sent anywhere: that you chose “I’ll do this later” when asked to link a game, so you are not asked on every page; and, for each finished duel or scrim you open, that you have already seen its result, so its result card plays once. These stay until you clear your browser storage.

Our own measurement happens on the server and uses no cookie. Audience measurement — visits, referring sites, countries, and the button presses, time and scrolling described in section 2 — uses no stored identifier at all and relies on the daily-rotating hash from section 2, which is built so we cannot follow one person from one day to the next. The one exception is the Codele day number above, which is stored in your browser and is built to the same rule: it lasts a day and identifies nobody. What you do inside the app while signed in is recorded against your account.

TechLeague is for people in professional employment and is not for children. We do not knowingly collect anything from anyone under 16. If you think a child has registered, email feedback@techleagueesports.com and the account will be removed.

If this page changes in a way that actually affects you, we will update the date at the top and tell you in the app or by email.

TechLeague is run from Israel by the person who built it. Anything on this page, including a request under section 9, goes to feedback@techleagueesports.com.

See also our Community Guidelines.