Effective date: 3 November 2026.
Ottawa Cavaliers Chess Academy (OCCA) uses information to operate chess activities, accounts, registration, payments, waivers and practice, answer enquiries and protect the service. This policy covers chesscavaliers.org. Banks, Google and linked websites have their own privacy notices.
Privacy enquiries: Ottawa Cavaliers Chess Academy (OCCA), Ottawa, Ontario, Canada. Email chesscavaliers@gmail.com with “Privacy” in the subject, or use our website contact page.
What we collect and use
Accounts and participants: name, email, password hash, account/security activity, participant birth date, optional CFC ID, chess experience and managing-account relationship. These support access, identification, eligibility and registration.
Events and payments: entries, participant/fee snapshots, invoices, payment references and amounts, allocations, cancellations, attendance and staff notes. These support event administration, accounting and enquiries. Payments use your bank; this website does not collect banking passwords or card details.
Waivers: participant name/birth date, signer name/email, guardian phone/relationship where applicable, declarations, typed or drawn signatures/initials, agreement wording, timestamps and integrity evidence. Signing evidence includes an IP-derived digest and limited browser information. Signed HTML and PDF records document the agreement.
Contact: name, email, topic, message and staff handling records, used to address your enquiry. Please omit passwords and unnecessary sensitive information.
Puzzles: guest or participant identifiers, attempts, moves, hints, mistakes, results, ratings, streaks and dates, used to run practice and show progress. Guest history joins an account only through an explicit assignment action.
Security: sessions, account/admin audit records, email-delivery status and hashed IP/email rate-limit identifiers, used to control access and investigate misuse.
Existing OCCA records may have been transferred into this website. Profile updates do not rewrite historical invoices or signed evidence.
Children and access
Adults manage parent accounts and under-13 profiles. Players aged 13 or older can have self-managed accounts; minors require guardian signatures for tournament waivers. These product thresholds do not replace appropriate privacy consent. Provide another person's information only with authority, explaining the relevant privacy information appropriately. Contact us about a child's privacy concern.
Account holders see their own records and managed participants. Invited signers receive limited access to their signed document. Authorized administrators handle registration, payments and support. Detailed staff waiver access requires a recorded purpose. Operational rosters/exports can include names, CFC IDs, eligibility and participation/payment status, but omit birth dates, signatures and guardian contacts.
Gmail payment verification
With the receiving mailbox owner's permission, OCCA Website reads OCCA's receiving Gmail account to verify Interac notifications, match invoices and prevent duplicate receipts. Members do not connect personal Gmail accounts.
Google's read-only permission allows mailbox-wide access to messages/settings. OCCA searches date ranges for likely payment notifications or invoice-reference text and reads matching messages/headers; unrelated messages can match. The integration cannot send, change or delete Gmail messages or initiate bank transfers.
It retains mailbox/authorization information, message IDs and fingerprints, extracted bank/invoice references, amounts, currency, dates, processing results and payment/review links. Administrators can inspect extracted evidence and add notes. Automated processing does not retain full message bodies/headers, payer names, account suffixes or private notification links, although it may read them temporarily.
Google connections use HTTPS; stored OAuth credentials are encrypted. Payment facts remain in the application database. Enabled receipt emails pass the member's address, amount, invoice reference, receipt number and account link to the delivery service.
The mailbox owner can revoke permission in Google Account settings. OCCA's disconnect control removes its stored refresh token, stops synchronization and requests Google revocation. Existing records remain.
OCCA's use and transfer of Google API data will follow the Google API Services User Data Policy, including Limited Use requirements.
Providers and public information
Hosting, database/backup and email providers process information to operate these services. Google handles authorized mailbox requests. Information may also be disclosed as required by law or for security; this does not authorize unrelated Google-data use.
Namecheap hosts our website and application database and processes related hosting logs and backups. Hosting logs may include visitors' IP addresses. Google provides OCCA's Gmail mailbox and the authorized payment-notification access described above. When website email is enabled, our email-delivery service processes recipients' addresses and message contents.
These providers may process information outside Canada, including in the United States. Information processed abroad may be subject to local laws and lawful access by courts, law-enforcement or national-security authorities.
OCCA selects biographies, photos, captions and event/news information for public pages. Account creation does not automatically publish private profiles or signed records. Contact us about public information concerning you or your child.
Cookies, protection and retention
Session cookies support sign-in and secure forms. A random puzzle guest cookie expires in the browser after 90 days; server records do not necessarily expire then. Local storage saves puzzle sound preferences. Browser controls can clear these, but cannot delete account records and may interrupt features.
The application uses HTTPS, password hashing, access controls and audit records. OAuth credentials and queued account-security email payloads are encrypted; this does not establish encryption of every database field, export or backup.
Archiving profiles preserves history. Payment and waiver records are not automatically deleted. Corrections, Gmail disconnection and browser-data clearing do not erase them; backups/exports may retain copies.
We assess retention according to the information's purpose: operating accounts and events, maintaining payment and accounting records, documenting signed agreements, resolving enquiries or disputes, and meeting applicable legal requirements. We consider these purposes when reviewing requests to delete information, including information held in backups or exports. Records are not automatically deleted after a fixed period.
Your choices
Edit available profile/security settings through your account. Contact our privacy contact for access, corrections, complaints, consent withdrawal or account closure, including requests for a child you may represent. Identity/authority checks and protection of others' information may be necessary. Withdrawing necessary information may prevent a feature; justified record retention may still apply.
Send privacy requests to chesscavaliers@gmail.com. OCCA reviews access, correction, account-closure and deletion requests individually and may ask for information needed to verify your identity or authority. We will explain the outcome and, if information must be retained, the reason. The website does not provide general self-service account deletion.
We will date policy updates and obtain new consent where required before a new use.