Privacy Policy

Last updated: 19 February 2026 · Effective from publication

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Data We Collect

a) Registration and Account Data

When you register, we collect: email address, password (stored encrypted via Supabase Auth), and optional display name.

b) Chess Game Data

When you connect your Lichess or Chess.com account, we import publicly available game data (PGN, results, ratings, time controls) via their respective public APIs. This data is stored in our database and used for analysis.

c) Analysis Data and AI-generated Profiles

Chess games are analyzed locally using the Stockfish engine. Analysis results (error classifications, evaluation curves) and your AI-generated player profile are stored in our database.

d) Chat History

Your messages to the AI coach and the AI's responses are stored in our database and associated with the respective game.

e) Technical Access Data

When accessing our website, technical data such as IP address, browser type, operating system, and access time are recorded in server logs. This data is used exclusively for error diagnosis and ensuring operation and is deleted after a maximum of 14 days.

3. Legal Bases for Processing

• Contract performance (Art. 6(1)(b) GDPR): Registration, authentication, storage of your game data.
• Consent (Art. 6(1)(a) GDPR): Processing of your chess data by external AI services (Claude by Anthropic).
• Legitimate interests (Art. 6(1)(f) GDPR): Collection of technical access data to ensure secure operation.

4. Third-Party Services and Data Transfers

Supabase

We use Supabase (Supabase Inc., San Francisco, USA) as our database service and for authentication. Your account and game data are stored on Supabase servers. Data transfers to the USA are based on Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR.

Supabase Privacy Policy

Anthropic / Claude

For AI coaching features, we use Claude (Anthropic PBC, San Francisco, USA). When you use the AI coach or generate an AI player profile, relevant move sequences and analysis data are transmitted to the Anthropic API. Anthropic processes this data to generate a response. Transfers to the USA are based on Standard Contractual Clauses.

Note: Anthropic may use transmitted content to improve its models. More information: Anthropic Privacy Policy

Lichess

When you connect your Lichess account, we fetch publicly available game data via the Lichess API. We only store your Lichess username and the imported game data. No Lichess login credentials are stored with us.

Lichess Privacy Policy

Chess.com

When you connect your Chess.com account, we fetch publicly available game data via the Chess.com API. Only your username and imported game data are stored.

Chess.com Privacy Policy

Stockfish

Chess analysis is performed locally on our servers using Stockfish (open-source chess engine, GNU GPL v3). No data is transmitted to external Stockfish servers.

stockfishchess.org

5. Retention Period

We store your data for as long as your account is active. After account deletion, all personal data is deleted within 30 days, unless legal retention obligations apply. Server logs are deleted after a maximum of 14 days.

6. Your Rights (Art. 15–22 GDPR)

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) \u2013 Available at any time via Settings → 'Delete all data' or 'Delete account'.
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent (Art. 7(3) GDPR)

To exercise these rights, please contact the address listed above. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

7. Cookies and Local Storage

We use only technically necessary cookies:

• locale \u2013 Stores your language preference (German/English). No expiry (session cookie).
• sb-* (Supabase Auth) \u2013 Authentication tokens for your session. Deleted on sign-out.

We do not use any third-party tracking, advertising, or analytics cookies.

8. Minors

This service is not directed at children under the age of 16. We do not knowingly collect personal data from minors. If we become aware of such data, it will be deleted immediately.

9. Changes to This Privacy Policy

We reserve the right to update this privacy policy as needed. The current version is available on this page. For significant changes, registered users will be notified by email.

Last updated: 19/02/2026