Privacy policy

The controller of your personal data under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act is:

• Contract (Art. 6(1)(b)): running your account, tracking progress, delivering what you bought, answering support.
• Legitimate interests (Art. 6(1)(f)): the leaderboard and the public profile, a pseudonymous ranking being the core of the product and the pseudonym being generated by us rather than taken from you (you can change it at any time, anyone can report or block a name, and we ban a name that deserves it); security, abuse and fraud prevention, debugging, and improving the product. You can object to the leaderboard processing at hello@chesstactics.app.
• Consent (Art. 6(1)(a)): optional email (the three onboarding notes, streak reminders and the streak-lost note, the weekly digest, achievement notices). Withdrawable at any time, in Settings.
• Legal obligation (Art. 6(1)(c)): tax and accounting records, and answering lawful requests.

• Running the product: accounts, journey progress, puzzle sessions, the rating, the scan, XP, streaks and achievements.
• The leaderboard and your profile: your nickname, your rating, your sprint scores, your XP and your rank. The nickname is a pseudonym we generate, so nothing there identifies you unless you rename yourself into something that does. Anyone can report or block a name from the board; a name that impersonates or abuses gets blanked.
• Email you asked for: the three onboarding notes, streak reminders and the streak-lost note, the weekly digest, achievement notices, a reminder if you leave a checkout unfinished and, three days later, one discount code for yourself if you still have not bought, and (once, three days after you buy) one discount offer on a sibling chess product of ours. Each is a switch in Settings and each carries an unsubscribe link. On top of that, transactional mail (receipts, account notices) that we send whether or not you opted into anything.
• Improving the trainer: which puzzles are missed most often, which lessons fail, and debugging.
• Security and compliance: rate limiting, abuse prevention, legal obligations.

We never sell your personal data and we do not share it with anyone for advertising.

These providers process data on our behalf and on our instructions only, under data processing agreements:

• Supabase: authentication and database hosting.
• Vercel: website hosting, content delivery and server logs.
• Stripe: payment processing (PCI-DSS certified); receives your email address for the receipt.
• Resend: delivery of transactional and opted-in email, and of support messages sent from inside the mobile app.
• Web3Forms: delivery of the contact form on this website; your name, email address and message pass through it to reach our inbox.
• Google: optional sign-in with Google.
• PostHog: product analytics. Pageviews and usage events, tied to your account id AND your email address once you sign in. No advertising trackers.
• Sentry: error reports from the website, configured not to attach personally identifying request data.
• RevenueCat, and through it Apple and Google: an unlock bought in a mobile app. We store the store receipt (transaction and product id, the store, whether it was a sandbox, the amount) because it is what grants your access.
• DiceBear: the default avatars are drawn by their public service, so your browser fetches the image from them, with the seed in the address. The seed is your account id, which is already public on your profile.
• DigitalOcean: the nightly database backup is written to their object storage, and GitHub, where the job that writes it runs. A backup contains everything in section 2.
• Our sibling chess products (ChessEndings, ChessBegins, DarkSquares, ChessAtlas), run by the same company. Three days after you buy, your email address is sent to one of them so it can mint you a single-use discount code, and they may ask us whether an address of theirs already owns Pro here. Nothing else crosses, and nothing goes to anyone outside the company.
• Lichess and Chess.com: the scan reads public games for the username you give us, through their public APIs. The puzzles themselves come from the Lichess puzzle database (CC0), which is queried offline, from aggregate data that contains no personal data and never from your request.

Some of these providers process data outside the European Economic Area, notably in the United States. Where they do, the transfer is covered by the EU-US Data Privacy Framework or by the European Commission's Standard Contractual Clauses. Ask at hello@chesstactics.app for the details of a specific one.

• Account and training data: kept while the account exists. Deleting the account removes the profile, the attempts and sessions, the scanned games and their findings, and the achievements from the live database immediately.
• Backups: the database is dumped nightly to encrypted object storage, so that a bad migration is recoverable. A deleted account is gone from the live database at once and disappears from the backups as they roll over, within 30 days.
• Activity and email logs: 90 days. Anti-abuse counters: 24 hours.
• Reports and blocks. If you report a name we store who reported whom, the reason you picked, and the name as it read at the time, so that a rename cannot hide it; if you block someone we store that pair. Neither is readable by any player. A report is kept until it is resolved and for a year after.
• Billing records: kept for 10 years, as French accounting law requires. Purchases are never edited after the fact; a refund is recorded as a separate reversal. When an account is deleted its purchase record stays, detached from any user, as an anonymous accounting entry. An unlock bought in a mobile app is held by Apple, Google and RevenueCat on their own terms; our copy of the receipt goes when the account does.
• Support messages: kept up to 3 years after the conversation ends.
• Server logs: a short rolling window, set by our hosting provider.

Under the GDPR you have the right to:

• access your data and get a copy (Art. 15)
• correct inaccurate data (Art. 16)
• have your data erased (Art. 17), account deletion is self-service, from Settings (see how to delete your account)
• restrict processing (Art. 18)
• receive your data in a portable, machine-readable format (Art. 20)
• object to processing based on legitimate interests, and to direct marketing (Art. 21)
• withdraw consent at any time, without affecting what was processed before

Write to hello@chesstactics.app or use the contact form. We answer within one month.

Two kinds, and no advertising. The cookies that keep you signed in, and one analytics cookie from PostHog so a visitor is counted once across pages rather than once per page. There are no advertising trackers and no third-party ad cookies. Your browser's local storage holds interface preferences and, on your first visit, where you came from (the referring site, the page you landed on and any campaign tags in the address) so we know which pages bring people in.

Data is encrypted in transit. Authentication is handled by Supabase. Access to rows is enforced in the database by row-level security and narrowed further by column grants, so a policy that lets you edit your profile does not let you edit your billing status. Puzzle solutions are revoked at the column level rather than merely hidden by a query, and every result you submit is re-derived on the server rather than believed. No system is perfectly secure, but the product is built so that the server holds no more about you than it needs and trusts nothing the client asserts.

chesstactics is not directed at children under thirteen (13) and we do not knowingly collect their data. Below the age of digital consent in your country, fifteen (15) in France, an account needs the consent of a parent or guardian. If you believe a child has given us personal data, write to hello@chesstactics.app and we will delete it.

We may update this policy as the product or the law changes. Material changes are announced by updating the date above and, if you have an account, by email or a notice in the product.

For any privacy question, or to exercise any of the rights above, write to hello@chesstactics.app or use the contact page.

If our answer does not satisfy you, you can complain to the French supervisory authority, CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr), or to the authority where you live.