Privacy policy

The controller of your personal data under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act is:

• Contract (Art. 6(1)(b)): running your account, tracking progress, delivering what you bought, answering support.
• Legitimate interests (Art. 6(1)(f)): security, abuse and fraud prevention, debugging, and improving the product.
• Consent (Art. 6(1)(a)): optional email (streak reminders, the weekly digest, achievement notices) and appearing on the leaderboard. Withdrawable at any time, in Settings.
• Legal obligation (Art. 6(1)(c)): tax and accounting records, and answering lawful requests.

• Running the product: accounts, journey progress, puzzle sessions, the rating, the scan, XP, streaks and achievements.
• The leaderboard: your display name and your rank, and only if you turned it on. It is off by default, and the switch sits beside the name field so what is being published is in front of you when you consent.
• Email you asked for: streak reminders, the weekly digest and achievement notices, each with an unsubscribe link, plus transactional mail (receipts, account notices) that we send whether or not you opted into anything.
• Improving the trainer: which lines are failed most often, which puzzles are too hard, and debugging.
• Security and compliance: rate limiting, abuse prevention, legal obligations.

We never sell your personal data and we do not share it with anyone for advertising.

These providers process data on our behalf and on our instructions only, under data processing agreements:

• Supabase: authentication and database hosting.
• Vercel: website hosting, content delivery and server logs.
• Stripe: payment processing on the web (PCI-DSS certified); receives your email address for the receipt.
• Resend: delivery of transactional and opted-in email.
• Web3Forms: delivery of the contact form; your name, email address and message pass through it to reach our inbox.
• Google: optional sign-in with Google. Apple: optional sign in with Apple, in the mobile app.
• Apple App Store / Google Play and RevenueCat (mobile app only): purchase processing and entitlement status. The store handles the payment itself; RevenueCat holds an app user identifier and the receipts, no card data.
• PostHog (mobile app only): product analytics, usage events, no advertising trackers.
• Sentry (mobile app only): crash and performance reports, configured not to attach personally identifying request data.
• Lichess and Chess.com: the scan reads public games for the username you give us, through their public APIs. The puzzles themselves come from the Lichess puzzle database (CC0), which is queried offline, from aggregate data that contains no personal data and never from your request.

Some of these providers process data outside the European Economic Area, notably in the United States. Where they do, the transfer is covered by the EU-US Data Privacy Framework or by the European Commission's Standard Contractual Clauses. Ask at hello@chesstactics.app for the details of a specific one.

• Account and training data: kept while the account exists. Deleting the account removes the profile, the progress, the review schedule and the scan findings immediately.
• Billing records: kept for 10 years, as French accounting law requires. Purchases are never edited after the fact; a refund is recorded as a separate reversal.
• Support messages: kept up to 3 years after the conversation ends.
• Server logs: a short rolling window, set by our hosting provider.
• Anonymous scans: not retained against a person, because there is no account to retain them against.

Under the GDPR you have the right to:

• access your data and get a copy (Art. 15)
• correct inaccurate data (Art. 16)
• have your data erased (Art. 17), account deletion is self-service, from Settings on the web and in the app (see how to delete your account)
• restrict processing (Art. 18)
• receive your data in a portable, machine-readable format (Art. 20)
• object to processing based on legitimate interests, and to direct marketing (Art. 21)
• withdraw consent at any time, without affecting what was processed before

Write to hello@chesstactics.app or use the contact form. We answer within one month.

Only functional cookies: the ones that keep you signed in. There are no advertising trackers and no third-party ad cookies, which is why there is no cookie banner, consent is required for the cookies we do not set. Your browser's local storage holds interface preferences, and stays on your device.

Data is encrypted in transit. Authentication is handled by Supabase. Access to rows is enforced in the database by row-level security and narrowed further by column grants, so a policy that lets you edit your profile does not let you edit your billing status. Puzzle solutions are revoked at the column level rather than merely hidden by a query, and every result you submit is re-derived on the server rather than believed. No system is perfectly secure, but the product is built so that the server holds no more about you than it needs and trusts nothing the client asserts.

chesstactics is not directed at children under thirteen (13) and we do not knowingly collect their data. Below the age of digital consent in your country, fifteen (15) in France, an account needs the consent of a parent or guardian. If you believe a child has given us personal data, write to hello@chesstactics.app and we will delete it.

We may update this policy as the product or the law changes. Material changes are announced by updating the date above and, if you have an account, by email or a notice in the product.

For any privacy question, or to exercise any of the rights above, write to hello@chesstactics.app or use the contact page.

If our answer does not satisfy you, you can complain to the French supervisory authority, CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr), or to the authority where you live.