Privacy Policy

The controller of your personal data under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act is:

• Contract (Art. 6(1)(b)): operating your account, tracking your progress, delivering Pro purchases, support.
• Legitimate interests (Art. 6(1)(f)): security, fraud and abuse prevention, service improvement and debugging.
• Consent (Art. 6(1)(a)): optional emails (streak reminders, weekly digest); withdrawable at any time.
• Legal obligation (Art. 6(1)(c)): tax and accounting records, responding to lawful requests.

• Running the product: accounts, progress tracking, mistake explanations, achievements, quotas.
• Leaderboards: your display name and ranking only, and only if your profile is public. You control this in your settings.
• Emails you opt into: streak reminders and the weekly digest, each with an unsubscribe link, plus transactional emails (receipts, account notices).
• Improving the service: aggregate usage analysis and debugging.
• Security and compliance: preventing abuse, meeting legal obligations.

We never sell your personal data, and we share none of it with advertising networks.

We share data with providers who process it on our behalf, under GDPR-compliant data processing agreements:

• Supabase: authentication and database hosting.
• Stripe: payment processing on the website (PCI-DSS certified); receives your email for receipts and billing.
• Vercel: website hosting and content delivery (server logs).
• Resend: transactional and opt-in email delivery, and support messages sent from inside the mobile apps.
• Web3Forms: contact form delivery from this website; your email and message are transmitted to reach our support inbox.
• Google: optional sign-in with Google (OAuth).
• PostHog: product analytics on this website and in the mobile apps: the pages and screens you view and your training activity, under a random identifier kept in a cookie (website) or on the device (apps), linked to your account identifier and email address once you sign in. It is never shared with an advertising network.
• Sentry (mobile apps): crash reports and a sample of performance measurements, with the error details, your device model, its operating system and the app version; no email address or other identifying details are sent.
• Apple App Store / Google Play and RevenueCat (mobile apps): purchase processing and subscription status. The store handles your payment data directly; RevenueCat stores an app user identifier and purchase receipts, no email or card data.
• Lichess: our servers query the Lichess tablebase API with chess positions only, which contain no personal data. The scan feature fetches public games from the Lichess and Chess.com public APIs for the username you provide.

Some providers process data outside the European Economic Area (notably in the United States). Where they do, transfers are protected by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses. You can request details of these safeguards at support@chessendings.com.

• Account and training data: kept while your account exists. Deleting your account from the dashboard removes your profile and training data immediately.
• Billing records: kept for 10 years, as French accounting law requires. Purchase records are never edited retroactively; refunds are recorded as reversals.
• Support messages: kept up to 3 years after resolution.
• Server logs: kept for a short rolling window by our hosting provider.
• Guest data: stored only in your browser; clear your browser storage to remove it.

Under the GDPR you have the right to:

• access your data and get a copy (Art. 15)
• correct inaccurate data (Art. 16)
• have your data erased (Art. 17); account deletion is self-service from the dashboard
• restrict processing (Art. 18)
• receive your data in a portable, machine-readable format (Art. 20)
• object to processing based on legitimate interests, and to any direct marketing (Art. 21)
• withdraw consent at any time, without affecting prior processing

To exercise any of these rights, email support@chessendings.com. We respond within one month. You also have the right to lodge a complaint with a supervisory authority (see section 13).

We use two kinds of cookie, and no advertising ones. The functional cookies keep you signed in and remember your language and your theme. The product-analytics cookie is set by PostHog, our analytics processor, on this website's own domain: it holds a random identifier so that the pages and training steps of one visit can be counted together (see PostHog above); it is never shared with an advertising network. We also use your browser's local storage for preferences and for guest training progress; that data stays on your device.

One entry does leave your device. So that we can tell which channels bring people to ChessEndings, local storage keeps a short record of your first visit: the site that referred you (the site name only, such as lichess.org, never the page you came from), the first page of ours you opened, any campaign tags in the link you followed, whether you arrived on a phone, a tablet or a computer, and the date of that first visit. That record is sent to our analytics processor when you arrive and again if you create an account, so that we can see how many people a channel brings and not only how many sign up. It is the same record either way. It contains no name, no address and nothing about what you read here, but it travels with the identifier your analytics profile is kept under, and once you have an account that profile is your account: it is your personal data and the rights in this policy apply to it. It is never used to advertise to you.

The entry is discarded after 90 days, and clearing your browser storage removes it immediately. If you create an account, a copy of that record is also kept with the account on our own servers, so that a later purchase can be counted for the channel that brought you; that copy is deleted with the account.

Data is encrypted in transit (TLS), authentication is handled by Supabase with hashed credentials, access to production data is restricted, and database access is enforced by row-level security. No system is perfectly secure, but we design the Service so that the server never trusts unverified client input and holds no more personal data than the product needs.

The Service is not directed at children under thirteen (13) and we do not knowingly collect their data. Users under the age of digital consent in their country (fifteen (15) in France) need parental consent to use the Service with an account. If you believe a child provided us personal data, contact us at support@chessendings.com and we will delete it.

We may update this policy as the product or the law evolves. Material changes are announced by updating the date above and, if you have an account, by email or an in-product notice.

For any privacy question or to exercise your rights, write to support@chessendings.com or use the contact page.

If you are not satisfied with our response, you may lodge a complaint with the French supervisory authority: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr), or with the authority of your country of residence.