Privacy Policy

1. Data Controller

The data controller is Yoan Bousquet, operating OpenChess from France. For any privacy-related inquiries, contact us at:

2. Data We Collect

• Account data: email address, username, first name, last name (optional), country, language preference, profile image (optional), bio (optional).

• Usage data: chess libraries, opening lines, practice statistics, game reviews, puzzle attempts, annotations, achievement progress.

• Technical data: session tokens, IP address (for security), browser user agent (for security), timestamps of actions.

• Payment data: Paddle (our Merchant of Record) handles all payment information directly. We only store your Paddle customer ID and subscription status. We never see or store your credit card details.

• Social login data: if you register using a third-party provider (Google, Lichess), we receive your name, email address, and profile picture from that provider. We do not receive your password or access to your account on these platforms.

3. Legal Basis for Processing

• Contract performance: processing necessary to provide the OpenChess service (account management, chess training features).

• Consent: optional data like profile information, language preferences, and notification settings.

• Legitimate interest: security monitoring, service improvement, abuse prevention.

4. How We Use Your Data

• Provide and maintain the chess training service

• Track your learning progress with spaced repetition algorithms

• Enable community features (public annotations, leaderboards, profiles)

• Send notifications about your learning progress (if enabled)

• Process subscription payments through Paddle

• Ensure security and prevent abuse

• Improve the service based on aggregated usage patterns

5. Public Profile

By default, your OpenChess profile is public, like on Lichess or Chess.com. It is accessible to logged-out visitors, including via a direct link, and may be indexed by search engines. The following are then publicly visible: your username, bio, country, learning statistics, study time, badges, and the content of the repertoires you have marked as public. Your email address and account data are never made public. You can make your profile private at any time from Settings → Profile; it is then visible only to you, and visitors get a not-found page.

6. Data Sharing

We share your data only with:

• Paddle.com: payment processing and subscription management (as Merchant of Record)

• Railway.app: hosting infrastructure (data processing agreement in place)

• Vercel: frontend hosting (no personal data stored)

We do not sell, rent, or trade your personal data to third parties.

In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal data may be transferred to the acquiring entity. We will notify you via email before your data is transferred and becomes subject to a different privacy policy.

7. Data Retention

Your data is retained for as long as your account is active. When you delete your account, personal data is permanently deleted within 30 days. Anonymized usage statistics may be retained for service improvement.

8. Your Rights (GDPR)

As an EU resident, you have the following rights:

• Right of access: request a copy of your personal data

• Right to rectification: correct inaccurate personal data

• Right to erasure: request deletion of your personal data

• Right to restriction: limit how we process your data

• Right to data portability: receive your data in a machine-readable format

• Right to object: object to processing based on legitimate interest

• Right to withdraw consent: withdraw consent at any time for optional processing

You can exercise these rights through your account settings (data export, account deletion) or by contacting us at the email below.

You also have the right to lodge a complaint with the French data protection authority (CNIL) at https://www.cnil.fr.

9. Cookies and Local Storage

OpenChess uses only strictly necessary cookies and functional local storage. We do not use any tracking, advertising, or analytics cookies.

Strictly necessary (required for the service to function)

• better-auth.session_token — HttpOnly session cookie, 7 days, identifies your authenticated session

Functional storage (your preferences, stored in your browser)

• Language preference — remembers your chosen language (localStorage)

• Theme — light or dark mode choice (localStorage)

• Board & sound settings — chessboard appearance and sound preferences (localStorage)

• Tree display — opening tree layout preferences (localStorage)

• Annotation drafts — unsaved annotation editor work (localStorage)

• Data cache — cached API responses for faster page loads (localStorage)

• Filter presets — saved search filters (localStorage)

• Session recovery — restores interrupted practice sessions (localStorage)

Third-party services

• Paddle (payment processing) — may set transient cookies during checkout transactions. Paddle acts as our Merchant of Record and handles its own compliance.

• Sentry (error monitoring) — reports errors via API only, does not set cookies in your browser.

Privacy-friendly analytics

• Vercel Analytics — measures page performance (Core Web Vitals). Does not use cookies. Does not collect personal data.

• Umami — counts page views, referral sources, and device types. Does not use cookies. Does not collect personal data. Self-hosted on our own infrastructure.

We do not use tracking cookies, advertising cookies, or retargeting. No personal data is shared with third parties for analytics purposes.

10. Data Security

We implement appropriate technical and organizational measures to protect your data, including HTTPS encryption, secure session management, access controls, and regular security reviews.

11. Children's Privacy

OpenChess requires users to be at least 13 years old. We do not knowingly collect personal data from children under 13. If we become aware of such collection, we will delete the data promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes via email. The "Last updated" date at the top of this page indicates the most recent revision.

13. Contact

For any questions about this Privacy Policy or to exercise your GDPR rights, contact us at: