Privacy Policy

Last updated: October 11, 2026

In short: we store your account, your chess files and how you use the site, only to run Chess.ceo. Staff never read your chess files. No tracking, no ads, no selling data, no AI training. GDPR applies in full.

Controller

ChessGM OÜ, Sepapaja tn 6, Tallinn 15551, Estonia — admin@chess.ceo. Data is stored in the EU.

What we collect

Email — login and account recovery. If you sign in with Google, also your Google account ID.
Username and avatar — your display identity, plus a history of username changes.
Country — looked up once from your IP address at signup. The IP itself isn't kept with it.
Chess content — your games and collections, their version history, and who you share them with.
Puzzle activity — attempts, rating, streaks, favourites and votes.
Payments — subscription status, payment records and account balance. Card details stay with Stripe, Apple or Google.
Usage — last login, the days you were active, and which platforms you use (web, app, desktop). The desktop app also registers a device ID per installation, for licensing.
Cloud engines — when you rented an engine and what it cost.
Legal — which Terms and Privacy Policy versions you accepted, and when.
Security logs — IP address, browser and login times, anonymized after 30 days.

Legal basis: GDPR Art. 6(1)(b) for the service, Art. 6(1)(f) for security.

What we don't do

No tracking across other sites, no fingerprinting, no advertising profiles. Visitors without an account are only counted in aggregate.
No selling or sharing of data with advertisers or brokers.
No AI training on your data.
Staff do not open or read your chess files. They are only processed automatically, to run the features you use, such as search and the opening tree.

Encrypted storage

Optional AES-256-GCM client-side encryption. The key never leaves your device; we cannot read encrypted files. Position search uses blind index tokens.

Third parties

Google — the sign-in script loads from accounts.google.com. If you sign in with Google, Google tells us your email and account ID.
Stripe, Apple, Google — payments. They receive your email and payment details.
Resend — sends our emails (login codes, receipts). It receives your email address and the message.
Lichess — your browser contacts it directly when you browse Lichess games or players.
flagcdn.com — serves country flag images.

Apart from what is listed, each one only sees your IP address for that request.

Payments

Processed by Stripe, Apple or Google. We store only a subscription reference, never card details.

Cookies

Essential cookies only: authentication, refresh token, CSRF. No consent banner is required.

Your rights

View and edit your data, and export your games as PGN, in your settings. To delete your account, email admin@chess.ceo; all data is removed within 30 days.

Retention

Account data while the account exists; security logs 30 days; deleted accounts purged within 30 days.

Changes

Significant changes are announced by email or on the site. The date above shows the last revision.