Privacy Policy

CipherChess is a chess analysis platform that helps you import, study, and improve your games. We take privacy seriously: most of what we do runs in your browser, and we collect only the information needed to provide and improve the service.

This Privacy Policy explains what information we collect about you, how we use and share it, the choices you have, and the rights you can exercise. It applies to cipherchess.com and the related applications and services operated by us (collectively, the "Service").

Reading the whole document takes about ten minutes. If you only have a moment, the "Overview" box below summarises the key points.

For the purposes of the EU and UK General Data Protection Regulations ("GDPR" and "UK GDPR") and analogous laws elsewhere, the "controller" of your personal information is:

You can contact us about anything in this policy — including to exercise your privacy rights — using the details in the Contact us section.

This policy covers personal information that we collect and process when you:

• visit cipherchess.com or any subdomain we operate;
• create or sign in to a CipherChess account;
• connect a Lichess or Chess.com account to import your games;
• use any feature of the Service, including engine analysis, opening explorer, repertoire builder, PDF book scanner, or game viewer;
• contact us, send feedback, or otherwise communicate with us.

It does not cover personal information processed by independent third parties whose services you choose to connect (such as Lichess, Chess.com, or Google) when you use them outside CipherChess. Those services are governed by their own privacy policies.

We collect three broad categories of information.

4.1 Information you give us directly

4.2 Information we collect automatically

4.3 Information we receive from third parties

4.4 Information we do not collect

We do not collect government-issued identifiers, payment card details, biometric data, precise GPS location, contacts lists, or special categories of personal data (such as data about race, ethnicity, religion, political opinions, sexual orientation, or health) other than what you may voluntarily include in feedback or user-generated content.

We use the information described above for the following purposes:

If you are in the European Economic Area or the United Kingdom, we rely on the following lawful bases under Article 6 of the GDPR / UK GDPR:

A "cookie" is a small file your browser stores on your device. We also use related technologies such as localStorage, sessionStorage, and IndexedDB. We only set non-essential cookies after you opt in.

7.1 Strictly necessary (always on)

These keep the Service working. Disabling them would break sign-in, save settings, or break the chess board itself. Under GDPR ePrivacy rules, they are exempt from consent requirements.

7.2 Analytics (off until you opt in)

These help us understand which features get used and where the UI gets stuck. Nothing here loads or sets cookies until you explicitly grant consent. We use Google Consent Mode v2, which means even when Google Analytics is loaded, measurement cookies are denied by default.

7.3 Managing your cookie preferences

You can change your choice at any time using the cookie button in the bottom-left corner of every page, or right here:

You can also delete cookies and clear local storage from your browser's settings. Note that deleting strictly necessary cookies will sign you out and reset your preferences.

We share personal information only in the limited circumstances described below. We never sell your personal information, and we do not share it for cross-context behavioural advertising.

• Service providers (sub-processors). Vendors that help us operate the Service — hosting, authentication, databases, analytics — process personal information on our behalf under contractual data-protection commitments. They are listed in Sub-processors.
• Connected platforms you choose. When you authorise a Lichess connection or enter a Chess.com username, your browser and our servers exchange data with those platforms strictly to perform the action you requested.
• Legal compliance. We may disclose information if we are required to do so by valid legal process (subpoena, court order, etc.) or where we have a good-faith belief it is necessary to investigate fraud, protect the safety of any person, or enforce our Terms.
• Business transfers. If CipherChess is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction. We will notify you (e.g., by email and/or a prominent notice on the Service) of any change in ownership and any choices you may have.
• With your consent. For anything else not described in this policy, we will ask you first.

We engage the following organisations to process personal information on our behalf. Each is bound by a data-processing agreement that requires them to protect your information at least to the standard of this policy.

CipherChess operates globally. The sub-processors listed above are based in several countries, including the United States, France, and others. This means your personal information may be transferred to, stored in, or processed in a country other than the one in which you live.

When we transfer personal information from the EEA, UK, or Switzerland to a country that has not received an adequacy decision from the relevant authority, we rely on appropriate safeguards under Article 46 GDPR / UK GDPR, including:

• Standard Contractual Clauses (the EU SCCs and the UK International Data Transfer Addendum) with our sub-processors;
• where applicable, the EU-U.S. Data Privacy Framework, the UK Extension to the DPF, and the Swiss-U.S. DPF;
• supplementary technical measures such as encryption in transit and at rest.

You can request a copy of the transfer mechanisms in place by contacting us.

We keep personal information only for as long as we need it to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Specifically:

We take reasonable and appropriate technical and organisational measures to protect your information from unauthorised access, alteration, disclosure, and destruction. Those measures include:

• encryption in transit (HTTPS / TLS) for all traffic to and from the Service;
• encryption at rest for the databases that hold your account and content;
• password hashing with industry-standard algorithms (handled by our auth provider);
• token-based session authentication with refresh-token rotation;
• least-privilege access controls for our team and our sub-processors;
• regular dependency updates and security patching;
• logging and monitoring designed to detect abnormal activity.

No system is perfectly secure. If we ever discover a breach affecting your personal information, we will notify you and the relevant supervisory authority in line with applicable law (within 72 hours under GDPR / UK GDPR where the breach is likely to result in a risk to your rights and freedoms).

Wherever you live, you have meaningful choices about your personal information. The list below applies broadly; jurisdiction-specific rights are detailed in the next sections.

• Access. Request a copy of the personal information we hold about you.
• Correction. Ask us to fix information that is inaccurate or incomplete.
• Deletion. Ask us to delete your account and associated data.
• Portability. Receive a machine-readable export of the data you provided. Saved games can be exported as PGN at any time inside the app.
• Restriction or objection. Ask us to limit or stop certain processing.
• Withdraw consent. Turn off optional analytics any time via the cookie settings.
• Opt out of communications. Use the unsubscribe link in any non-essential email, or contact us.

To exercise any of these rights, email us at the address in the Contact us section. We will reply within 30 days. We may need to verify your identity before acting; we will only ask for the minimum information necessary to do so.

If you are in the EEA, the UK, or Switzerland, the GDPR / UK GDPR grants you all of the rights listed above plus the following:

• the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (we do not carry out such processing — see Automated decisions);
• the right to lodge a complaint with your local supervisory authority. You can find the relevant authority at edpb.europa.eu/members (EEA) or ico.org.uk (UK).

We would appreciate the chance to address your concerns first — please contact us before lodging a complaint.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), provides you with specific rights regarding your personal information.

15.1 Categories of personal information we collect

In the past 12 months we have collected the following CCPA categories:

• Identifiers — email address, account identifier, IP address, device identifiers.
• Internet or other electronic network activity — browsing history within the Service, interaction information, and information about your interactions with our pages.
• Geolocation data — coarse location inferred from IP address (country / region only).
• Inferences — limited usage-pattern inferences drawn from analytics events.

The sources, purposes, and recipients of each category are described in Sections 4, 5, and 8 above.

15.2 Sale and sharing

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not sold or shared personal information in the previous 12 months.

15.3 Sensitive personal information

We do not collect or use sensitive personal information for purposes that would require a separate notice or opt-out under CPRA Section 1798.121.

15.4 Your CCPA rights

• Right to know what personal information we collect, use, disclose, and share.
• Right to delete personal information we have collected from you, subject to certain exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing — not applicable, because we do not sell or share.
• Right to limit use of sensitive personal information — not applicable, see 15.3.
• Right to non-discrimination for exercising your rights.

To exercise any of these rights, email us at the address in Contact us. You may designate an authorised agent to act on your behalf; we will require written authorisation and will verify your identity directly where the law allows.

Residents of other regions — including Brazil (LGPD), Canada (PIPEDA), Australia (Privacy Act 1988), South Africa (POPIA), Japan (APPI), and similar jurisdictions — have rights broadly equivalent to those described above. If your local law grants you additional rights, you may exercise them by contacting us.

The Service is not directed to children under the age of 13 (or 16 in the EEA and UK), and we do not knowingly collect personal information from them. If you are a parent or guardian and believe a child has provided us with personal information without your consent, please contact us and we will delete the information promptly.

Some browsers transmit a "Do Not Track" (DNT) signal. Because there is no industry standard for how to interpret DNT, we do not currently respond to it.

We do honour the Global Privacy Control (GPC) signal where legally required. If your browser sends a GPC signal, we treat it as a request to opt out of the "sale" or "sharing" of personal information under CCPA — even though we do not sell or share to begin with — and we will not enable optional analytics until you affirmatively choose to.

We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing. The chess engines and analytics tools inside CipherChess operate on chess positions, not on you as a person.

The Service may contain links to third-party websites or services (for example, Lichess game pages, Chess.com profiles, GitHub repositories, or Discord). When you follow such a link you leave CipherChess; we are not responsible for the content or privacy practices of the site you arrive at. Read their privacy policies before submitting personal information.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or legal requirements. When we do, we will:

• update the "Last updated" date at the top;
• increment the version number;
• where the change is material, surface it in the cookie banner or by email so you can review it before continuing to use the Service.

Your continued use of the Service after a revised policy takes effect constitutes acceptance of the changes, to the extent permitted by law.

For any privacy-related question, request, or complaint, please reach out:

We aim to respond to all requests within 30 days. If you are not satisfied with our response, you may have the right to lodge a complaint with a supervisory authority — see Sections 14 and 15.