Privacy Policy

Nikolas Burk, Erich-Nehlhans-Str. 29, 10247 Berlin, Germany

Email: nikolas.burk@gmail.com

We process personal data only to the extent necessary to provide a functional website and our services. Data collected includes account information (email, name), game data you import, analysis requests, AI coach conversations, images you upload to create puzzles, and subscription and purchase information. Data is stored locally on your device via LiveStore and synced to our servers for persistence.

We process your data based on the following legal grounds (Art. 6(1) GDPR):

• Consent (Art. 6(1)(a)) — e.g. when you sign up or connect OAuth accounts
• Performance of a contract (Art. 6(1)(b)) — e.g. providing analysis, puzzle, and coaching features
• Legitimate interest (Art. 6(1)(f)) — e.g. security, fraud prevention, service improvement

This website is hosted on Cloudflare (Workers, D1 database, Durable Objects for real-time sync). Cloudflare may process connection data (IP address, timestamps) in the EU and US. We have a Data Processing Agreement (DPA) with Cloudflare.

You can register using the following methods:

• Email & Password — your password is stored as a bcrypt hash, never in plain text
• OAuth via GitHub, Google, or Lichess — we only request the minimum required scopes (email, profile). OAuth tokens are stored securely on our servers.
• Session data — we store your IP address, user agent, and geolocation data (city, country, coordinates) provided by Cloudflare for session security

Game imports, puzzle progress, analysis requests, and UI state are stored locally in LiveStore (SQLite in your browser) and synced to our servers per user account. Stockfish analysis requests contain only chess positions (no personal data).

When you create a puzzle from a screenshot, the image you select is uploaded to our servers and processed to detect the chessboard and extract the position (FEN). Uploaded images are used only for this purpose, are not used for advertising, and are not shared with third parties for their own purposes.

Chat messages and chess positions are sent to the Vercel AI Gateway (currently using Google Gemini). Messages are processed to generate responses and are not permanently stored by the third-party provider for training purposes.

Paid subscriptions are processed through RevenueCat (RevenueCat, Inc., USA) together with the Google Play billing system. To validate purchases and manage your subscription entitlements, RevenueCat collects a device identifier (e.g. Android ID / app-set ID) and your purchase history (subscription status, transactions). We do not receive your full payment card details; these are handled by Google Play. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in fraud prevention (Art. 6(1)(f) GDPR).

We use Brevo (formerly Sendinblue) to send verification and password reset emails. Your email address and name are shared with Brevo for this purpose. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

We only use technically necessary first-party session cookies for authentication (Better Auth). We do not use tracking cookies, analytics cookies, or third-party cookies. No cookie consent banner is required.

Some of our service providers are based in the United States: Cloudflare, Vercel (AI Gateway), Google (Gemini AI), GitHub (OAuth), and RevenueCat (subscription processing). These transfers are protected by Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework.

Under the GDPR, you have the following rights:

• Right of access (Art. 15) — request information about your stored data
• Right to rectification (Art. 16) — correct inaccurate data
• Right to erasure (Art. 17) — request deletion of your data
• Right to restriction (Art. 18) — restrict processing of your data
• Right to data portability (Art. 20) — receive your data in a machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interest
• Right to lodge a complaint with a supervisory authority

The competent supervisory authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

You can delete your account at any time via the app settings. This will permanently remove your personal data from our servers. Some data may be retained for a limited period to comply with legal obligations.

We may update this privacy policy from time to time. The current version is always available at this URL.