Privacy policy

ChessCue is the controller responsible for the personal data described in this policy. This policy applies to people who visit our website, create an account, use ChessCue, or contact us.

ChessCue is currently identified by its trading name and is available only for closed prelaunch testing. Before public launch, this section will identify the responsible legal entity, jurisdiction, postal address, and any required representative or data protection officer. Privacy questions and rights requests can be sent to privacy@chesscue.com.

ChessCue is intended for adults. You must be at least 18 years old to create an account or use ChessCue. We do not knowingly collect personal data from anyone under 18.

If you believe that someone under 18 has provided personal data to ChessCue, contact us at privacy@chesscue.com and we will review and, where appropriate, delete the account and data.

The data we handle depends on how you use ChessCue.

• Account and profile data, including your name, email address, profile image, authentication methods, passkeys, multi factor authentication settings, plan, and account settings. Passwords, active authorization tokens, passkey secrets, and other authentication secrets are not included in personal data exports.
• Chess and coaching data, including positions, moves, PGN records, imported games, results, preferences, coach conversations, and remembered coaching notes.
• Integration data, including Chess.com or Lichess usernames, Lichess authorization tokens, synchronization status, and imported game history. A Chess.com username is a public profile identifier: ChessCue does not receive a Chess.com authorization token or verify that you control that account. Imported games may contain other people's usernames and personal data, including player names, game records, and other information included by the source platform. Only import games you are permitted to share with ChessCue and avoid importing unnecessary personal data.
• Voice data that you choose to send for live coaching or review, together with resulting transcripts and coach responses.
• Support requests and correspondence, including the content and metadata of messages you send us, feedback, and privacy requests.
• ChessCue does not currently collect billing or transaction data. If paid plans are enabled, this may include transaction, refund, tax, and chargeback records, together with subscription and order identifiers. Payment card details would be handled by Lemon Squeezy rather than stored by ChessCue.
• Technical and security data, including IP address, browser and device details, session records, authentication events, rate limit records, and activity dates.
• Usage data, including page views, feature interactions, quota consumption, and diagnostic information.

We collect personal data directly from you, automatically from your device and browser, and from the services you choose to connect or use.

• Directly from you: account registration, profile updates, game play, coaching requests, voice you choose to send, support requests, and privacy requests.
• From your device and browser: technical, security, and usage data generated when you use ChessCue, including authentication and rate limit records.
• From connected services: Google sign in, Chess.com, and Lichess may provide the identifiers, authorization information, and game data needed for the connection you request.
• From imported games: PGN records may include other players' usernames, moves, results, and source platform data. We collect this information from the public game records associated with the Chess.com username you enter or from the Lichess account you authorize. We use it only to provide your requested import and coaching features. We do not use imported third party data to contact other players or build profiles about them. We cannot readily identify or contact opponents from this data, so this public policy provides information about that processing.

We use personal data only when we have a legal basis under applicable data protection law.

Account creation, account operation, requested integrations, and coaching use the contract basis. Security, abuse prevention, service reliability, and internal service measurement use legitimate interests where permitted and where your rights do not override them. Product analytics provided by PostHog uses consent. We use legal obligations or legal claims where required.

• To create and operate your account, provide games and coaching, synchronize requested integrations, and deliver account communications. This processing is necessary to perform our contract with you. If you do not provide account credentials or complete required security checks, you cannot create or use an account. Connected accounts, game imports, voice coaching, profile images, and paid features are optional; declining the related data prevents us from providing that optional feature.
• To secure ChessCue, prevent abuse, improve reliability, and measure service use internally. We rely on our legitimate interests where those interests do not override your rights.
• For other people's data in public or imported games, we rely on legitimate interests in providing the import and coaching features you request, protecting the service, and limiting use to those purposes. We do not use it to contact opponents or build profiles about them.
• To process data where we specifically ask for permission. You may withdraw consent at any time without affecting earlier lawful processing.
• To meet legal obligations and establish, exercise, or defend legal claims where necessary.

This table is ChessCue's notice at collection. It lists the categories collected, how they are used, disclosures for business purposes, sale or sharing status, and retention. It also describes the categories collected and disclosed during the preceding 12 months.

ChessCue does not sell any category of personal data or share it for cross context behavioral advertising. A No in the Sold or shared column applies to the entire category. Billing data is not collected unless paid plans are enabled.

ChessCue sends the chess context, prompts, coach history, and coaching notes needed to generate responses to Google Gemini. Voice features also send audio to Gemini for live processing or transcription. Live audio may travel directly from your browser to Google.

ChessCue does not intentionally keep raw voice recordings after a request is processed. Resulting transcripts and responses may be saved as coach history so that you can continue or review a conversation. You can clear this history in settings. When live session resumption is used, live session state, including audio and text, may be retained by Google for up to 24 hours under Google's Gemini API terms.

Under Google's current paid Gemini API terms, Google does not use prompts or responses to improve its products. Google may retain prompts, context, and responses for up to 55 days for abuse monitoring. ChessCue does not use your prompts, voice transcripts, or coach responses to train a ChessCue model.

AI coaching can be incomplete or inaccurate and does not make decisions with legal or similarly significant effects. ChessCue does not use voice data to identify you, create biometric templates, or infer sensitive traits. Avoid sensitive personal data in coach messages. Private coaching notes are limited to chess patterns, goals, and preferences, and you can clear them in Settings.

• Google Gemini API terms
• Google Gemini API abuse monitoring

ChessCue does not use automated processing to make decisions that produce legal or similarly significant effects about you. AI coaching provides suggestions and explanations, but it does not decide whether you may access essential services, receive credit, obtain insurance, or exercise a legal right.

ChessCue does not create profiles to infer sensitive traits from voice, chess games, coach messages, or usage data. It may create private game specific coaching notes for your requested coaching, as described in AI coaching and voice. Product analytics is used to understand feature interactions after consent and is not used to make decisions about you.

ChessCue currently stores cloud games, imported games, coach conversations, coaching notes, and linked account data as private account data. ChessCue does not currently provide public profiles or public sharing controls. Data is not publicly displayed by ChessCue unless a feature clearly says it will be shared.

Authorized ChessCue personnel may access personal data only when needed to operate, secure, support, investigate misuse, respond to legal requests, or comply with law. Access is limited by role and security controls. Provider personnel may process data under the provider's terms and controls.

The privacy preferences banner asks for affirmative consent before PostHog receives page views and interaction metadata. PostHog runs without cookies, session recording is disabled, and event data is kept for one year. Chat, coach response, and live transcription content is excluded. You can accept, decline, or withdraw consent from the sign in screen or user menu. Your choice may synchronize to your account. Refusing or withdrawing consent does not affect ChessCue functionality.

ChessCue uses essential cookies and browser storage for sign in, security, privacy choices, preferences, resumable games, local game history, and coach context. You can clear local data in Settings or through browser controls. ChessCue also keeps internal account sign in and daily activity records to administer accounts, measure use, improve reliability, and prevent abuse. It does not send these records to PostHog without analytics consent.

ChessCue does not respond to Do Not Track browser signals because ChessCue does not track your activity across unrelated websites or services. We also do not allow third parties to collect your activity over time across unrelated websites when you use ChessCue. Global Privacy Control is handled as described in California privacy rights.

• Authentication cookies: ChessCue's main session cookie lasts for rolling seven days and is refreshed at most once every 24 hours.
• chesscue_device cookie: a signed, HTTP only trusted device identifier used to recognise a verified browser for up to 30 days.
• device_trust_challenge cookie: a signed, HTTP only device verification challenge identifier that expires after 10 minutes.
• PostHog: cookieless product analytics enabled only after consent, with session recording disabled.
• Browser storage: chesscue_consent_preferences, preferences, resumable games, local game history, and coach context remain until you clear them or use the relevant privacy control.
• Cloudflare Turnstile: an essential third party browser request used to protect account creation from automated abuse.

ChessCue does not currently send marketing emails or use personal data for targeted advertising. The free plan may display contextual promotions for ChessCue plans and features based only on the ChessCue page or feature you are viewing. No third party advertising provider is currently enabled. We use Resend for authentication, security, account, and legal notice emails needed to provide and protect ChessCue.

If ChessCue begins marketing by email or uses personal data for targeted advertising, we will update this policy, obtain consent where required, and provide a clear unsubscribe or privacy preference control.

ChessCue discloses personal data only when needed to operate the service or meet a legal obligation. Recipients may include the service providers and independent integrations in the provider appendix, professional advisers such as lawyers and accountants, public authorities or law enforcement, and a buyer or successor during a business reorganization.

A buyer or successor may use the data only as permitted by applicable law. ChessCue will give notice before a transfer when required. International transfers are described below.

ChessCue's providers may process personal data in the European Economic Area, the United States, and other countries where they or their subprocessors operate. The provider appendix identifies the services involved.

For transfers from the European Economic Area, we rely on an adequacy decision where one applies. If no adequacy decision applies, we use appropriate safeguards such as the European Commission's 2021 Standard Contractual Clauses. For transfers from the United Kingdom, we use the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or the UK International Data Transfer Agreement. For Switzerland, we use the EU Standard Contractual Clauses as adapted for Swiss law. Where appropriate, we also apply supplementary technical and organizational safeguards.

Contact privacy@chesscue.com to request a copy of the safeguards that apply to your data.

• European Commission EU Standard Contractual Clauses
• UK IDTA and Addendum

We keep personal data only for as long as needed for the purpose for which it was collected, to provide ChessCue, or to meet legal, security, and dispute obligations. When a specific period is not stated below, we apply these criteria. We review retention every six calendar months, next due 25 February 2027, and before any provider, plan, or material processing change. The 10 minute device verification challenge and 30 day trusted device identifier periods are described in Cookies, analytics, and browser storage.

You can remove saved conversations, coaching notes, local game history, and cloud game history in Settings. After a verified account deletion request, we normally remove account data immediately and complete deletion from ChessCue controlled active systems within 30 days. Provider systems may take longer under their retention cycles.

An ordinary unbanned account is treated as inactive after 24 calendar months without genuine, non impersonated activity. ChessCue sends an initial warning 30 days before deletion and a reminder 7 days before deletion. Signing in cancels the scheduled deletion and starts a new inactivity period. ChessCue does not begin the deletion countdown unless Resend accepts the initial warning for sending.

At the deletion deadline, ChessCue removes active application data and retries available provider cleanup for ImageKit, Lichess, and PostHog. This cleanup covers the ImageKit source image, Lichess authorization token, and the PostHog person, events, and recordings associated with the ChessCue user identifier. After cleanup completes, ChessCue removes the email address, user identifier, tokens, provider identifiers, and error details from the deletion job. ChessCue keeps a non identifying completion record for 12 months, then deletes it. Cancelled jobs are scrubbed and deleted after 30 days.

Administrators and banned accounts are not deleted through the inactivity process. ChessCue may also retain limited data when a legal or security exception requires it, including records needed for fraud prevention, disputes, legal claims, or compliance.

• Account and profile data: while your account is active. Ordinary unbanned accounts enter the warning process after 24 calendar months without genuine activity, subject to the legal and security exceptions described below.
• Cloud games, imported games, coaching history, notes, transcripts, and responses: until you clear them or delete your account, unless a legal or security exception applies.
• Transient coach interaction records: up to 24 hours for retries and continuation.
• Profile images: the source is deleted when you remove the image. ImageKit delivery caches may retain requested copies for up to one year.
• Security and authentication records: the main database session expires after rolling seven days and is refreshed at most once every 24 hours. Expired session rows are removed by the hourly retention job. Vercel application and runtime logs are kept for 24 hours, with no log drain or Observability Plus.
• Rate limit records: Upstash analytics is disabled. ChessCue keeps only hashed rate limit enforcement counters for at most one hour.
• Administrator audit records: deleted 12 calendar months from the event.
• Provider managed backups and recovery copies: until the provider's retention cycle expires. Prisma Postgres Free has no automatic database snapshots. ChessCue restricts deleted data from ordinary use while any other provider recovery copies remain.
• Account deletion jobs: contact and provider cleanup data only until deletion completes or the job is cancelled. Scrubbed completion evidence remains for 12 months and scrubbed cancelled jobs remain for 30 days.
• Transaction, tax, refund, chargeback, and other financial records: ChessCue does not currently collect these records. Before paid plans are enabled, ChessCue will publish the applicable legal retention period and provider deletion schedule.
• Privacy requests and correspondence: retained while open, automatically closed after 90 days without correspondence, and deleted 12 calendar months after closure. A new reply reopens a closed request. This correspondence survives account deletion until its own deadline unless a narrow legal obligation requires longer retention. Resend keeps its provider email and attachment copy for 30 days. ChessCue archives plain text and delivery metadata plus attachment metadata, but never HTML, mail headers, or attachment contents.
• Privacy preferences, policy versions, and delivery records: account preferences and account linked delivery records remain while your account is active and are deleted with the account. Release records that no longer identify a person may be retained to document which policy version was issued.
• Authentication secrets, passkeys, and multi factor credentials: while your account uses them and for the limited security period needed after removal, then deleted with the account subject to legal and security exceptions.

Depending on where you live, you may have the following rights. We may need to verify your identity before completing a request.

To submit a request, email privacy@chesscue.com from the email address associated with your account when possible. State the right you want to exercise and describe the data or processing involved. You may also use the account privacy controls for deletion, conversation, memory, local game, and cloud game actions they provide. We will not ask you to send a password, API key, or access token.

We verify requests using reasonable information, such as an authenticated account action when available, a reply from the account email address, or account details needed to match the request. We request only what is reasonably necessary and will explain if we cannot verify a request. An authorized agent may act for you where applicable if we can verify their authority.

We aim to confirm receipt promptly. For requests covered by European Economic Area, United Kingdom, or Swiss data protection law, we respond without undue delay and within one month. If a request is complex or numerous, we may extend the response by up to two further months and will tell you within the first month. For California requests, we respond within 45 days of a verifiable request and may extend that period once by another 45 days when reasonably necessary, with notice.

Use Download personal data in Settings to receive the personal data in ChessCue's application database as JSON, with chess records in PGN where appropriate. This download does not include records held only by providers. Email privacy@chesscue.com if your request also covers provider held data. Where a portability right applies, we provide covered data in a structured, commonly used, machine readable format. We omit authentication secrets, information about another person, and security controls.

To request account deletion, use the Request account deletion action in Settings under Data and privacy or email privacy@chesscue.com. You do not need to cancel an active subscription before requesting deletion. A confirmed request removes the database account immediately and places provider cleanup in the same retryable deletion process. We delete the associated profile, cloud games, imported games, coach history, saved notes, saved voice transcripts, and linked account authorization tokens, and disconnect linked platforms. We retain only the limited records needed for legal, security, fraud prevention, dispute resolution, or transaction obligations.

Account deletion does not automatically delete data held by Chess.com, Lichess, or other independent services. Local data remains in your browser until you clear it. Provider records and provider managed backups may remain until their retention cycles expire. Privacy request correspondence survives account deletion until 12 calendar months after closure so ChessCue can complete and document the request, unless a narrow legal obligation requires longer retention. Email privacy@chesscue.com to include provider held data in a verified request. Legal, security, fraud prevention, dispute, or transaction records may remain only as long as needed for those purposes.

Requests are generally free. Where applicable law allows, we may refuse or charge a reasonable fee for a request that is manifestly unfounded, excessive, repetitive, or abusive. If we limit or refuse a request, we will explain why and tell you how to raise a concern.

• Ask for access to, or a copy of, your personal data.
• Correct inaccurate or incomplete personal data.
• Request deletion or restriction of personal data in applicable circumstances.
• Receive certain data in a portable format.
• Object to processing based on legitimate interests and withdraw consent where processing relies on consent.
• Ask for information about automated processing and, where applicable, contest a solely automated decision with legal or similarly significant effects.
• Complain to the data protection authority where you live, work, or believe an infringement occurred.

• European data protection authorities
• UK Information Commissioner's Office
• Swiss data protection authority
• California Privacy Protection Agency

Residents of some United States states have privacy rights in addition to the California rights described below. These rights apply only when the relevant state law covers ChessCue and the requested processing.

Submit a request or appeal by emailing privacy@chesscue.com. We will verify and respond to the request within the period required by the applicable state law. If we deny all or part of a request, you may appeal our response to your request by replying to the decision within 60 days and explaining why you believe it should be reconsidered. We will answer the appeal within the period required by the applicable law and explain how to contact the relevant state regulator if the appeal is denied.

• Confirm whether ChessCue processes your personal data and access that data.
• Correct inaccurate personal data where the applicable state law provides that right.
• Delete personal data that you provided or that ChessCue obtained about you, subject to legal exceptions.
• Receive personal data in a portable and usable format.
• Opt out of a sale, targeted advertising, or profiling used for decisions with legal or similarly significant effects. ChessCue does not currently perform any of these activities.
• Appeal our response to your privacy request where applicable state law provides an appeal right.

California residents may have the following rights under the California Consumer Privacy Act. The notice at collection and data map above is ChessCue's California Notice at Collection. It lists each category collected, its purpose, business disclosures, sale or sharing status, and retention.

ChessCue does not sell or share personal information. In the preceding 12 months, ChessCue did not sell it for money or other valuable consideration and did not share it for cross context behavioral advertising. A Global Privacy Control signal does not change current processing. If this changes, ChessCue will honour opt out preference signals where required.

During the preceding 12 months, ChessCue collected the categories marked in the data map: identifiers, customer records, commercial information limited to plan or subscription status, sensitive account login information, internet or other electronic network activity, audio and visual information, user content, and inferences drawn from chess activity. The Business disclosures column is the separate list of categories disclosed to service providers or contractors and identifies those recipients. The Sold or shared column is the separate list for sale and sharing. ChessCue uses sensitive account login information only to provide, secure, and administer accounts.

To submit a California request, email privacy@chesscue.com or use the online privacy controls in your ChessCue account for the deletion and data clearing actions they provide. If you do not have an account or need access, correction, portability, opt out, limitation, or another request, email us. We may need information to verify your identity, but we will not require you to create an account. We will respond within 45 days of a verifiable request and may extend that period once by another 45 days when reasonably necessary, with notice.

You may use an authorized agent to submit a request. We may require signed permission naming the agent and may verify your identity directly or require the agent to provide proof of authority. We retain the categories described here only for the periods and purposes in How long data is kept.

• Know the categories and specific pieces of personal information we collected, the sources, purposes, and categories of recipients, and the categories of personal information sold, shared, or disclosed for a business purpose.
• Request deletion of personal information, subject to legal exceptions.
• Request correction of inaccurate personal information.
• Opt out of the sale or sharing of personal information.
• Limit the use and disclosure of sensitive personal information where applicable.
• Receive equal service and pricing without discrimination for exercising these rights.

We use measures designed to protect personal data, including encrypted transport, protected authentication credentials, encrypted integration tokens, private profile image delivery, access controls, rate limiting, session management, and account security alerts. No system can guarantee absolute security.

We may update this policy as ChessCue and applicable requirements change. The effective date and version number at the top identify the current version.

For material changes, we will publish a prominent notice and notify registered accounts where appropriate or required. Where processing requires consent, we request it separately rather than treating this notice as consent.

• Version 2026-08-25.1, effective 25 August 2026.
• Version 2026-08-24.1, effective 24 August 2026.
• Version 2026-08-21.3, effective 21 August 2026.

This appendix identifies the outside services that may receive personal data. Providers process data for ChessCue, while Chess.com and Lichess act as independent services for connections you request.

This appendix was reviewed on 25 August 2026. We review it every six calendar months, next due 25 February 2027, and before enabling or changing any provider, plan, or material processing.

• Google provides account sign in and Gemini processing for text and voice coaching.
• Cloudflare Turnstile uses browser and device signals to protect account creation from automated abuse.
• Chess.com supplies public profile and game data for a username you enter. Lichess supplies authorization and game data when you connect an account.
• Vercel Pro hosts ChessCue. Application functions use the Frankfurt, Germany region, while delivery and operational processing may occur elsewhere. Application and runtime logs remain for 24 hours. ChessCue does not enable a log drain or Observability Plus.
• Prisma Postgres Free stores account and application data in Frankfurt, Germany. The Free tier has no automatic database snapshots, and ChessCue does not create separate database backups.
• Upstash Free provides hashed rate limit enforcement counters in Frankfurt, Germany. Counters remain for at most one hour and analytics is disabled.
• ImageKit Free stores and delivers private profile images. Its existing delivery cache disclosure remains unchanged: requested copies may be cached for up to one year.
• Resend Free receives and delivers privacy, authentication, security, account, and legal notice emails. Its provider email and attachment copy remains for 30 days.
• Lemon Squeezy is not currently enabled. If paid plans launch, it will act as merchant of record and process checkout, subscription, tax, refund, and order data.
• PostHog EU Cloud provides cookieless product analytics only after affirmative consent.

• Chess.com privacy policy
• Lichess privacy policy