Privacy policy

ChessCue is the trading name of the controller responsible for this service. We are in closed prelaunch testing. Before public launch, we will identify the responsible legal operator, jurisdiction, postal address, and any required representative or data protection officer here. Contact privacy@chesscue.com with questions or requests.

You must be at least 18 years old to use ChessCue. We do not knowingly collect personal data from anyone under 18. Contact us if you believe a child has provided personal data so we can investigate and, where appropriate, delete it.

We receive data from you, your browser, Google sign in, and the chess services you choose to connect. The table explains our purposes, legal bases, and providers. Contract means processing needed to deliver your requested service. Legitimate interests means our interests in security, reliability, and administering ChessCue, balanced against your rights.

Account credentials and necessary security checks are required to use an account. Profile images, imports, voice coaching, and analytics are optional; declining the relevant data prevents only that feature. We do not currently collect payment or transaction data.

A Chess.com username identifies a public profile; we do not receive its password or verify that you own it. Lichess connections use your authorization. You can disconnect linked services in Settings.

Imports and uploaded PGN files can contain other players' data. Import only games you are permitted to share and avoid unnecessary personal information. We use opponent data for the requested chess features, not to contact opponents or build profiles about them. We cannot readily identify or contact opponents from game records; this public notice explains that processing.

Google Gemini receives the positions, prompts, recent conversation, and saved chess coaching notes needed to answer you. Voice features also send audio for live processing or transcription, sometimes directly from your browser to Google.

We do not intentionally retain raw microphone audio after processing. Saved transcripts, responses, and generated recap audio are separate records with the retention periods below. Google may keep live session state, including audio and text, for up to 24 hours when session resumption is used.

Under Google's paid Gemini API terms, prompts and responses are not used to improve Google's products. Google may retain inputs and outputs for up to 55 days for abuse monitoring. ChessCue does not use your prompts, voice transcripts, or responses to train a ChessCue model.

Coaching notes concern chess patterns, goals, and preferences. We do not use voice to identify you or infer sensitive traits, or make automated decisions with legal or similarly significant effects. Avoid sensitive information in coaching requests.

• Google Gemini API terms
• Google abuse monitoring

Essential cookies and browser storage support sign in, security, privacy choices, preferences, local games, and coach context. The session lasts for rolling seven days; trusted device identifiers last up to 30 days and verification challenges for 10 minutes. Local data stays until you clear it in Settings or your browser.

PostHog receives analytics only after affirmative consent. It runs without cookies or session recording, and excludes chat, coach response, and live transcription content. Accept, decline, or withdraw consent from the sign in screen or user menu without losing ChessCue functionality. Your choice may synchronize to your account. Internal account activity records are not sent to PostHog without consent.

We do not track you across unrelated websites or allow providers to do so through ChessCue. We do not respond to Do Not Track signals. Because we do not sell data or share it for targeted advertising, Global Privacy Control does not change current processing. We do not send marketing email; in product promotions concern ChessCue features and the page you are viewing.

Games, imports, conversations, and coaching notes are private account data; ChessCue has no public profiles or sharing controls. Authorized personnel may access data when needed for support, security, operations, or legal obligations, using restricted access. Providers receive only data needed for their role. Chess.com and Lichess operate independently for your connections.

We may also disclose necessary data to professional advisers, authorities where legally required, or a successor in a business transfer, subject to applicable law. We do not sell personal data or share it for cross context behavioral advertising.

Our application hosting and database use Frankfurt, Germany, and analytics uses PostHog EU Cloud. Providers may also process data in the United States and other countries where they operate. For transfers requiring protection, we rely on applicable adequacy decisions or safeguards such as EU Standard Contractual Clauses, the UK Addendum or IDTA, and Swiss adaptations where required. Contact privacy@chesscue.com for a copy of the safeguards applicable to your data.

• EU Standard Contractual Clauses
• Chess.com privacy policy
• Lichess privacy policy

We keep data for the periods below, unless a specific legal, security, or dispute obligation requires limited records for longer. After verified account deletion, we normally remove your account immediately and complete deletion from ChessCue controlled active systems within 30 days. Independent services and provider recovery copies follow their own retention cycles; retained recovery data is restricted from ordinary use.

Ordinary accounts become inactive after 24 calendar months without genuine use. We send warnings 30 days and 7 days before deletion; signing in cancels it. Administrators and banned accounts are excluded from automatic inactivity deletion, with retention limited to their operational, security, or legal purpose.

• Account, profile, cloud games, conversations, coaching notes, and saved transcripts: until you remove them or delete your account. Connection credentials remain until disconnected or deleted. Transient coaching records last up to 24 hours.
• Completed or failed recaps, generated audio in Cloudflare R2, and cloud recap progress: scheduled for deletion 30 days after the recap's last update. Queue delivery records remain for the provider's retry and recovery cycle.
• Profile images: the source is deleted when removed; ImageKit delivery caches may retain copies for up to one year.
• Security records: application logs for 24 hours, hashed rate limit counters for at most one hour, minimized browser security violation aggregates for 30 days after the last occurrence, and administrator audit records for 12 calendar months. Expired sessions are removed by scheduled cleanup.
• Privacy correspondence: while open and for 12 calendar months after closure, including after account deletion. Requests close after 90 days without correspondence and reopen on reply. Resend retains provider email and attachment copies for 30 days; ChessCue keeps message text and metadata, without attachment contents.
• Optional analytics events: one year. Local games, recap progress, preferences, and coach context remain in your browser until cleared.

Depending on applicable law, you can access, correct, delete, restrict, or object to processing of your data, receive a portable copy, and withdraw consent without affecting earlier lawful processing. You can complain to the data protection authority where you live, work, or believe an infringement occurred.

Use Download personal data in Settings for application data in JSON and chess records in PGN where appropriate. Use Request account deletion to delete your account, or clear conversations, notes, and games separately. Downloads omit authentication secrets and protected information about others. For provider held records or other rights, email privacy@chesscue.com, preferably from your account email.

Account deletion removes linked tokens and stored account content, with the retention exceptions above. It does not delete your accounts at Chess.com or Lichess, or local browser data. Contact us to include provider held data in your request.

We may verify your identity or an agent's authority using only necessary information; never send passwords or access tokens. Requests are generally free. We respond within applicable deadlines; under GDPR, within one month, with up to two further months for complex or numerous requests and notice within the first month. If law permits a refusal or fee, we explain the reason and how to challenge it.

• European data protection authorities
• UK privacy complaints
• Swiss data protection authority

Where a US state privacy law applies to ChessCue, residents may also request confirmation of processing, access, correction, deletion, portability, and an appeal of a denied request. Email privacy@chesscue.com; no new account is required. You may use an authorized agent and exercise rights without discrimination.

California residents covered by CCPA may request categories and specific information collected, sources, purposes, and business disclosures described above. We have not sold or shared data for cross context advertising in the preceding 12 months. Sensitive login data is used only to operate and secure accounts. Applicable California requests are answered within 45 days, extendable once by 45 days with notice. For an appeal where available, reply to our decision within 60 days; we explain the outcome and further regulator options within the applicable deadline.

• California privacy complaints

We use encrypted connections, protected credentials and integration tokens, access controls, and abuse prevention to protect personal data. No online service can guarantee absolute security.

We update this policy as the service changes and preserve dated versions in the policy history. For material changes, we provide a prominent notice and notify registered users where appropriate or required. We inform you before processing data for a new purpose and obtain separate consent where required. Updating this policy does not itself give us your consent.