Privacy Policy

When you create an account, we collect:

• Email address - For account identification, login, and communications
• Display name (nickname) - Your chosen username visible on the platform
• Password - Only if you register with a password (not with Google or Apple sign-in); stored only as a cryptographic hash (bcrypt), never in plain text
• Account creation date - For account management
• Language preference and time zone - To display content in your preferred language and schedule reviews and reminders on your local day
• Google or Apple account identifier - Only if you sign in with Google or Apple
• Sign-up context - The platform you signed up on (web, iOS, Android), the page and referring website you came from, campaign (UTM) parameters, and your country derived from your connection, to understand how users find ChessAtlas

Optionally, you can add an avatar, a bio, a location and links to your social profiles. Your avatar is shown on your public profile with your nickname (see 2.3); your bio, location and social links are kept in your account and are not shown on your public profile.

When you connect your chess accounts, we collect:

• Lichess username
• Chess.com username
• Last synchronization date

We use these usernames to fetch your publicly available games through their respective APIs. We do NOT access your passwords, private messages, or any private account data on these platforms.

As you use ChessAtlas, we collect:

• Courses you create, fork, and study
• Variations and chapters in your repertoire
• Training session data (moves played, correct/incorrect responses)
• Spaced repetition scheduling data (due dates, intervals)
• Statistics and progress data (XP, streaks, accuracy rates)

Visible to others: your public profile page, which anyone with its link can open, shows your nickname, avatar, XP and level, streaks, global rank, achievements and the number of reviews per day. Signed-in users can also see your nickname, avatar and XP in the leaderboards.

If you buy a paid plan:

• Stripe customer ID (for subscription management)
• Subscription or purchase status and plan type, price and currency
• Billing history (invoices, payment dates)
• Country and, where Stripe asks for it, billing address (for VAT calculation)
• The page or screen from which you opened the checkout
• For in-app purchases: the purchase receipt and status sent by the store through RevenueCat

Important: We do NOT store your full credit card number, CVV, or banking details. Card payments on the web are processed directly by Stripe, and in-app payments by Apple or Google.

We automatically collect:

• IP address, and for each signed-in session the IP address, browser or device (user agent) and approximate country, to secure your account
• Browser type and version
• Operating system
• Device type
• Referrer URL
• Session duration, page views and the product events you trigger (see 5.3)
• Error reports when something fails (see 5.3)

We keep a record of the emails we send you and their delivery status (for example a bounce or a spam complaint), your email preferences, and, in the mobile app, the push notification token if you allow notifications. If you write to us through the contact form of our website, we receive your name, email address and message.

• Stripe (Payment Processing) - Processes web payments and calculates VAT. Location: USA (EU-US DPF certified).
• Google OAuth (Authentication) - Optional Google sign-in. Location: USA (SCCs + EU-US DPF).
• Apple Sign-In (Authentication) - Optional Apple sign-in, on the web and in the mobile app. Apple may relay a private email address (`@privaterelay.appleid.com`) that forwards to your real inbox; we never see the real address. Location: USA.
• DigitalOcean (Hosting) - Servers, database, file storage (avatars, course images) and the chess engine server of the web application and API. Location: Amsterdam, Netherlands (EU).
• Vercel (Hosting) - Hosts the chessatlas.net website. Location: USA, with a global network that may serve pages from a location near you.
• Resend (Email Delivery) - Sends our emails and reports their delivery status. Receives your email address and the content of the email. Location: USA.
• Web3Forms (Contact Form) - Relays the messages sent through the contact form of our website (name, email address, message) to our inbox.

• Lichess.org - We fetch publicly available game data via their public API.
• Chess.com - We fetch publicly available game data via their public API.

• PostHog - Product analytics on the website, the web application and the mobile app (see 10.2). Receives the pages and screens you view, the product events you trigger, your device and browser information, the page and campaign that brought you, and, once you are signed in, your account ID, email address, nickname and language. Location: EU (data hosted in the European Union).
• Sentry - Crash and error reporting for the web application, the mobile app and our servers. Captures technical context (device model, browser, OS version, a stack trace, the request that failed), your account ID and, for server errors, your IP address. Passwords, authentication tokens and other secrets are scrubbed before transmission. Location: EU (data hosted in Germany).
• New Relic - Performance monitoring of our servers (response times, errors, request metadata). Location: EU data region.

• Apple App Store / Google Play Store - Distribution and in-app purchase processing. When you purchase a subscription on mobile, the store handles your payment data directly; we receive only the resulting receipt / token.
• RevenueCat - In-app subscription management. Receives your ChessAtlas account ID, your store purchase receipts and the paywall from which you bought, so we can verify your Premium status across reinstalls and devices. No email or payment card data. Location: USA (see Section 6 for safeguards).
• Expo Push Notifications - Optional training reminders. If you grant the notification permission, we store an opaque push token on our servers so we can send reminders through Expo's push service. Revocable any time in the mobile app's Settings or the system notification settings. Location: USA.

• Meta Platforms Ireland Ltd (Meta pixel) - On chessatlas.net only, and only after you click "Accept" in the cookie banner: records page views and clicks on the App Store / Google Play buttons, so we can measure which of our Facebook and Instagram ads bring visitors. Meta may transfer this data to the USA (DPF certified). It is never loaded if you decline or do not answer.

Required for the Service to function:

• Session authentication cookies (secure, HTTP-only)
• CSRF protection tokens
• User preferences (language, theme), and your cookie banner answer (see 10.3)

We use PostHog for product analytics to understand how users interact with our Service. On the chessatlas.net website and in the web application, PostHog stores an identifier in local storage on each site and in a first-party cookie shared between chessatlas.net and app.chessatlas.net, so that a visit and the sign-up that follows are counted together. It runs independently of the cookie banner, which controls the Meta pixel only (see 10.3). PostHog does not run if your browser sends a "Do Not Track" signal; you can also object by writing to privacy@chessatlas.net.

On chessatlas.net, the Meta pixel (see 5.5) and its cookies (_fbp, _fbc) are only loaded after you accept them in our cookie banner. Your answer is kept for six months in a chessatlas-consent cookie. You can withdraw at any time, which also deletes the Meta cookies:

The web application uses browser local storage and IndexedDB, and the mobile app its own device storage, to keep a copy of your chess training data on your device for faster performance and, on mobile, offline training. Your data itself is stored on our servers; the copy on your device is a cache that is synchronized with them.

If you are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority. In France, this is: