ChessPredator Privacy Policy
Effective October 1, 2026 · First version
Contents
- The short version
- Who is responsible for your data?
- What do we collect?
- Why do we use it, and what allows us to?
- Player data from public sources, and digital twins
- Who do we share it with?
- Cookies and browser storage
- How long do we keep it?
- What are your rights, and how do you use them?
- How do we protect it?
- Is your data sent to other countries?
- Children
- U.S. state law disclosures and browser privacy signals
- Changes to this policy
1. The short version
- What we collect: the account details you give us (username, email, the chess profiles you link), your settings, and a security log of what happens in your account, which includes your IP address. We also hold public chess games and player information published by Lichess, Chess.com and chess federations.
- We never sell your personal information, and we don't share it for advertising.
- No ads, no trackers. We use no third-party analytics, advertising cookies, tracking pixels or social-media widgets.
- Delete your account at any time: email chesspredatorapp@gmail.com from the address on your account, and we delete it within 30 days.
- Players can remove their public page. If you have a page on ChessPredator, you can have it removed and taken out of search engines. See section 5.
2. Who is responsible for your data?
The operator of ChessPredator (chesspredator.com) is responsible for your data. You can reach us at chesspredatorapp@gmail.com.
Under the EU and UK General Data Protection Regulation (GDPR), we are the controller of the personal data described here. Send privacy questions and requests to chesspredatorapp@gmail.com.
We have not appointed a representative in the EU or UK under GDPR Article 27, because our processing of EU and UK data is occasional. We will appoint one if that changes.
3. What do we collect?
3.1 If you create an account
| What | Where it comes from | Example |
|---|---|---|
| Username and email address | You, when you sign up | knightrider, you@example.com |
| Password | You, when you sign up | We store only a scrambled one-way hash (bcrypt), never the password itself. Accounts that use Google Sign-In have no password with us |
| Google sign-in identity | Google, if you choose "Sign in with Google" | Your Google email, which confirms who you are |
| Lichess access token | Lichess, if you connect your Lichess account | We encrypt it before storing it and use it only to read your Lichess username and games |
| Linked chess profiles | You, or Lichess when you connect it | "Lichess: knightrider", plus the profile's avatar image address. You can follow several profiles |
| Settings | You, in Settings | Analysis depth, how many games to analyze, time per position, language, dark mode |
| Plan and credits | Us | Free or paid plan, credits left, next reset date |
| Billing references (paid plans, once live) | Stripe | Stripe customer and subscription IDs and the renewal date. Your card number never reaches our servers: Stripe holds it |
| Activity log | Our server | "On [date] user 412 requested an opening analysis of a Chess.com player, from IP address 203.0.113.7": the time, your user ID, the type of event (page view, login, logout, analysis request), the page, the chess platform and player analyzed, the analysis settings, and your IP address |
| Contact-form messages | You | What you write to us, delivered to us by email |
3.2 If you just visit
- IP address. Our public search and preview pages keep your IP address briefly in memory to stop abuse (rate limiting). It is not written to a database for visitors who aren't signed in. Our web server (nginx) also keeps standard access logs (IP address, time, page requested, browser type).
- Cookies and browser storage. Only what the site needs to work. See section 7.
3.3 Public chess data about players
We hold a collection of about 34,000 chess players built from publicly available data: games published by Lichess and Chess.com through their public interfaces, and the titles and ratings published with those games. For example: a player's handle, their games (moves, results, dates, opponents), title, rating, and, where a federation publishes it, their name. This data concerns players whether or not they have a ChessPredator account. Section 5 explains what we do with it.
4. Why do we use it, and what allows us to?
The GDPR requires a legal basis for each use. We apply the same rules to everyone.
| Purpose | Data used | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|
| Run your account and log you in | Username, email, password hash, Google identity | Contract: we need it to provide the service | Until you delete your account, plus backups (section 8) |
| Analyze the games you ask for | Linked profiles, Lichess token, settings, public game data | Contract | Same as above. Analyses of public games may be kept to speed up later requests |
| Write AI player reports | Aggregated game statistics and the chess handle analyzed | Contract (for you); legitimate interest (for the player analyzed) | Reports may be stored and reused |
| Bill paid plans and manage credits | Plan, credits, Stripe IDs | Contract; legal obligation (tax and accounting records) | Billing records: 7 years, for tax and accounting |
| Keep the service secure and stop abuse | Activity log, IP addresses, server logs | Legitimate interest in protecting the service and its users | Activity log: 12 months. Server logs: 14 days |
| Understand how the service is used, so we can improve it | Activity log, counted internally | Legitimate interest. We use our own log only, never a third-party analytics tool | 12 months |
| Answer your messages | Contact-form contents, email | Legitimate interest in answering you | 24 months after the conversation ends |
| Public player pages and digital twins | Public game data | Legitimate interest in the study of chess (section 5) | Until removal is requested |
| Send service emails (password reset, billing notices) | Contract | — | |
| Send news or offers | Consent. You can unsubscribe in every email | Until you unsubscribe |
Where we rely on legitimate interest, we have weighed our interest against your rights, and you can object at any time (section 9).
5. Player data from public sources, and digital twins
What we show. Every player in our collection can have a public page at chesspredator.com/u/<player>. It shows the player's name and identifiers as published by the source, summary statistics, opening repertoire, and replayable games. These pages are listed in our sitemap so search engines can find them. Previews of a player's recent games, fetched live from the platform, are marked so search engines don't index them. In-depth analysis is available only to signed-in users.
Why we are allowed to. Chess games are a public, sporting record. Players publish them on Lichess and Chess.com, and tournaments publish them for study. Studying other players' games is how chess is learned and how players prepare. Our legitimate interest is to make that study easier. We weighed it against players' privacy: we use only data the player or their platform already made public, we show no contact details, and we remove pages on request.
Digital twins. A twin is a computer model that imitates how a particular player tends to choose moves, based on their public games. A twin is a statistical model. It is not the person, it doesn't speak for them, and how it plays says nothing certain about how the real player would play.
How to remove your page or twin. Email chesspredatorapp@gmail.com with "Remove my page" in the subject, and include the platform and handle. To make sure the request comes from you, we will ask you to prove you control the account, for example by adding a short code we give you to your Lichess or Chess.com profile. Once verified, we:
- remove your public page and any twin built from your games;
- ask search engines to drop the page;
- keep a small suppression record (platform and handle only) so the page is never re-created.
Removal is permanent. Your games stay public on Lichess or Chess.com, because we don't control those sites. To remove them there, use the platform's own tools.
6. Who do we share it with?
We do not sell or share personal information, in the sense of the California Consumer Privacy Act or any similar law, and we don't use it for targeted advertising.
We use these service providers. Each receives only what it needs for its job:
| Provider | What they do for us | What they receive |
|---|---|---|
| OVHcloud (U.S. region) | Hosts our servers, which are in the United States | Everything we store, held on our servers |
| Google Sign-In; sends our emails (Gmail) | Your Google identity, if you use Google Sign-In; the contents of the emails we send you | |
| Lichess | Connects your Lichess account; supplies public games | Your Lichess token and username, when you connect them; requests for public games |
| Chess.com | Supplies public games through its published-data interface | Requests for public games |
| Anthropic | Writes AI player reports | Aggregated game statistics and the chess handle being analyzed. Never your email or account details. Under Anthropic's commercial terms, this data is not used to train its models |
| OpenAI | Machine translation of report and page text | The text being translated (report content and chess statistics), not your account details |
| Stripe (once paid plans are live) | Payments | Your billing name, email and payment method, which Stripe stores |
We may also disclose information when the law requires it (for example, a valid court order), to protect the rights and safety of our users or others, or to a buyer or successor if the service is sold or reorganized. In that last case, this policy keeps applying to your data until you are told otherwise.
7. Cookies and browser storage
We use only what the site needs to work. Nothing tracks you across other websites.
| Name | Type | What it does | How long it lasts | Essential? |
|---|---|---|---|---|
session |
Cookie (ours) | Keeps you signed in. Remembers your active chess profile and language. During Google or Lichess sign-in, also holds a one-time security code that blocks forged sign-ins | Until you close your browser | Yes |
cp_filters |
Browser storage (stays on your device) | Remembers the player and table filters you last chose | Until you clear it | Functional |
cp_search_lanes |
Browser storage | Remembers which sources the search box looks in | Until you clear it | Functional |
cp_search_recent |
Browser storage | Your last five searches, for quick access. Never sent to our server | Until you clear it | Functional |
Your dark-mode choice is saved in your account settings, not in a cookie.
Why there is no cookie banner: EU and UK rules require consent only for storage that isn't needed for a service you asked for. Everything above is needed for the site to work, or remembers a choice you made, and stays on your device. If we ever add anything that isn't, we will ask for your consent first.
8. How long do we keep it?
The table in section 4 gives the period for each use. In addition:
- After you delete your account, your data disappears from our backups within 90 days.
- The activity log is purged automatically after 12 months.
- In-memory rate-limit data lasts minutes and is never saved to disk.
- Suppression records are kept indefinitely, so a removed page stays removed.
9. What are your rights, and how do you use them?
Wherever you live, you can:
- see the personal data we hold about you, and get a copy in a portable format;
- correct it;
- delete it;
- object to uses based on legitimate interest, including public player pages;
- restrict how we use it while a dispute is resolved;
- withdraw consent (for example, to news emails) at any time;
- complain to a data-protection authority. In the EU, that is the authority where you live; in the UK, the ICO.
How: many of these you can do yourself. Edit your profiles and settings in Profile and Settings. To delete your account, or for anything else, email chesspredatorapp@gmail.com. We may ask you to confirm your identity first. We answer within 30 days (GDPR) or 45 days (U.S. state laws), and tell you if we need more time and why.
You can also ask someone to act for you (an authorized agent). We will ask for proof that they are authorized.
We will never treat you differently, or charge you more, for using these rights.
Latin America. If you live in Colombia, you have rights under Ley 1581 de 2012 (habeas data): to know, update, correct and delete your data, and to revoke your authorization. If you live in Mexico, you have the ARCO rights (access, rectification, cancellation and opposition) under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares. We grant these rights through the same contact: chesspredatorapp@gmail.com.
10. How do we protect it?
- Passwords are stored as one-way bcrypt hashes.
- Lichess access tokens are encrypted on our servers.
- All connections to the site use encryption (HTTPS/TLS).
- Only the people who run the service can reach the servers, and each part of the system gets only the access it needs.
- The site never shows your own chess handle or platform in the navigation bar, so you can use ChessPredator in front of an opponent without revealing who you are.
No system is perfectly secure, and we can't promise yours never will be breached. If a breach affects your personal data, we will notify you and the authorities as the law requires.
11. Is your data sent to other countries?
Our servers are in the United States. If you use ChessPredator from outside the U.S., your data is transferred to and stored in the U.S., where the laws may protect it less than at home. For transfers from the EU and UK, we rely on the EU–U.S. Data Privacy Framework (and its UK extension) where a provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses.
12. Children
You must be at least 13 to create an account. ChessPredator isn't aimed at children under 13, and we don't knowingly collect personal data from them. Chess has many young players, so: if you are a parent or guardian and believe your child under 13 has given us personal data, write to chesspredatorapp@gmail.com with "Parent request" in the subject. We will delete the account and its data.
Public player pages show only data that platforms and federations already publish. A parent or guardian can ask us to remove a minor's page by the process in section 5.
Users under 18 need a parent or guardian's permission to buy a paid plan.
13. U.S. state law disclosures and browser privacy signals
We are below the size thresholds of the California Consumer Privacy Act and similar state laws, but we give every user the rights in section 9 anyway. For transparency, this table maps our data to the categories those laws use:
| Category | Examples from us | Source | Purpose | Shared with | Sold or shared for ads? |
|---|---|---|---|---|---|
| Identifiers | Username, email, IP address, account IDs | You; our server | Accounts, security | Hosting, Google (email), Stripe | No |
| Commercial information | Plan, credits, purchase history | You; Stripe | Billing | Stripe | No |
| Internet activity | Activity log, server logs | Our server | Security, improving the service | Hosting | No |
| Public game records | Games, ratings, titles | Lichess, Chess.com, federations | Chess analysis | Hosting; Anthropic and OpenAI (statistics only) | No |
| Inferences | Playing-style statistics, AI reports, twins | Derived from public games | The analysis you request | Anthropic (statistics) | No |
We collect no sensitive personal information as those laws define it, other than account login credentials, which we use only to sign you in.
Do Not Track and Global Privacy Control. We don't track you across other sites and we don't sell or share personal information, so these signals have nothing to switch off. We honor them by default.
14. Changes to this policy
When we change this policy, we update the effective date at the top and keep the previous version linked there. For important changes, we will tell you by email or with a notice on the site before they take effect.
Contact: chesspredatorapp@gmail.com