Privacy Policy

1. Data We Collect

Account Data:

• Google sign-in: email, display name, and profile picture.
• Sign in with Apple (iOS App only): your Apple account identifier and the email address Apple provides, which may be a private relay address. We retain an encrypted Apple refresh token when available so we can revoke access when fulfilling an account-deletion request.
• Email sign-in: your email address, verified with a one-time code or link.
• Usernames from Chess.com, Lichess, and PGN files you submit.

Purchase Data: Stripe handles website payments; Apple or Google handles purchases made in the Apps. We keep purchase and subscription records, including the plan, transaction identifiers, dates and status, to provide access on your account. We do not receive your full card details from the app stores.

Coach Conversations: the questions you ask the coach and its answers are kept with your account so a conversation can continue, and sent to our AI model provider to write the answers.

ChatGPT App and Claude Connector: our app in ChatGPT and our connector in Claude answer chess questions with Chessigma's tools, from the server described at chessigma.com/developers/mcp.

• What we receive: the chess input a tool is given, such as moves, a FEN position, a PGN, a public game link, an opening name, ratings or a date. The assistant may also attach technical hints to a request, such as your language, an approximate location and anonymous identifiers; our tools do not use them. We do not receive your name, email address or ChatGPT or Claude account details.
• What we keep: the tools do not store the input they are given. To limit request rates and prevent abuse, we log each request to the app's endpoint: the time, the request method and path, and the IP address and user agent of the computer that sent it. That is usually OpenAI's or Anthropic's server rather than your device; it is your device when you connect from a program on your own computer, such as Claude Code. We keep this log for up to 24 months.
• Link markers: links in the app's answers carry utm_source and utm_medium markers. If you open one, our analytics record that your visit came from the ChatGPT app or the Claude connector, as they do for any marked link. We tell the two apart by the user agent and IP address of the request.
• Games you open: opening a game review link imports that game like any other game imported to Chessigma. It is saved and shown as a public page on chessigma.com, at an address under /games/, which anyone with the link can open and search engines may index.
• OpenAI and Anthropic: ChatGPT is run by OpenAI and Claude by Anthropic, each under its own terms and privacy policy.

Technical & Usage Data: IP address, approximate signup country, device/browser details and usage events. Collected for security, account administration and analytics. When you sign in, analytics can be linked to your account ID and email address.

Cookies & Ads: Google AdSense sets cookies to serve non-personalized ads unless you opt in to personalized tracking.

2. Why We Use It

• Provide and improve the chess analysis service.
• Secure the platform and prevent abuse.
• Understand feature usage through analytics.
• Comply with legal obligations.

3. Legal Bases (GDPR)

• Contract – to deliver the service you request.
• Legitimate interest – security, analytics, and product improvement.
• Consent – optional cookies or marketing emails.
• Legal duty – when law requires it.

4. Service Providers

We share data only with trusted providers acting on our instructions:

• Vercel – hosting infrastructure.
• Cloudflare – content delivery network for our images, fonts and chess engine files.
• Amazon Web Services – server-side analysis of the games you import.
• Modal – hosting our coach and chess-processing services.
• Supabase – database, authentication, and storage.
• Resend – account verification, service and product emails, including your email address and delivery records.
• Stripe – payment processing.
• Apple and Google – authentication and payment for purchases made in the Apps.
• RevenueCat – app purchase records and subscription access, linked to your account ID.
• OpenRouter – sends your coach questions to the AI models that write the answers.
• Google Cloud Platform – Google Sign-In / SSO backend.
• PostHog – EU-hosted product analytics, including usage events and, for signed-in users, account ID and email address; support conversations and the contact details you provide. Session replay is disabled in the Apps.
• Discord – copies of general feedback and associated contact details for our support team when feedback notifications are configured. Account-deletion requests are excluded from these notifications.
• Google AdSense – ad delivery (see Section 1).

All providers are under confidentiality agreements and, where needed, Standard Contractual Clauses for international transfers.

5. How Long We Keep It

We delete or anonymise personal data 24 months after your last activity unless the law requires longer. You can request deletion sooner (see Section 6).

6. Your Rights

Under GDPR and CCPA you can access, correct, delete, or export your data, and object to or restrict processing. Email us; we reply within 30 days.

To delete your account, use the request form at chessigma.com/contact/delete-account.

7. California Consumer Privacy Act (CCPA)

Under CCPA, California residents have the right to declare their preferences on the sale of data for advertising and marketing purposes.

8. Security

Data is encrypted in transit (HTTPS) and access-controlled. Vercel, Supabase, and Google Cloud run in data centres certified to ISO 27001 or similar. No system is perfectly secure, but we work hard to protect your information.

9. Contact

Questions or requests? Email mehdi@chessigma.com or eliot@chessigma.com.

10. Changes

We'll post updates here. Significant changes will be flagged prominently.