Privacy Policy

Last updated: 3 November 2026  ·  Effective date: 3 November 2026  ·  Version 1.10

1. Who we are (Data Controller)

The person responsible for your personal data ("we", "us", the "Data Controller") is:

Yevhenii Chebotarkyi, an individual operating Ochess as a personal project, based in the United Kingdom.

Contact: support@ochess.app

For privacy-related questions, requests, or complaints, please use the email above. We will respond within 30 days.

The Ochess app for iPhone is distributed on Apple's App Store from a developer account held by a member of our family, on our behalf and under a licence from us, so the seller name the App Store shows may differ from the name above. That account holder does not process your personal data for their own purposes; we remain the Data Controller for everything described in this policy.

This policy is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and is also designed to comply with the EU GDPR for users in the European Economic Area.

2. Scope

This Privacy Policy applies to the Ochess website (currently hosted at ochess.app), the Ochess app for Android on Google Play, the Ochess app for iPhone on Apple's App Store (together the "apps"), and any related subdomains operated by us (together the "Service"). It does not apply to third-party websites or services linked from the Service, such as Lichess, Chess.com, Google or Apple, which have their own privacy policies.

3. What personal data we collect

3.1 Data you provide directly

When you register and use Ochess, we collect:

Mandatory account data:

• Email address
• Username (chosen by you, must be unique)
• Account creation timestamp
• How you heard about Ochess (a single-choice answer we ask for at registration: YouTube, TikTok, Instagram, Facebook, Threads, Reddit, Discord, Google search, a friend, Google Play or the App Store in the apps, or Other)

Optional profile data (only if you choose to add it):

• Real name
• Date of birth
• FIDE rating
• Chess.com username
• Lichess username
• "About" text
• Preferred interface language

Authentication data:

• Authentication method used (email and password, Google sign-in, or Sign in with Apple in the iPhone app)
• Hashed password (managed by Firebase Authentication; we never see your plaintext password)
• If you choose "Continue with Google": Google shares your email address, name and profile photo with us. Firebase Authentication keeps them with your sign-in record, and the photo becomes your profile picture; inside Ochess you are shown by the username you choose.
• If you choose "Sign in with Apple": Apple gives us an identifier for your Apple Account and the email address you choose to share: either your own address, or a private relay address ending in @privaterelay.appleid.com that forwards our emails to you. We do not ask for your real email address if you chose to hide it. Apple may also offer your name the first time you sign in; the app does not keep it.

Records of consent:

• Timestamp of your acceptance of these Terms and Privacy Policy
• Timestamp of your confirmation that you meet the minimum age in the Terms (13, with a parent's or guardian's permission under 18; accounts created before 19 October 2026 confirmed 16)
• The versions of the Terms and of this Privacy Policy you accepted

3.2 Data generated by your use of the Service

• Chess games you import from Lichess, Chess.com, or via PGN upload, and the new games our server fetches once a day for the Lichess and Chess.com usernames on your profile (on your first visit of the day, or a day after the last fetch if you have not visited, and never more than once an hour; if more than 1000 new games are waiting, the rest follows an hour at a time), including the ratings recorded in them (yours and your opponents'), your opponents' usernames, results, time controls, openings and moves
• What we compute from those games: engine analysis reports, your accuracy and mistake statistics, your personal opening statistics, a playing-style estimate made with the Maia-2 model on our own server (how your moves compare with players of different ratings; shown to you and not used to make decisions about you), the training repertoire generated for you, and how your games followed the opening courses you study (how far each game kept to the course, where it left it, and whether you or your opponent left first), with a short daily summary of the previous day's games in those courses, kept in your notifications
• Your opponents' public usernames and ratings, which are part of the games you import. We process them only to show and analyse your games (legitimate interests, Art. 6(1)(f)); anyone who wants their username removed from another user's games can write to support@ochess.app
• Opening labs you create, including the move trees, chapters, settings, and any notes
• Training progress: which exercises you've completed and when (the course chapters and lab chapters you've studied and your review schedule for them, the opening puzzles you've tried, whether you solved them and the puzzle rating worked out from them, how many times you have trained each opening trap, and the endgame trainer levels and lessons you've completed)
• Direct messages you send to or receive from other users and, for a conversation someone new started, whether it was accepted or declined
• Reports: if you report a conversation, a comment, a shared lab or a public lab, the report records what you reported, the reason you chose and any details you wrote, and links them to your account and to the account you reported. If someone reports content of yours, the report is linked to your account
• Shared lab metadata: if you choose to make a lab public or share it via link, the share metadata (share ID, ownership, visibility setting) is recorded
• User preferences stored in your browser's local storage (board orientation, lab settings, study progress cache)
• Account activity log: which pages of the website and which screens of the Android app you open (stored as a per-day summary of visit counts, with the app's screens marked as such) and when you were last active. If you signed up in the Android app, your profile also records that. This log is tied to your account, is visible only to the Service Operator, and is used to understand how the Service is used and to improve it
• Creator link: if you open Ochess through a link from a creator we work with (an address such as ochess.app/?ref=… in a video description, or a short one such as ochess.app/channelname said in a video) and create your account during that same visit, your profile records which creator's link it was. The link is remembered only by the open page and is never stored in your browser, so it is not recorded if you sign up on a later visit

3.3 Data we do NOT collect

For transparency, we explicitly do not collect:

• IP addresses beyond what Firebase logs internally for security and what the connection itself needs: our own server necessarily receives your IP address to answer a request, and it may appear in technical logs, which are deleted automatically on a rolling basis (see § 7)
• Your time zone, beyond using it. When you are signed in, your browser sends our server its time zone setting (for example "Europe/Kyiv") with each visit and when you open the daily summary, so that "yesterday" means your own yesterday. The server works out your calendar day from it and does not store it
• Device fingerprints. Your browser or app sends a standard technical "user-agent" line with each request; it may appear in technical logs (see § 7) and is not used for anything else
• Browser history or activity outside the Service
• Payment data (the Service is currently free)

3.4 Cookies and analytics

We use two categories of storage in your browser:

1. Strictly necessary technical storage: required for the Service to function. This includes Firebase Authentication session cookies and localStorage keys for caching your labs, board orientation, training progress, and similar preferences. No consent is required for this category.
2. Analytics (optional, opt-in only): Firebase Analytics, which collects anonymised usage statistics (which pages are visited, how features are used). It is disabled by default. We only enable it after you click "Accept" on the cookie banner. You can withdraw consent at any time via "Cookie settings" in the footer; this resets the choice and disables Analytics.

We do not use any tracking, marketing, or advertising cookies.

Visits through a creator's link (§ 3.2) are counted on our side as one number per link and day. The count holds nothing about you, and nothing is stored in your browser for it.

3.5 The Ochess app for Android

The app signs you in to the same Ochess account as the website, with your email and password or with Google, and the data described above applies to it in the same way. In particular:

• What it sends. To our own server (api.ochess.app): requests for your imported games, their analysis, your repertoire and your personal opening statistics; the games and positions you ask the engine to analyse; requests for opening statistics; the training progress of your courses and opening labs; and which opening puzzles you try and whether you solve them. To Google Firebase: sign-in; your profile; your opening labs when you open or edit them; how many times you have trained each trap and your endgame-trainer progress; and, while you are signed in, which screens you open, for the account activity log (see § 3.2). Courses, puzzles and traps are downloaded from our public storage without identifying you.
• Lichess and Chess.com. When you import or refresh your games, the app asks Lichess (lichess.org) and Chess.com (api.chess.com) for the public games of the usernames you entered, directly from your phone. These sites therefore receive your phone's IP address, those usernames and a note that the request comes from the Ochess app, and handle them under their own privacy policies (see § 5.2). The games are then sent to our server. If your phone cannot reach them, our server fetches the same public games instead.
• What it keeps on your phone. Downloaded courses, puzzles and traps (so they work offline), a copy of your opening labs (so they open quickly and edits made without a connection are not lost), your course, puzzle, trap and endgame progress and review schedule, your sound, puzzle-difficulty and endgame-trainer settings, and your sign-in session.
• Android backup. If backup is turned on for your phone, Android may copy your progress files and sound setting (never your sign-in session, your labs or downloaded content) to your Google account's backup, under Google's own privacy policy, and restore them on a new phone.
• Permissions. The app asks for internet access only.
• No third-party analytics, ads or crash reporting. The app contains none of these. Which screens you open goes only to the account activity log (§ 3.2), and only while you are signed in. If you have allowed your phone to share usage and diagnostics data with Google, Google may collect crash and performance reports about the app under Google's own privacy policy and show us aggregated figures in Google Play Console.
• Report a problem. This link opens your email app with a message that includes the app version, your phone model and the Android version. Nothing is sent unless you send that email.
• Deleting your account in the app (Account → Delete account) erases the same data as on the website (see § 9) and also clears the course progress, review schedule and copy of your labs stored on that phone.

3.6 The Ochess app for iPhone

The iPhone app signs you in to the same Ochess account as the website (with your email and password, with Google, or with Sign in with Apple), and the data described above applies to it in the same way. In particular:

• What it sends. The same as the Android app (see § 3.5), except that it does not add the screens you open to the activity log: to our own server, your games, their analysis, your repertoire and opening statistics, the positions you ask the engine to analyse, and your training progress; to Google Firebase, sign-in, your profile, your opening labs, and your trap and endgame-trainer progress. Courses, puzzles and traps are downloaded from our public storage without identifying you.
• Lichess and Chess.com. When you import or refresh your games, the app fetches them from Lichess and Chess.com directly from your iPhone, exactly as described for the Android app in § 3.5.
• Signing in. "Continue with Google" opens Google's own sign-in page in a secure window provided by iOS. "Sign in with Apple" uses Apple's own sign-in sheet. What Google and Apple share with us is listed in § 3.1; what you do on their pages is covered by their privacy policies.
• What it keeps on your iPhone. In the app's private storage: downloaded courses, puzzles and traps (so they work offline), a copy of your opening labs, your course, puzzle, trap and endgame progress, your review schedule, and changes that have not reached our server yet. In the app's settings: your sound, puzzle-difficulty and endgame-trainer choices. In the iOS Keychain: your sign-in session, which only Ochess on this iPhone can read and which is never copied to backups or to another device.
• iCloud and computer backups. If iCloud Backup or a computer backup is turned on, iOS may include the app's files and settings (not your sign-in session) in that backup, under Apple's privacy policy, and restore them on a new iPhone. We cannot see these backups.
• Permissions and tracking. The app asks for no iOS permissions (no camera, photos, contacts, location or notifications), does not use the advertising identifier, and does not track you across other companies' apps or websites.
• No analytics, ads or crash reporting. The app contains none of these. If you have chosen in your iPhone's settings to share analytics with app developers, Apple may provide crash reports and aggregated usage figures about the app under Apple's own privacy policy.
• Report a problem. This link opens your mail app with a message that includes the app version, your iPhone model and the iOS version. Nothing is sent unless you send that email.
• Deleting your account in the app (Account → Delete account) erases the same data as on the website (see § 9), clears the copy of your labs and the course, review and puzzle progress stored on that iPhone, and signs you out. If you signed in with Apple, you are first asked to confirm with your Apple Account, and we ask Apple to revoke Ochess's access to it. Deleting the app removes what it stored on your iPhone, but does not delete your account, and iOS may keep your sign-in session in the Keychain after the app is removed. Sign out first if you are giving the phone to someone else.

4. Why we process your data, and on what legal basis

5. Who we share your data with

We do not sell your personal data. We do not share it for advertising purposes.

We share data only with the following categories of recipients, and only as necessary:

5.1 Service providers (data processors acting on our behalf)

Every service provider listed here processes your personal data only on our instructions, under a written data processing agreement that requires it to keep the data confidential and secure, to protect it to at least the standard described in this policy and required by UK and EU data protection law, and to delete it when the service ends. We do not allow them to use your data for their own purposes.

• Google Ireland Limited / Google LLC (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Firebase Analytics): provides the entire backend infrastructure of the Service. Google acts as our data processor under Google's Cloud Data Processing Addendum.
• Our hosting provider (a professional hosting company inside the European Union): runs the machine behind our own server (api.ochess.app), which does two jobs. First, it is our opening-statistics proxy: when you open a position in Opening Lab, your browser sends the request here and the server fetches the statistics from Lichess on our behalf. Second, it is where your imported games and their analysis are stored and processed: the games themselves, engine analysis reports, your personal opening statistics and your generated repertoire live in a database on this machine, identified by your account ID. The same machine keeps your review schedule for lab chapters and the analysis you run on them, the record of how your games followed the courses you study, and the Lichess and Chess.com usernames on your profile, for which it fetches your new public games from those sites once a day, usually on your first visit of the day. Your IP address is processed by this server inside the EU. The hosting company provides the hardware and acts as our data processor; the software on it is ours. We will name the provider on request.
• Resend (Plus Five Five, Inc., USA): sends the emails about your account (email confirmation and password reset) from noreply@ochess.app on our behalf. It receives your email address and the content of that email. Sending runs on infrastructure in the European Union (Ireland); any transfer to the US is covered by the safeguards described in § 6.
• Google Workspace: hosts our mailboxes, including support@ochess.app, so your emails to us and our emails to you are stored there under Google's Cloud Data Processing Addendum.

5.2 Independent third parties (data controllers in their own right)

When you use certain features, your device (your browser on the website, or the Ochess app on your phone) connects directly to the third parties below. These parties act as independent data controllers, and their handling of your data is governed by their own privacy policies.

• Lichess (Association Lichess.org, France): opening statistics for Opening Lab originate from Lichess, but these requests are now made by our server (see § 5.1), not your browser, so your IP address is not exposed to Lichess for opening statistics. Lichess receives your IP address directly only for the game-import and rating-lookup actions described below. See Lichess Privacy Policy.
• Lichess API (lichess.org/api/...): used when you import or refresh your games or look up your Lichess rating; your IP address is visible to Lichess for these requests. Once a day our server also asks Lichess for your new games under the username on your profile; for that request Lichess sees our server's address and that username, not your IP address.
• Chess.com (Chess.com, LLC, USA): used when you import or refresh your games or look up your Chess.com rating; your IP address is visible to Chess.com for these requests. Once a day our server also asks Chess.com for your new games under the username on your profile, from our server's address, not yours. See Chess.com Privacy Policy.
• Google (Google sign-in) and Apple (Sign in with Apple): used only when you choose to sign in with them; they confirm who you are and share the data listed in § 3.1. If you hide your email with Apple, our emails to you pass through Apple's private relay, which forwards them to your real address. See Google Privacy Policy and Apple Privacy Policy.

5.3 Other users of the Service

• Public lab content: if you set a lab to "public" or "unlisted", its content (move tree, chapters, notes you've added) becomes accessible to anyone who has the share link.
• Direct messages: messages you send are visible to the recipient; a first message to someone new arrives as a request, and they read it only if they accept. The Service Operator reads a conversation when one of its participants reports it, and can technically access stored messages for security and abuse-handling purposes, but does not routinely read them.
• Profile information: your username and any optional profile fields you fill in (FIDE rating, Chess.com / Lichess usernames, "about" text) may be visible to other users in shared contexts.

5.4 Legal disclosures

We may disclose your data if required by law, court order, or to protect the rights, safety, or property of us, our users, or others.

6. International data transfers

Your data is split between two locations:

• United States: account data, profile, opening labs, training progress, messages and the activity log, in Google Cloud (Cloud Firestore default database, Cloud Storage, and the deletion Cloud Function; nam5 multi-region).
• European Union: your imported games and everything computed from them (analysis reports, personal opening statistics, repertoire, how your games followed the courses you study), your review schedule for lab chapters and the analysis of your lab chapters, and the Lichess and Chess.com usernames used for the daily fetch of your games, on our own server. This data does not leave the EEA.

A separate Firestore database used only for static opening data is hosted in the European Union (europe-west3, Frankfurt) and contains no personal data.

This means the data in the first group is transferred outside the UK and EEA to the United States. Our account emails are sent by Resend, a US company, from infrastructure in the EU; any transfer of your email address to the US is covered by the same kind of safeguards, set out in Resend's data processing agreement.

For these transfers, we rely on:

• The Standard Contractual Clauses ("SCCs") approved by the European Commission and the UK International Data Transfer Addendum, which Google Cloud has implemented through the Google Cloud Data Processing Addendum. These provide GDPR-equivalent contractual safeguards.
• Google's supplementary technical measures including encryption at rest and in transit.

You acknowledge that US laws (including FISA Section 702 and Executive Order 12333) may, in limited circumstances, require Google to disclose data to US government authorities. We have no practical way to control or prevent such disclosures, but they are not routine and the SCCs provide remedies in the event of misuse.

If you are not comfortable with this transfer, please do not use the Service.

We aim to migrate primary data storage to an EU region in a future version of the Service. Updates to this policy will reflect any such change.

7. How long we keep your data

We do not retain personal data longer than necessary.

8. Security

We rely on Google Cloud's security infrastructure, which includes encryption in transit (TLS) and at rest, access controls, and ISO 27001 / SOC 2 / ISO 27018 certifications.

On our side, we follow good engineering practices: passwords are never stored in plaintext (Firebase Auth handles them), Firestore Security Rules restrict access to data, and requests to our own server are authenticated with your Firebase token so that one account cannot read another's games or analysis.

The Service Operator can technically access stored account and chess data: it is a single-person project, and the same person maintains the database and the server. In practice this access is used to keep the Service running, to answer support requests, and to read the aggregate statistics described in § 4 (how strong our users are, which openings and courses they use). Individual games, labs and messages are not routinely read.

No system is perfectly secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the UK Information Commissioner's Office (ICO) within 72 hours and notify you without undue delay.

9. Your rights and how to exercise them

Under UK GDPR and EU GDPR, you have the following rights:

• Right of access (Art. 15): you can request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): you can correct inaccurate or incomplete data, either through the Service's profile editor or by emailing us.
• Right to erasure / "right to be forgotten" (Art. 17): you can delete your account from the profile page, in the apps (Account → Delete account), or by email without signing in; the account deletion page describes all three. This automatically erases your profile, username reservation, training progress, opening labs (private and shared), Cloud Storage files associated with your labs, your account activity log, and all your direct messages and conversations from Google Firebase, and your imported games, analysis reports, personal opening statistics, repertoire, course records, review schedule, lab analysis and the Lichess and Chess.com usernames kept for the daily fetch from our own server. The analytics_consent setting in your local browser storage is also cleared. Residual copies in Google Cloud's own systems and backups expire within about six months (Google's stated maximum is 180 days). If you signed in with Apple, deleting your account also asks Apple to revoke Ochess's access to your Apple Account. You can also stop using Sign in with Apple with Ochess in your iPhone's Settings → Apple Account → Sign in with Apple; that does not delete your Ochess account.
• Right to restriction of processing (Art. 18): you can ask us to stop processing your data in certain circumstances.
• Right to data portability (Art. 20): we do not currently provide an in-app data export function. To exercise this right, please email us at support@ochess.app with the subject line "Data export request". We will provide your data in a machine-readable format (JSON) within 30 days.
• Right to object (Art. 21): you can object to processing based on legitimate interests.
• Right to object to direct marketing (Art. 21(2)): you can stop our emails about new courses and features at any time by replying "unsubscribe" to any of them or by writing to support@ochess.app. We then keep only a note not to email you. Emails about your account itself are not affected.
• Right to withdraw consent (Art. 7(3)): for analytics, click "Cookie settings" in the footer at any time. For other consent-based processing, email us.
• Right not to be subject to automated decision-making (Art. 22): we do not engage in automated decision-making with legal effects.

To exercise any of these rights, email us at support@ochess.app. We will respond within 30 days. We may need to verify your identity before acting on requests that don't come from your account email.

Right to lodge a complaint

If you believe we have violated your data protection rights, you can lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or with the data protection authority in your country of residence within the EEA.

10. Children

Anyone can use Ochess without an account. Without one, we do not ask for or store anything that identifies you: courses, puzzles and traps are downloaded from public storage, your progress stays on your device, and our servers and Google's see your IP address only to answer requests (see § 3.3). On the website, Firebase Analytics runs only if the cookie banner is accepted; if you are under 13, or under the age at which you can give this consent yourself where you live (16 in some EU countries), please ask a parent or guardian before accepting it.

Accounts are for people aged 13 or older. If you are under 18, you need a parent's or guardian's permission to create one (Terms § 3.1). We do not knowingly keep an account of a child under 13; if we learn of one, we delete it.

If you are a parent or guardian and want your child's account deleted, or believe a child under 13 has given us personal data, contact us at support@ochess.app and we will delete it.

Because younger people use the Service, some protections apply to everyone: Analytics stays off unless it is accepted, a first direct message from someone new arrives as a request the recipient has to accept, and anyone can report messages, comments and labs.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the latest revision. For material changes (e.g. new categories of data, new storage locations, changes to legal basis), we show registered users a notice on the website on their next visit, summarising what changed and asking you to acknowledge the new version; your acknowledgement, and the version it refers to, are recorded on your account. The apps always link to the current version from the Account tab, and the version you accepted when you created your account is recorded on it.

Previous versions of this policy will be available on request.

12. Contact

For any privacy-related question or to exercise your rights:

Email:support@ochess.app

Subject line suggestions:

• "Data access request"
• "Data export request"
• "Account deletion request"
• "Account deletion follow-up"
• "General privacy question"