Privacy Policy

• Account information: email address, password hash (via Firebase Authentication), optional display name when signing in with Google.
• Chess content: the repertoires, positions, annotations and notes you create. These are stored in our database linked to your account.
• Support communications: any message you send us via email.

• Technical data: IP address, user-agent string, timestamps of requests (logged by our hosting provider for security and debugging).
• Session data: Firebase Authentication cookies/tokens to keep you signed in.
• Device preferences: language preference, board settings, training progress stats (stored locally in your browser via LocalStorage and IndexedDB so the app can work offline and faster on repeat visits).

• Chess.com: your public username, games history, ratings. Only if you voluntarily connect your chess.com account via the in-app “Connect” feature.
• Lichess: public study content you choose to import. No account linking required.
• Google: basic profile info (email, name, avatar) if you sign in with Google OAuth.

• We never see or store your full payment card details. All payments are processed by Lemon Squeezy acting as Merchant of Record. We only receive metadata about your subscription status (active, trial, cancelled, renewal date) associated with your Firebase user ID.
• Lemon Squeezy processes your card under their own Privacy Policy: https://www.lemonsqueezy.com/privacy.

Creating and managing your account, storing your repertoires, delivering training features, authenticating you. Without this data we cannot provide the Service.

When you subscribe to the Pro plan, we share your Firebase user ID and email with Lemon Squeezy so they can link the purchase to your account and activate Pro features via webhooks.

Keeping records of transactions and receipts for tax and accounting purposes. We retain billing records for 10 years as required by Italian tax law (D.P.R. 633/1972).

Server logs, rate-limiting, fraud prevention, write-throttling. Our legitimate interest is keeping the Service available and safe for all users.

Answering your questions and resolving issues when you contact us.

• Google LLC (Firebase) — authentication, database (Firestore), file hosting. Data lives in EU regions where possible; some metadata may be processed in the USA under the EU-US Data Privacy Framework. Privacy: firebase.google.com/support/privacy.
• Vercel Inc. — static hosting and edge serverless functions. Data transit processed in the USA under the EU-US Data Privacy Framework. Privacy: vercel.com/legal/privacy-policy.

Lemon Squeezy — a product of Stripe, Inc., USA — processes all payments as Merchant of Record, collects applicable VAT, issues receipts. Privacy: https://www.lemonsqueezy.com/privacy.

• Chess.com — we call their public API with your username to fetch your games, only after you connect your account in-app.
• Lichess — we call their public API to fetch opening statistics and cloud evaluations for positions you view; no account linking required.

We never sell, rent or trade your personal data to third parties for marketing purposes. We do not show third-party advertising.

Kept for the duration of your account. If you delete your account, your profile, repertoires, and training progress are permanently deleted within 30 days. You can request deletion by emailing privacy@chessnotes.app.

Transaction receipts and invoices are retained for 10 years as required by Italian tax law (D.P.R. 633/1972 art. 39 and D.Lgs. 74/2000). These may be retained even after account deletion.

Access logs (IP, timestamp, URL) are kept for up to 90 days for security and debugging, then automatically discarded.

Encrypted backups may retain data for up to 30 days after deletion before being overwritten.

• Access (Art. 15) — request a copy of your personal data.
• Rectification (Art. 16) — correct inaccurate data (most editable directly in-app).
• Erasure / “right to be forgotten” (Art. 17) — request deletion.
• Restriction (Art. 18) — limit how we process your data.
• Portability (Art. 20) — receive your data in a structured, machine-readable format.
• Objection (Art. 21) — object to processing based on legitimate interest.
• Withdraw consent (Art. 7) — where processing is based on consent.
• Not be subject to automated decisions (Art. 22) — we do not perform automated decision-making with legal effects.

Email us at privacy@chessnotes.app with your request. We will respond within 30 days, extendable by another 60 days for complex requests (Art. 12(3) GDPR). The service is free; we may charge a reasonable fee only for manifestly unfounded or excessive requests.

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority): https://www.garanteprivacy.it, or with the supervisory authority in your country of residence.