Privacy Policy
This Privacy Policy explains how ChessNotes (operated by Francesco Albano) collects, uses, and protects your personal data when you use the website chessnotes.app and the ChessNotes web application (the “Service”). It is written to comply with the EU General Data Protection Regulation 2016/679 (“GDPR”) and the Italian Legislative Decree 196/2003 as amended by D.Lgs. 101/2018 (“Italian Privacy Code”). In short: we keep your account, your repertoires and your training so the app works; we count a few first-time steps to improve the app, and you can switch that off; we import chess games only if you ask; we never sell your data or show ads; you can get a copy of your data, correct it or delete it, and delete your account yourself in the app.
Last updated: 2026-10-01
1. Data Controller
- The Data Controller under Article 4(7) GDPR is Francesco Albano, a private individual providing the Service free of charge, based in Italy.
- You can contact the Data Controller about any matter relating to your personal data at albanofrancesco22@libero.it.
- We have not appointed a Data Protection Officer (DPO) because our processing does not meet the thresholds of Article 37 GDPR (no large-scale processing of special categories, no large-scale regular and systematic monitoring). If this changes we will update this policy and publish the DPO contact.
2. Personal data we collect
We collect only what the Service needs to work and to be improved. We do not collect special categories of data (health, religion, political opinions, etc.) and we do not ask for your real name, address, phone number or payment details.
2.1 Account data
- Your email address and the date your account was created. Passwords are handled by Firebase Authentication (Google) and are never visible to us.
- Whether your email address has been verified (we send a verification email when you sign up with email and password).
- If you sign in with Google (optional): the basic profile Google shares with Firebase Authentication (email address, name and profile picture). We use the email address for your account and show your Google name in your profile; we do not use the profile picture.
- Sign-in records kept by Firebase Authentication: the IP address and browser user-agent used to sign in and the date of the last sign-in.
- A record of your acceptance of the Terms of Service: the version accepted, when, how (email sign-up, Google sign-up or the in-app prompt) and in which language.
2.2 Content you create
- Your repertoires: titles, the move tree (PGN and its layout), notes and annotations on positions, and timestamps of creation and last change.
- For repertoires you build from your own games: a summary stored with the repertoire (which platform and username the games came from, the filters you chose, how many games and how often each position occurred in them).
2.3 Training data
- For every position you train: its review history and schedule (the spaced-repetition state, due date, number of reviews and lapses, timestamps of the last reviews) and a per-repertoire summary (positions learned, last training date).
- Your progress and settings: XP, level, streaks and streak freezes, daily goal, badges, training-load preferences (session length, new positions per day, memory target), and per-session counters used so that XP is never lost or counted twice.
2.4 Usage statistics
The dates on which you first reach a few product steps and how many days you use the Service. Details, legal basis and how to switch it off are in section 4.
2.5 Chess games (only if you connect a chess.com or Lichess username)
Your public games from chess.com and/or Lichess and data derived from them. Details in section 5.
2.6 Technical data and data stored on your device
- Technical data: IP address, browser user-agent and request timestamps, processed by our hosting providers when your browser connects to the Service and to the chess services described in section 6. Our server functions use the IP address only in memory, for a few minutes, to limit the number of requests per device.
- Security reports: if the page tries to load something our security policy (Content Security Policy) does not allow, your browser may send us an automatic report. We keep only the type of rule, the blocked address and the page path (without query strings) in our hosting logs; like any request, it reaches our host with your IP address.
- Device storage: your preferences, caches and safety copies of unsaved training progress are kept in your browser (LocalStorage, SessionStorage and IndexedDB). See the Cookie Policy.
2.7 Support communications
The content of any email you send us and our replies.
3. Purposes and legal basis of processing
We process your personal data for the following purposes, each based on a specific legal ground under Article 6 GDPR:
3.1 To provide the Service (Art. 6(1)(b) — contract)
Creating and securing your account, verifying your email address, storing and syncing your repertoires and notes, scheduling your training, keeping your progress, and the analysis features (engine evaluations, opening statistics). Without this data we cannot provide the Service.
3.2 To import and analyse your games, at your request (Art. 6(1)(b) — contract)
When you connect a chess.com or Lichess username we download and analyse the public games of that username to show you your statistics and the features listed in section 5. You can disconnect at any time.
3.3 Usage statistics to improve the Service (Art. 6(1)(f) — legitimate interest)
Understanding where new users get stuck (for example, how many create a first repertoire or finish a first training session) so we can fix the onboarding and the product. You can object at any time with the in-app switch described in section 4.
3.4 To secure the Service and prevent abuse (Art. 6(1)(f) — legitimate interest)
Security rules, per-device rate limits on our server functions, write-throttling, security reports (section 2.6) and technical logs kept by our providers. Our legitimate interest is keeping the Service available and safe for all users. You can object to this processing (section 9); we may continue it only for compelling legitimate grounds, such as stopping an attack.
3.5 Support and legal obligations (Art. 6(1)(b), (c) and (f))
Answering your messages, handling requests about your rights, keeping the record of the Terms you accepted (to show which version applies to you), and complying with legal obligations.
4. Usage statistics
To understand whether new users manage to get started, the app records on your own account record (users/{your id}, field funnel) the date and time of the first time you:
sign up and open the app; open the Quick start; create your first repertoire (and how it was created: blank, PGN, Lichess study, starter repertoire, from games); add your first moves; open the board; write your first note; start a training session, answer a first position, complete a first session and close a training session (with rough ranges only: the stage it was at, the training mode, how many positions were queued and answered, and how long it was open); finish or skip the guided tour; start importing the games of a chess.com or Lichess username and connect it; open “Repertoires from your games” (and from where: Quick start, library, a notice), see the openings found there (how many) and create repertoires from your games (how many); come back on a later day, after a week, and for a second session.
It also keeps the last day you were active, the number of days you used the app and the number of sessions (a new session is counted when you open the app at least 30 minutes after the start of the previous one), and how many times you closed a training session, and how many of those without answering any position.
What it does not record: no repertoire titles, moves, notes, games or search terms; no clicks or page views; no device fingerprint. It uses no cookies and no third-party analytics tools (no Google Analytics, no Firebase Analytics, no advertising pixels), and nothing is shared with anyone.
How it is used: the operator runs aggregate reports (counts, percentages and median times across all users). We do not look at individual records except when needed to fix a technical problem, and they are never used to make decisions about you, for marketing or for profiling.
Legal basis: our legitimate interest in improving the Service (Art. 6(1)(f) GDPR). We have assessed that this minimal, first-party processing does not override your interests, also because you can stop it at any moment.
How to switch it off (right to object, Art. 21 GDPR): open the account menu → Profile & progress → Privacy and turn off Usage statistics. The choice is saved on your account and applies on all your devices: recording stops immediately and the statistics already collected are deleted. When it is off, your account is also left out of the operator’s aggregate reports. You can turn it back on at any time.
Retention: for as long as your account exists, unless you switch it off earlier.
5. Games from chess.com and Lichess
This feature is optional and starts only when you enter a username in Your games:
What we fetch: the public games of that username, using the chess.com Published-Data API and the Lichess public game export. These are games that the platforms already publish. We do not ask for your chess.com or Lichess password and we do not access your account on those platforms.
What we store: for each game, the moves, the result, the colour you played, the opening, the time control and class, the date, whether it was rated, the game link, your rating and your opponent’s public username and rating as published by the platform. For Lichess we import the games of the last 12 months; if they are fewer than 200, we also import older games, newest first, until you have 200 games in total or there are no more. For both platforms, at most the 6,000 most recent games. They are stored on our database linked to your account (collections chesscomConnections, chesscomArchives, lichessConnections, lichessArchives) and, to make the app fast, cached in your browser (IndexedDB).
What we use them for: only to show you your own statistics: your results by opening and position, habitual mistakes, where your games leave your repertoire, blunder review, repertoires built from your games, and the rating band used for the coverage score. Evaluations of positions from your games may be requested from the Lichess cloud evaluation or computed in your browser by Stockfish.
Opponents: your games include your opponents’ public usernames and ratings. We show them only to you, as part of your game history, and we do not use them for any other purpose. If you are one of those opponents: your public username and rating come from the public game records published by chess.com or Lichess; we process them on the basis of the legitimate interest of our user, and ours, in analysing the user’s own games (Art. 6(1)(f) GDPR); they are kept as long as the game is kept (section 8.3); and you can exercise your rights, including the right to object, by writing to us (section 9).
Only usernames you are entitled to use: please connect only your own accounts (or one you are authorised to analyse). We do not verify ownership, because the data is already public.
Disconnecting: when you disconnect a username, its stored games and connection data are deleted from our database and from the cache in your browser. Repertoires you created from your games are your content and stay until you delete them (they keep the summary described in section 2.2). Signing out removes the local games caches from that browser.
7. International data transfers
Google and Vercel are part of groups based in the United States, and Lichess and chess.com may process requests outside the EEA. In particular, Firebase Authentication (sign-in) runs only in data centres in the United States. When personal data is transferred outside the European Economic Area, it is protected by one of the mechanisms of Articles 44-49 GDPR:
The European Commission adequacy decision on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795 of 10 July 2023), for recipients certified under it — Google LLC is certified.
Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) included in the providers’ data processing terms: Firebase Data Processing and Security Terms and Vercel Data Processing Addendum. You can also ask us for a copy of the safeguards at the address in section 1.
Additional measures such as encryption in transit (TLS) and at rest.
8. How long we keep your data
We keep personal data only as long as needed for the purposes above:
8.1 Account, content and training data
For as long as your account exists. You can delete individual repertoires in the app at any time. To delete your whole account, open the account menu → Profile & progress → Privacy → Delete account: after you confirm your password (or your Google account), your login, repertoires, training data, usage statistics and imported games are deleted at once, and the related data in that browser is removed. You can also email albanofrancesco22@libero.it from the address linked to the account: we then delete everything within 30 days of the request. In both cases, residual copies in our provider’s backup systems are overwritten within the provider’s cycle (for Google, at most 180 days) and are not used meanwhile.
8.2 Usage statistics
For as long as your account exists, or until you switch them off (they are deleted immediately).
8.3 Imported games
Until you disconnect the username or delete your account.
8.4 Data on your device
Until you sign out (account-related caches and the games databases are removed), clear your browser’s site data, or the cache expires. Details in the Cookie Policy.
8.5 Technical logs and support emails
Technical logs are kept by our providers for limited periods set in their own terms: the logs of our server functions that we can see on Vercel are kept from one hour to one day depending on the hosting plan (at most 30 days); Firebase Authentication keeps sign-in IP addresses for a few weeks. We do not use logs to profile you. The in-memory rate-limit counters last a few minutes. Support emails are kept as long as needed to handle your request and any follow-up (for requests about your rights, also as long as needed to show how we handled them), then deleted.
9. Your rights
Under Articles 15-22 GDPR, you have the following rights regarding your personal data:
Right to object. You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21 GDPR). For usage statistics no reason is needed: switch them off in Profile & progress → Privacy and they stop and are deleted at once. For anything else, write to us.
9.1 Rights available to you
- Access (Art. 15) — request a copy of your personal data.
- Rectification (Art. 16) — correct inaccurate data (most of it is editable directly in the app).
- Erasure (Art. 17) — request deletion; you can also delete repertoires, disconnect game sources and delete your whole account yourself (section 8.1).
- Restriction (Art. 18) — limit how we process your data.
- Portability (Art. 20) — receive your data in a structured, machine-readable format; repertoires can also be exported as PGN in the app.
- Objection (Art. 21) — object to processing based on legitimate interest; for usage statistics use the switch in Profile → Privacy.
- Automated decisions (Art. 22) — we do not take decisions with legal or similarly significant effects by automated means. Training schedules and suggestions are features of the Service, not decisions about you.
9.2 How to exercise your rights
Email albanofrancesco22@libero.it. We will respond within one month, extendable by two further months for complex requests (Art. 12(3) GDPR). It is free of charge; we may only charge a reasonable fee or refuse for manifestly unfounded or excessive requests. We may ask you to write from the email linked to your account to confirm your identity.
9.3 Right to lodge a complaint
If you believe we are processing your data unlawfully, you can lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority): https://www.garanteprivacy.it, or with the supervisory authority of the EU country where you live or work.
10. Security
We take appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or disclosure:
Transport encryption (HTTPS/TLS) on every connection, and encryption at rest by our providers.
Firestore Security Rules: each user can read and write only their own data; there is no anonymous access.
Passwords are handled by Firebase Authentication and never stored by us in plain text.
Write-throttling and a client-side circuit breaker to limit abuse and runaway errors.
Account-related browser caches are removed when you sign out, to protect shared devices.
Security headers on every page, including a Content Security Policy that lists the only servers the page may contact (currently in report-only mode: violations are reported, not blocked).
If a personal data breach occurs we record it, notify the Italian Data Protection Authority within 72 hours where required (Art. 33 GDPR) and, where the risk to you is high, inform you directly (Art. 34 GDPR).
12. Minors
- The Service is not intended for children under 14. We chose this minimum age by reference to the Italian age of digital consent (Art. 8 GDPR and Art. 2-quinquies of the Italian Privacy Code), even though our processing is not based on consent. We do not knowingly collect data from children below this age. If you are a parent or guardian and believe your child has provided us with personal data, contact us and we will delete it promptly.
- Users aged 14 to 17 are treated like everyone else: nobody’s data is used for advertising, marketing or profiling. The short summary at the top of this policy explains the essentials in plain words.
13. Changes to this policy
- We may update this Privacy Policy, for example when we add features. When we make material changes we will update the date at the top, keep previous versions available on request, and inform signed-in users with an in-app notice (and by email where reasonably possible). Changes that only describe processing more accurately apply from publication; if we start a new kind of processing, we will tell you before it starts.
- This is version 3.0.0, last updated on 2026-10-01.
14. Contact
For any question about this Privacy Policy or to exercise your rights, write to albanofrancesco22@libero.it.