Privacy Policy

Nikolas Burk, Erich-Nehlhans-Str. 29, 10247 Berlin, Germany

Email: nikolas.burk@gmail.com

We process personal data only to the extent necessary to provide a functional website and our services. Data collected includes account information (email, name), game data you import, analysis requests, AI coach conversations, images you upload to create puzzles, usage and analytics data (including session recordings in our mobile apps, see section 6), and subscription and purchase information. This data is stored on our servers per user account; your device keeps only a cache so the app stays usable offline.

We process your data based on the following legal grounds (Art. 6(1) GDPR):

• Consent (Art. 6(1)(a)) — e.g. when you sign up or connect OAuth accounts
• Performance of a contract (Art. 6(1)(b)) — e.g. providing analysis, puzzle, and coaching features
• Legitimate interest (Art. 6(1)(f)) — e.g. security, fraud prevention, service improvement

This website is hosted on Cloudflare (Workers, D1 database, Durable Objects for real-time sync). Cloudflare may process connection data (IP address, timestamps) in the EU and US. We have a Data Processing Agreement (DPA) with Cloudflare.

You can register using the following methods:

• Email & Password — your password is stored as a bcrypt hash, never in plain text
• OAuth via GitHub, Google, or Lichess — we only request the minimum required scopes (email, profile). OAuth tokens are stored securely on our servers.
• Session data — we store your IP address, user agent, and geolocation data (city, country, coordinates) provided by Cloudflare for session security

Game imports, puzzle progress, and analysis requests are stored on our servers per user account. Display preferences and a cache of recently fetched data stay local to your browser. Stockfish analysis requests contain only chess positions (no personal data).

When you create a puzzle from a screenshot, the image you select is uploaded to our servers and processed to detect the chessboard and extract the position (FEN). Uploaded images are used only for this purpose, are not used for advertising, and are not shared with third parties for their own purposes.

We use PostHog (PostHog, Inc.) for product analytics, processed in its EU cloud (Frankfurt). We record events describing how features are used — a puzzle solved, a page viewed — linked to your user ID. The content of what you type (chat messages, comments, games) is not sent as event data.

In our mobile apps (iOS, Android) we additionally record your on-screen session to understand how features are used and where people get stuck. Images and text entry fields are masked on your device before the recording is transmitted; text displayed on screen is not masked. Recordings are deleted automatically after 30 days. The legal basis is our legitimate interest in improving the service (Art. 6(1)(f) GDPR).

Chat messages and chess positions are sent to the Vercel AI Gateway (currently using Google Gemini). Messages are processed to generate responses and are not permanently stored by the third-party provider for training purposes.

Paid subscriptions are processed through RevenueCat (RevenueCat, Inc., USA) together with the Google Play billing system. To validate purchases and manage your subscription entitlements, RevenueCat collects a device identifier (e.g. Android ID / app-set ID) and your purchase history (subscription status, transactions). We do not receive your full payment card details; these are handled by Google Play. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in fraud prevention (Art. 6(1)(f) GDPR).

We use Brevo (formerly Sendinblue) to send verification and password reset emails. Your email address and name are shared with Brevo for this purpose. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

We use technically necessary first-party session cookies for authentication (Better Auth), plus first-party cookies set by our analytics software PostHog, which recognise a session and link repeat visits by the same person. We do not use third-party cookies and no cookies for advertising. You can object to analytics at any time — see section 12.

Some of our service providers are based in the United States: Cloudflare, Vercel (AI Gateway), Google (Gemini AI), GitHub (OAuth), RevenueCat (subscription processing), and PostHog (product analytics). Analytics data is stored exclusively in PostHog's EU cloud (Frankfurt), though PostHog, Inc. itself is US-based. These transfers are protected by Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework.

Under the GDPR, you have the following rights:

• Right of access (Art. 15) — request information about your stored data
• Right to rectification (Art. 16) — correct inaccurate data
• Right to erasure (Art. 17) — request deletion of your data
• Right to restriction (Art. 18) — restrict processing of your data
• Right to data portability (Art. 20) — receive your data in a machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interest
• Right to lodge a complaint with a supervisory authority

The competent supervisory authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

You can delete your account at any time via the app settings. This will permanently remove your personal data from our servers. Some data may be retained for a limited period to comply with legal obligations.

We may update this privacy policy from time to time. The current version is always available at this URL.