Privacy Policy
This is a translation of our German privacy policy. It describes the same data processing; the is the reference version.
ChessRiddle – Chess Training App
Last updated: October 15, 2026
Preamble
ChessRiddle is a chess training app that enables users to improve their tactical and visualisation-related chess skills through interactive puzzles and computer-assisted analyses.
The app is available as:
- Web application at chessriddle.com
- Mobile app for iOS (Apple App Store)
- Mobile app for Android (Google Play Store)
This privacy policy informs you about the nature, scope and purpose of the processing of personal data within our app and the associated websites, features and content.
We, ChessRiddle (hereinafter also "we" or "us"), take the protection of your personal data seriously and would like to inform you about data protection in our company.
Within the scope of our responsibility under data protection law, the entry into force of the EU General Data Protection Regulation (Regulation (EU) 2016/679; hereinafter: "GDPR") has imposed additional obligations on us to ensure the protection of personal data of the persons affected by processing (we also address you as a data subject with "customer", "user", "you" or "data subject").
Insofar as we decide alone or jointly with others on the purposes and means of data processing, this includes above all the obligation to inform you transparently about the nature, scope, purpose, duration and legal basis of the processing (cf. Art. 13 and 14 GDPR). With this statement (hereinafter: "privacy notice"), we inform you about the manner in which your personal data is processed by us.
Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is
ChessRiddle, Inh. Felix Beck
Kraillinger Weg 9
82061 Neuried
Germany
Phone: +49 15510 814400
E-mail: info@chessriddle.com
A Data Protection Officer has not been appointed, as the requirements under Section 38 of the German Federal Data Protection Act (BDSG) (fewer than 20 persons constantly engaged in automated data processing) are not met.
General Information
Definitions
In accordance with Art. 4 GDPR, this privacy notice is based on the following definitions:
"Personal data" (Art. 4(1) GDPR) means any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Identifiability may also be established through the combination of such information or other additional knowledge. The form or embodiment of the information is irrelevant (photographs, video or audio recordings may also contain personal data).
"Processing" (Art. 4(2) GDPR) means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data, as well as the modification of a purpose or intended use originally underlying the data processing.
"Controller" (Art. 4(7) GDPR) means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
"Third party" (Art. 4(10) GDPR) means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data; this also includes other affiliated legal entities within a group of companies.
"Processor" (Art. 4(8) GDPR) means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller, in particular in accordance with the controller's instructions (e.g. IT service providers). In terms of data protection law, a processor is not a third party.
"Consent" (Art. 4(11) GDPR) of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Legal bases for data processing
By law, any processing of personal data is in principle prohibited and only permitted if the data processing falls under one of the following legal justifications:
- Art. 6(1)(a) GDPR ("Consent"): Where the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
- Art. 6(1)(b) GDPR: Where processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract;
- Art. 6(1)(c) GDPR: Where processing is necessary for compliance with a legal obligation to which the controller is subject (e.g. a statutory retention obligation);
- Art. 6(1)(d) GDPR: Where processing is necessary in order to protect the vital interests of the data subject or of another natural person;
- Art. 6(1)(e) GDPR: Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; or
- Art. 6(1)(f) GDPR ("Legitimate interests"): Where processing is necessary for the purposes of the legitimate interests (in particular legal or economic interests) pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject (in particular where the data subject is a child).
For each processing operation we carry out, we indicate the applicable legal basis below. Processing may also be based on several legal bases.
Data deletion and storage duration
For each processing operation we carry out, we indicate below how long the data is stored by us and when it is deleted or blocked. Unless an explicit storage period is stated below, your personal data will be deleted or blocked as soon as the purpose or legal basis for storage ceases to apply. As a rule, your data is only stored on our servers in Germany, subject to the cases expressly named in this privacy notice. However, storage may continue beyond the stated period in the event of (threatened) legal disputes with you or other legal proceedings, or if storage is required by statutory provisions to which we as controller are subject (e.g. Section 257 of the German Commercial Code (HGB), Section 147 of the German Fiscal Code (AO)). When the storage period prescribed by statutory provisions expires, the personal data will be blocked or deleted, unless further storage by us is necessary and a legal basis exists for this.
Data security
We employ appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties (e.g. TLS encryption for our website), taking into account the state of the art, the costs of implementation and the nature, scope, context and purpose of the processing, as well as the existing risks of a data breach (including the likelihood and impact thereof) for the data subject. Our security measures are continuously improved in line with technological developments. We are happy to provide you with further information on request.
Cooperation with processors
Where we use external service providers to handle our business operations (e.g. in the areas of IT, logistics, telecommunications, sales and marketing), they only act on our instructions and are contractually obliged in accordance with Art. 28 GDPR to comply with data protection regulations.
Requirements for the transfer of personal data to third countries
In the course of our business relationships, your personal data may be disclosed or transferred to third-party companies. These may also be located outside the European Economic Area (EEA), i.e. in third countries. Such processing takes place exclusively to fulfil contractual and business obligations and to maintain your business relationship with us. We inform you about the respective details of the transfer in the relevant sections below. The European Commission certifies an adequate level of data protection for some third countries through so-called adequacy decisions. In other third countries to which personal data may be transferred, there may not be a consistently high level of data protection due to a lack of statutory provisions. Where this is the case, we ensure that data protection is adequately guaranteed. This is possible through binding corporate rules, Standard Contractual Clauses of the European Commission for the protection of personal data, certificates or recognised codes of conduct.
No automated decision-making (including profiling)
We do not intend to use the personal data collected from you for any automated decision-making process (including profiling).
No obligation to provide personal data
We do not make the conclusion of contracts with us conditional on you providing personal data to us in advance. As a customer, there is generally no statutory or contractual obligation for you to provide us with your personal data; however, it may be that we can only offer certain services on a limited basis or not at all if you do not provide the data required for this. If this is exceptionally the case within the scope of the products we offer below, you will be specifically informed.
Legal obligation to transmit certain data
We may in certain circumstances be subject to a special statutory or legal obligation to make lawfully processed personal data available to third parties, in particular public authorities (Art. 6(1)(c) GDPR).
Changes to this privacy notice
In the course of the development of data protection law and technological or organisational changes, our privacy notice is regularly reviewed for any need for adjustment or supplementation.
Your Rights
You may assert your rights as a data subject with regard to your processed personal data at any time using the contact details provided above. As a data subject, you have the right:
- pursuant to Art. 15 GDPR, to obtain from us confirmation as to whether or not personal data concerning you are being processed. In particular, you may request information about the purposes of the processing, the categories of data, the categories of recipients to whom your data have been or will be disclosed, the envisaged period of storage, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected by us, and the existence of automated decision-making including profiling and, if applicable, meaningful information about its details;
- pursuant to Art. 16 GDPR, to obtain from us without undue delay the rectification of inaccurate personal data or the completion of incomplete data stored by us;
- pursuant to Art. 17 GDPR, to obtain the erasure of personal data stored by us, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
- pursuant to Art. 18 GDPR, to obtain the restriction of processing of your data, insofar as the accuracy of the data is contested by you or the processing is unlawful;
- pursuant to Art. 20 GDPR, to receive your personal data which you have provided to us in a structured, commonly used and machine-readable format, or to request the transmission to another controller ("data portability");
- pursuant to Art. 21 GDPR, to object to the processing at any time, where processing is based on Art. 6(1)(e) or (f) GDPR. This is particularly the case where the processing is not necessary for the performance of a contract with you. Unless it is an objection to direct marketing, we ask you, when exercising such an objection, to state the reasons why we should not process your data as we have done. In the event of your justified objection, we will examine the situation and will either cease or adjust the data processing, or demonstrate to you our compelling legitimate grounds on the basis of which we will continue the processing;
- pursuant to Art. 7(3) GDPR, to withdraw your consent at any time — that is, your freely given, specific, informed and unambiguous indication expressed by a statement or other clear affirmative action that you agree to the processing of the personal data in question for one or more specific purposes — if you have given such consent. The consequence is that we may no longer continue the data processing based on this consent for the future; and
- pursuant to Art. 77 GDPR, to lodge a complaint with a supervisory authority about the processing of your personal data by our company.
Data we collect when using the app
Registration and user account
During registration, we collect:
| Data | Required/Optional | Purpose | Legal basis |
|---|---|---|---|
| E-mail address | Required | Account management, authentication, transactional emails | Art. 6(1)(b) |
| Password (hashed) | Required | Authentication | Art. 6(1)(b) |
| Username | Optional | Display in leaderboards and profile | Art. 6(1)(b) |
| Avatar (profile picture) | Optional | Profile personalisation | Art. 6(1)(a) |
| Country | Optional (editable in profile) | Display in leaderboards and profile, default billing currency and eligibility for regional prices | Art. 6(1)(b) |
User registration serves as identification for the purpose of contract performance pursuant to Art. 6(1)(b) GDPR.
Data will be deleted as soon as it is no longer necessary for the purpose for which it was collected. For data collected during the registration process for the performance of a contract or for the implementation of pre-contractual measures, this is the case when the data is no longer required for the performance of the contract. Even after the conclusion of the contract, it may be necessary to store personal data of the contractual partner in order to comply with contractual or statutory obligations.
As a user, you have the option to cancel your registration at any time. You may have the data stored about you amended at any time. If the data is required for the performance of a contract or for the implementation of pre-contractual measures, early deletion of the data is only possible insofar as no contractual or statutory obligations prevent such deletion.
Usage data
When using the app, we collect the following data, also pursuant to Art. 6(1)(b) GDPR for the purpose of contract performance:
- Puzzle attempts (result, number of attempts, solving time, puzzle type)
- Evaluation attempts (rating estimate, result, solving time)
- Glicko-2 ratings (separate ratings for tactics, visualisation and positional, each automatically calculated)
- Streak data (Riddle Streak, Evaluation Streak)
- Coordinate training results (stored server-side)
- Incorrect puzzle attempts (for the "Practice Mistakes" feature — repetition of previously incorrectly solved puzzles)
- Statistics and progress
- Moves entered when solving and puzzles served
- Training sessions and training plans
- Self-assessed playing level and best leaderboard positions
We store technical context linked to your account with puzzle attempts, coordinate attempts, training sessions, feedback, subscription starts and registration. The recorded fields vary by event: a pseudonymous session ID created per browser tab (chess-tactics-session-id), app surface and platform, app version and build, user agent, device type and time zone. Subscription starts record only surface, platform, version and build.
This context supports per-session statistics, error analysis for specific devices and versions, and displaying times in your time zone. Legal basis: Art. 6(1)(b) GDPR for the time zone, Art. 6(1)(f) GDPR for the other fields (legitimate interest in understanding usage and resolving errors).
Settings
Users can configure over 40 settings (e.g. language, board design, move notation, sound, difficulty levels). These are stored server-side on the basis of Art. 6(1)(b) GDPR and synchronised across devices.
Push notifications
If you allow push notifications, we transmit a device-specific token and the title and body of each notification to Google Firebase Cloud Messaging (FCM) for delivery and, for iOS devices, additionally to the Apple Push Notification Service (APNs).
Notification content may include:
- Another user's username
- Duel invitations, acceptances, declines, deadline reminders and results
- Friend requests and accepted friend requests
- Training plans shared with you, including the plan's name (shortened)
- Invitations to and activity in shared training sessions
- Arena notifications: that an arena has started, your final rank and the number of participants, and that you won an arena prize
- Reminders about your subscription, trial or crypto Gold access
Legal basis: Art. 6(1)(a) GDPR (Consent). You can switch off each category (duels, arenas, friends, training, account) separately or switch off all push notifications at any time in the app's notification settings, or withdraw push permission entirely in your operating system settings. The withdrawal applies to future processing and does not affect your other use of the app.
Device tokens that have been inactive for 180 days are automatically deleted.
Technical data
When accessing our app, the following data is automatically collected:
- IP address (temporarily in server logs)
- Device type, operating system, browser version
- Time zone
- Date and time of access
The legal basis for the temporary storage of data and log files is Art. 6(1)(f) GDPR.
The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's device. For this purpose, the user's IP address must be stored for the duration of the session.
The storage of additional metadata in log files is necessary to ensure the functionality of the website. The data also serves us for technical optimisation of the website and to ensure the security of our information technology systems. No evaluation of the data for marketing purposes takes place in this context.
For abuse protection, rate limiting briefly holds your IP address in an in-memory store (Redis), only for the length of the rate-limit window. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse).
Payment data
Payment processing is handled exclusively via Stripe (including purchases from the mobile app — these redirect to the Stripe Checkout page). There are no in-app purchases through the app stores.
We do not store any credit card numbers or bank details. We only receive from Stripe:
- Payment confirmation
- Payment method (type, last 4 digits)
- Billing periods
- Stripe customer ID
Legal basis: Art. 6(1)(b) GDPR (Performance of a contract)
Payment processing enables contract performance by the user.
With each payment we store the list price and, when your country qualifies for a regional price tier, that country — whether you buy the regional or the global price. Subscriptions record any applied promo code and the partner attribution when a purchase comes through a partner link. Misuse of a regional price may result in a recorded refund or cancellation.
To prevent repeated free trials, we keep the trial email address, Stripe customer ID and claim time even after account deletion. The record also contains the checkout session ID, source account ID and available app surface, platform, version and build. Our retention policy limits trial claims to 3 years after the claim. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing repeated trials).
Partner links and promo codes
When you open a partner link, we count a click at most once per visitor and day using a keyed hash of the partner slug, IP address and date. The marker stores no IP address and is deleted automatically 24 hours after the click. Partners see only aggregate clicks, sign-ups, sales and commission, never names or email addresses.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in commission accounting with partners).
Verified chess titles (Lichess, Chess.com)
Title verification is optional and starts at your request in settings. Legal basis: Art. 6(1)(b) GDPR (providing the feature you request).
For Lichess, you are redirected to lichess.org and sign in there. We request no permissions (no scopes) and read only your Lichess account ID, username and title. We ask Lichess to revoke the access token immediately afterwards. Revocation can fail and is not retried. We never see your Lichess password or store the token. Only an accepted title is stored.
For Chess.com, you enter your Chess.com username and place a verification line containing your ChessRiddle username and a code on your public Chess.com profile. We store the Chess.com username, code, line and request status. Via Mailjet we email your ChessRiddle user ID and username, Chess.com username, profile URL, code and line to our own mailbox for manual review. The request email stays in our mailbox until decided, at most 3 years, and account deletion does not remove it. When granting a title, we read the player ID and title for that username from Chess.com's public API. You can remove the verification line from your Chess.com profile after the decision.
On grant we store the title, platform, external username, external account ID and grant time. Other signed-in users see the title on leaderboards, profiles and arena standings. One external account can verify only one ChessRiddle account.
Your title is kept until you remove it in settings or delete your account. Title request records stay in the database until account deletion. These database records are included in data export and deleted with your account. The separate mailbox copy follows the retention policy above, based on Art. 6(1)(f) GDPR (legitimate interest in handling verification requests).
Country check for regional prices
The IP address of the request is looked up locally on our server against the DB-IP IP-to-Country Lite database to determine the country solely to offer regional prices. For this check, the IP address is not stored or passed on.
There is no transfer to third countries.
Legal basis: Art. 6(1)(f) GDPR (Legitimate interest in preventing misuse of regional prices).
IP Geolocation by DB-IP (CC BY 4.0)
Social Features
Profile visibility and leaderboards
Every signed-in user can view your profile unless you have blocked each other. Your profile shows username, avatar, verified title, country, ratings, best streak, solved and attempted counts, accuracy, rating history and member-since date. Users can find you by username. Leaderboards for ratings, streaks and puzzles solved, filterable by country, show username, avatar and title. These profiles and leaderboards are not visible to visitors who are not signed in.
Legal basis: Art. 6(1)(b) GDPR (ranking and comparison are part of the service).
a) Friendships
Users can send friend requests to other users. Accepted friends additionally get the friend-only features described below:
- Duels, live training sessions and shared training plans
- Puzzle solving history subject to the conditions of lit. b)
Legal basis: Art. 6(1)(b) GDPR (Performance of a contract). The friendship feature is part of the contractually agreed scope of the app.
b) Sharing puzzle solving history with friends
Users can enable in the privacy settings that their puzzle solving history is visible to accepted friends. This feature is disabled by default.
Legal basis: Art. 6(1)(a) GDPR (Consent). Consent is given by actively enabling the corresponding option in the privacy settings. It may be withdrawn at any time with effect for the future by disabling the option. The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
c) Friend suggestions
Users can set in the privacy settings whether they appear in other users' friend suggestions. This feature is enabled by default.
Legal basis: Art. 6(1)(f) GDPR (Legitimate interest). The legitimate interest lies in promoting social interaction within the app. Users may object to the processing at any time by disabling visibility in friend suggestions in the privacy settings.
d) Blocking
Users can block other users. Blocked users cannot send friend requests to the blocking user and cannot view their profile.
Duels, live training, arenas and collections
- Duels take place between accepted friends. Your opponent sees per-puzzle results and the head-to-head record. Invitations and results are sent by email and push notification.
- In live training sessions between friends, the trainer sees the student's moves live. A shared training plan is visible to its recipient.
- Arenas are public or link-only. Any signed-in user who can open an arena sees participants' username, avatar, title, score and presence. Prize winners receive a Gold subscription.
- Puzzle collections are private to their owner.
Legal basis: Art. 6(1)(b) GDPR (providing these features). Records are kept until account deletion. Hosted arenas and recorded prizes remain without a link to the person after deletion, based on Art. 6(1)(f) GDPR (legitimate interest in preserving arena and prize records).
Email Communication
Transactional emails
We send transactional emails via the service provider Mailjet SAS (France/EU) for the following purposes:
- Account: registration confirmation, magic link, password reset, password-changed notice and email change, including notice to the old address
- Subscription and payment: trial ending, payment failed, free period ending, cancellation and reactivation confirmations, regional-price refund, withdrawal information and confirmation
- Social: duel invitation and result, live training session invitation
Emails use the language selected in your account where a translation of that email exists. Cancellation confirmations are in German or English. Withdrawal confirmations use the language of the withdrawal form where a translation exists. Withdrawal information after purchase is in German for German recipients. Other recipients receive a localized introduction where a translation exists, followed by the binding German text and an English translation for reference. Opening and click tracking is disabled.
Legal basis: Art. 6(1)(b) GDPR (Performance of a contract — required for the operation of the user account)
We keep records of sent billing and cancellation emails under Art. 6(1)(b) and (c) GDPR for contract performance and statutory documentation. Feedback messages, chess-title requests and withdrawal declarations are also emailed to our own mailbox via Mailjet.
Duel and shared-session invitations also save the recipient address when preparing the first delivery attempt. Retries keep that address despite later account email changes, including after temporary failures or exhausted retries. It remains while the invitation is eligible and delivery is pending. It is erased when sending is recorded, when the invitation becomes ineligible, or when either participant deletes their account. Shared-session suppression also erases it. Only the invited recipient receives this saved address in their data export.
For cancellation and reactivation confirmations, billing notices and crypto-payment confirmations, we save the recipient address when preparing the first delivery attempt. Retries use that same address even if you later change your account email, so one pending message is not sent again to a different address. The saved address remains while delivery is pending, including after temporary errors or exhausted dispatch attempts. It is erased immediately when we record successful sending, permanent rejection or suppression.
Newsletter (planned)
We plan to send a newsletter with information about new features, tips and app updates. The newsletter will be sent via Mailjet.
- Legal basis: Art. 6(1)(a) GDPR (Consent)
- Sign-up: Voluntary, via a separate opt-in
- Unsubscribe: Possible at any time via the unsubscribe link in each newsletter email or in the account settings
When signing up for the newsletter, we store:
- E-mail address
- Time of sign-up
- IP address at sign-up (proof of consent)
Hosting, Processors and Third Parties
We have concluded Data Processing Agreements with the processors below. Independent controllers are identified separately. For the transfer of personal data to the processor and the processing by the processor, no further legal basis within the meaning of Art. 6 to 10 GDPR is required beyond the one on which we ourselves as controller base the processing.
Netcup GmbH – Hosting
Supabase Inc. – Database and Authentication
Stripe Inc. – Payment Processing
Sentry (Functional Software Inc.) – Error Monitoring
Google LLC – Firebase Cloud Messaging
Apple Inc. – Apple Push Notification Service
Plausible Analytics (Self-Hosted) – Website Analytics
Mailjet SAS – Email Delivery
Lichess – Independent controller
lichess.org (Association Lichess, France) handles your sign-in for optional title verification as an independent controller. We read account ID, username and title as described above. Processing stays in the EU, with no third-country transfer.
Legal basis: Art. 6(1)(b) GDPR.
Chess.com – Independent controller
Chess.com, LLC (USA) receives only the username you enter when we query its public player API at your request. Chess.com acts as an independent controller. The transfer to the USA is necessary to perform the title verification you request under Art. 49(1)(b) GDPR.
Legal basis: Art. 6(1)(b) GDPR.
YouTube / Google – Homepage video
The player from youtube-nocookie.com loads only after you click the homepage video. Google Ireland Limited then receives your IP address and browser data as an independent controller. Transfers to the USA rely on the EU-US Data Privacy Framework.
Legal basis: Art. 6(1)(a) GDPR (consent by clicking to load the video).
App Store Distribution
Apple App Store and Google Play Store serve exclusively for the distribution of the app. Payments are not processed through the app stores but through Stripe. The respective privacy policies of Apple Inc. and Google LLC apply to the data collected by them in the context of app store usage.
When downloading the app, the information required for this purpose is transmitted to the respective app store operator, in particular username, e-mail address, customer number of your app store account, time of download, payment information and individual device characteristics.
Further information on data processing by the app store operators can be found in their privacy notices:
- Apple Distribution International Ltd. (Ireland): https://www.apple.com/legal/privacy
- Google Ireland Limited: https://policies.google.com/privacy
Cookies, Local Storage and Technical Storage
We do not use any tracking cookies or advertising cookies. For website analytics, we use Plausible Analytics (self-hosted), which does not use cookies and does not collect personal data (see the Hosting, Processors and Third Parties section above for details).
Apart from the app's push registration, which is based on your consent pursuant to Section 25(1) TDDDG (see the table below and Push notifications), all local storage is strictly necessary for the operation of the website and app and does not require consent pursuant to Section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).
On the website
| Storage | Type | Purpose | Lifetime |
|---|---|---|---|
| sb-*-auth-token | Cookie | Supabase session token, possibly split into numbered parts. A related -code-verifier cookie is used during sign-in | Until logout or at most about 400 days |
| chess-tactics-settings | localStorage | User settings (language, board design, etc.) | Persistent |
| chess-riddle-daily-limit-reached | localStorage | Daily puzzle limit for free users | 1 day |
| chessriddle_seen_modes | localStorage | Tracks whether first-time user hints have been shown | Persistent |
| cached-puzzle-data | sessionStorage | Cached puzzle data | Browser session |
| submitted-puzzle-id-* | sessionStorage | Prevents duplicate puzzle submissions | Browser session |
| streak-playing | sessionStorage | Marks active streak session (navigation guard) | Browser session |
| chess-tactics-session-id | sessionStorage | Pseudonymous session ID per tab, sent with requests and stored with usage data (see Usage data) | Browser session |
| bestEvalStreak | localStorage | Evaluation streak personal best (local) | Persistent |
| NEXT_LOCALE | Cookie | Transient language of the displayed page | 1 year |
| CHOSEN_LOCALE | Cookie | Saved account language with account ID, server revision and a chosen/no-choice marker. Restores explicitly chosen language on ordinary visits and prevents older responses from restoring a superseded choice. A no-choice marker retains its revision. Current clients remove obsolete account bindings on confirmed sign-out or account change when shared browser access is available. | 1 year |
| __Secure-auth-confirmation | Cookie | Email-confirmation handoff | 5 minutes |
| training-session | localStorage | Resume an active training session | Training-session data is removed at logout |
| challenge-run | localStorage | Resume a duel and remember its finished state | Duel data is removed at logout |
| training.setup.lastMode:* | localStorage | Last training mode | Persistent |
| chessriddle:idempotency:* | sessionStorage | Prevents duplicate submissions | Browser session |
| chessriddle:lang-adopted:* | sessionStorage | Apply the account language once per sign-in | Browser session |
| chessriddle.password-reset | sessionStorage | Password-reset handoff | Browser session |
| engine-cache-v1 | Cache Storage | Cached chess engine files | Persistent |
In the mobile app
The app stores the following data only on your device, in app-private storage that other apps cannot read. Apart from the push registration, which exists only with your consent (see Push notifications), this storage is strictly necessary.
| Storage | Type | Purpose | Lifetime |
|---|---|---|---|
| Sign-in session (Supabase session including refresh token, and a temporary code verifier during sign-in) | App storage (SharedPreferences / NSUserDefaults) | Keeps you signed in | Session: until logout. Code verifier: until sign-in completes or logout |
| Access token, cached profile and a pending email-address change | Secure storage of the operating system (Android Keystore, iOS Keychain) | Authenticates requests, shows your profile while offline and completes an email change | Until logout. Email-change requests and replay markers expire after one day and are removed when checked |
| Settings, display preferences and local counters (board, sound, haptics, hints and arena celebrations already shown, whether you were already asked about notifications, last training mode, personal bests, daily-limit status, practice-mistake count) | App storage | Remembers your choices on this device | Until you uninstall the app or clear its data. Hints already shown, evaluation personal bests, daily-limit status and practice-mistake count are cleared at logout |
| Pending changes not yet confirmed by the server (unsent puzzle submissions, additions to collections) | App storage | Prevents lost or duplicate submissions when the connection drops | Until the server has confirmed them or the pending change is discarded |
| Push registration (Firebase installation ID and push token, kept by the Firebase SDK) | App storage | Delivers push notifications if you allow them (see Push notifications) | The push token is deleted at logout. For the installation ID: until you uninstall the app or clear its data |
| Cached files (opening catalogue, voice clips for spoken move announcements) | App files/cache | Faster loading, fewer downloads | Opening catalogue: until you uninstall the app or clear its data. Voice clips: until replaced or removed by the operating system |
| Data export file | Temporary file | Created only when you export your data, to hand it to the share dialog | Temporary, in the operating system's temporary directory |
| Unsent error reports (Sentry) | App files | Delivers error reports that could not be sent yet (after a crash or while offline) | Until sent or removed by the SDK's cache management |
Data Security and Retention
Technical and organisational measures
- Transport encryption: All data is transmitted via HTTPS/TLS
- Password hashing: Passwords are hashed with bcrypt (via Supabase Auth)
- Row Level Security: Database access is secured by Supabase Row Level Security (RLS) — users can only read and edit their own data
- Access controls: Administrative access to infrastructure and database is restricted to the controller
Retention periods
| Data type | Retention period | Legal basis |
|---|---|---|
| User account data | For the duration of the contractual relationship; after account deletion, only insofar as individual data is still required due to statutory obligations or for legal defence. | Art. 6(1)(b) GDPR during the contract term, Art. 6(1)(f) post-contractually. |
| Payment data (Stripe) | 10 years after end of contractual relationship | Section 147 AO in conjunction with Section 257 HGB |
| Error logs (Sentry) | 90 days | Art. 6(1)(f) GDPR |
| Inactive device tokens for push notifications | Automatically deleted after 180 days of inactivity | Art. 6(1)(a) GDPR |
| Support enquiries (email) | Until final resolution, max. 3 years | Art. 6(1)(f) GDPR |
| Newsletter consent record | 3 years after unsubscription | Art. 6(1)(f) GDPR to fulfil the burden of proof under Section 7(2) of the German Act Against Unfair Competition (UWG) |
| Chess titles and title request records | Title until removal in settings or account deletion, request records until account deletion | Art. 6(1)(b) GDPR |
| Chess-title request emails in our mailbox | Until decided, at most 3 years. Account deletion does not remove mailbox copies | Art. 6(1)(f) GDPR |
| Duels, live sessions, arenas, collections and training plans | Until account deletion. Hosted arenas and prize records remain without a link to the person | Art. 6(1)(b) and (f) GDPR |
| Trial claim record | Retention policy: 3 years after the trial claim, including after account deletion | Art. 6(1)(f) GDPR |
| Feedback emails in our mailbox | Until resolved, at most 3 years. Account deletion does not remove feedback emails | Art. 6(1)(f) GDPR |
| Feedback database metadata | At most 3 years under our retention policy, with the account link removed on account deletion | Art. 6(1)(f) GDPR |
| Sent billing and cancellation emails and other billing records | Up to 10 years | Art. 6(1)(b)/(c) GDPR, § 147 AO / § 257 HGB |
| Saved invitation recipient addresses | While delivery is pending and the invitation remains eligible. Erased on recorded sending, loss of invitation eligibility or deletion of either participant’s account. Shared-session suppression also erases the address. | Art. 6(1)(b) GDPR |
| Saved confirmation recipient addresses | Only while delivery is pending. Erased immediately on recorded successful sending, permanent rejection, suppression or account deletion. Retained delivery audit records follow their existing retention rules without this saved address. | Art. 6(1)(b) GDPR |
| Partner-click marker | 24 hours after the partner-link click | Art. 6(1)(f) GDPR |
| Rate-limit entries | Only the rate-limit window | Art. 6(1)(f) GDPR |
International Data Transfers
Overview of third-country transfers
| Provider | Server location | Registered office | Transfer mechanism |
|---|---|---|---|
| Netcup | Germany | Germany | – (no third country) |
| Chess.com | USA | USA | Art. 49(1)(b) GDPR |
| Google (FCM, YouTube) | USA | USA / Ireland | EU-US DPF |
| Apple (APNs) | USA | USA | Standard Contractual Clauses (SCCs) |
| Supabase | Frankfurt (AWS eu-central-1) | USA (Singapore) | EU-US DPF + SCCs |
| Stripe | USA | USA | EU-US DPF |
| Sentry | Frankfurt (ingest.de.sentry.io) | USA | EU-US DPF + SCCs |
| Mailjet | EU | France | – (no third country) |
Note on the EU-US Data Privacy Framework (DPF)
The EU-US Data Privacy Framework was declared valid on 10 July 2023 by an adequacy decision of the European Commission. The validity was confirmed in September 2025 by the General Court of the European Union (EGC). At the time of this privacy policy, an appeal before the Court of Justice of the European Union (CJEU) is pending.
In addition to the DPF, we have agreed Standard Contractual Clauses (SCCs) with the relevant providers as a supplementary safeguard.
Minors
The app is intended for users who have reached the age of 16.
Users under the age of 16 may only use the app with the express consent of a parent or guardian (Art. 8 GDPR).
USA / COPPA: Children under the age of 13 may not use the app. We do not knowingly collect personal data from children under 13 within the meaning of the Children's Online Privacy Protection Act (COPPA). Should we become aware that data of a child under 13 has been collected, it will be deleted without delay.
Notice for Users from California (CCPA/CPRA)
For users residing in California, the provisions of the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) additionally apply.
"Do Not Sell or Share"
We do not sell any personal data of our users and do not share it with third parties for advertising purposes within the meaning of the CCPA/CPRA.
Your Rights under CCPA/CPRA
- Right to Know: You may request information about the personal data collected
- Right to Delete: You may request the deletion of your data
- Right to Opt-Out: As we do not sell or share data, an opt-out is not required
- Right to Non-Discrimination: You will not suffer any disadvantage from exercising your rights
Contact
Requests under CCPA/CPRA should be directed to: info@chessriddle.com
Automated Decision-Making
The app automatically calculates several Glicko-2 ratings (for tactics, visualisation and positional) based on the user's puzzle solutions and evaluation attempts. These ratings serve exclusively for the selection of appropriate puzzle difficulty levels and for display in leaderboards.
No automated decision-making within the meaning of Art. 22 GDPR takes place that produces legal effects or similarly significantly affects the user. The rating affects neither access to features nor the terms of the subscription.
Data Export and Account Deletion
Data export
Users can export their personal data via the account settings. The export includes all stored account data, settings and usage statistics in a machine-readable format.
This includes chess titles and title requests, duels, sessions, arenas and trial claim records.
Account deletion
Users can delete their account at any time in the account settings. Upon account deletion:
- Profile, settings, puzzle and training data, ratings, friendships, duels, live sessions, arena participations, collections, chess titles and requests, push tokens, avatar and login account are removed. External avatar and login cleanup is queued and retried if necessary.
- Payment and billing records are retained without the account for statutory documentation (Section 147 AO, Section 257 HGB: 10 years), then deleted under our retention policy.
- Deleting either participant’s account removes the invitation and its saved recipient address. A sender that has already copied the address may still complete an in-flight send.
- Saved confirmation recipient addresses are erased with account deletion. An in-flight sender that already copied the address may still send the email. Account deletion cannot recall a message already handed to the email provider.
- Withdrawal declarations are retained for 3 years from the end of the year of receipt. Trial claim records are retained for 3 years after the claim to prevent repeated free trials, under our retention policy.
- Feedback database metadata remains for at most 3 years under our retention policy, with its account link removed. Feedback emails and chess-title request emails remain in our mailbox until resolved or decided, at most 3 years. Account deletion does not remove these emails.
- Arenas you hosted and recorded prizes remain without a link to you, to preserve arena and prize records.
- Error logs in Sentry are automatically deleted after a maximum of 90 days.
Contact and Support
When contacting us by email (info@chessriddle.com), we process the data provided by the user (email address, name, content of the enquiry) to handle the matter.
Legal basis:
- Art. 6(1)(b) GDPR (for enquiries related to an existing contract)
- Art. 6(1)(f) GDPR in conjunction with Recital 47 GDPR (for general enquiries — legitimate interest in responding, which corresponds to the user's expectation that their data will be used for the response)
The data will be deleted after final resolution of the matter, unless statutory retention obligations apply.
In-app feedback form
The feedback form sends your message, optional screenshot and email address as the reply address to our mailbox via Mailjet. It also includes feedback type, page URL and user agent. The feedback email is kept until resolved, at most 3 years, and is not removed by account deletion.
The feedback database record contains only feedback type, message length, screenshot presence, page URL and technical context (see Usage data), not the message itself. Account deletion removes its link to your account. Our retention policy deletes this metadata after at most 3 years.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering feedback and improving the app).
Withdrawal Form (§ 356a BGB)
When you use our online withdrawal function at chessriddle.com/withdraw, we process the data you submit (name, username, email address, as well as the date and time of receipt of your withdrawal declaration) exclusively to fulfil our statutory obligation under § 356a German Civil Code (BGB) to confirm receipt of your withdrawal declaration on a durable medium, including the content, date, and time of receipt.
Legal basis:
- Art. 6(1)(c) GDPR in conjunction with § 356a German Civil Code (compliance with a legal obligation to which the controller is subject)
Recipients: To deliver the receipt confirmation, we transmit your email address, name, and username to our data processor Mailjet SAS (see the “Mailjet SAS – Email Delivery” section above). No further disclosure to third parties or transfer to third countries outside the EU takes place.
Retention period: We store your withdrawal declaration and the receipt confirmation as proof of proper handling of your withdrawal declaration. Retention is based on the standard limitation period (three years under §§ 195, 199 BGB, starting at the end of the year in which the withdrawal was received). The data is then deleted unless longer statutory retention obligations apply.
Voluntary nature: Use of the online withdrawal function and submission of the requested data is voluntary. You may alternatively declare your withdrawal by post, fax, or email (see the withdrawal notice in our Terms); in that case we process only the data contained in your declaration. Not providing the data has no contractual consequences.
Changes to this Privacy Policy
We reserve the right to update this privacy policy to adapt it to changes in the legal situation, technical changes or new features.
For material changes affecting the rights of users, we will notify you:
- By email to the registered email address, and/or
- By a notice upon the next login in the app
The current version is always available at chessriddle.com/privacy.
Contact and Supervisory Authority
Controller
ChessRiddle, Inh. Felix Beck
Kraillinger Weg 9
82061 Neuried
Germany
Phone: +49 15510 814400
E-mail: info@chessriddle.com
Competent supervisory authority
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
(Bavarian State Office for Data Protection Supervision)
Promenade 18
91522 Ansbach
Germany
Phone: +49 981 180093-0
E-mail: poststelle@lda.bayern.de
