Legal information
Privacy Policy
This notice explains which data ChessFiore processes, why it is processed, and which choices remain under your control.
Last updated: 28 August 2026
1. Data controller
The data controller is ChessFiore, which determines the purposes and means of the data processing required to operate the platform.
2. Data processed and purposes
| Data | Purpose | Legal basis |
|---|---|---|
| PGN, FEN, game metadata and Stockfish results | Provide the requested analysis, display it and reuse an identical result already calculated | Performance of the requested service (GDPR Art. 6(1)(b)) |
| Seed-derived credentials, random identifier and session token encrypted in transit | Create the pseudonymous account, authenticate and keep the session active | Performance of the requested service (GDPR Art. 6(1)(b)) |
| Chess.com or Lichess username, when provided | Find games and, for a signed-in user, remember the preference | Performance of the user’s request (GDPR Art. 6(1)(b)) |
| IP address and technical request data in security logs | Abuse prevention, error diagnosis and service security | Legitimate interest in security (GDPR Art. 6(1)(f)) |
| Browsing data, online identifiers, interactions and advertising data processed by Google services, only after consent | Measurement through Google Analytics/Tag Manager and, when enabled, advertising management and personalization through Google AdSense | Consent (GDPR Art. 6(1)(a) and ePrivacy rules), withdrawable at any time |
The 10 seed words are not stored by the server. The server keeps an HMAC value to locate the account and an Argon2id verifier; session tokens are stored only as hashes.
3. Optional account and browser data
You can analyze without an account. In that case, the browser locally stores up to 20 structured results in IndexedDB; the original PGN is not saved in local history. If you create a seed account, history is linked to the pseudonymous identifier and synchronized with the server.
4. Recipients and external services
Stockfish runs on ChessFiore infrastructure. Technical data may be processed by hosting, database and cache providers appointed as processors where required. Only when you request a profile search does ChessFiore query the official Chess.com or Lichess APIs using the username supplied. Subject to consent, Google LLC and its group companies may process data through Google Analytics, Google Tag Manager and Google AdSense under their applicable terms and notices. ChessFiore does not directly sell personal data.
5. Retention
- The account session expires after 90 days and is revoked on logout.
- Browser history remains until you delete it in the interface or clear site data.
- Synchronized history remains linked to the account until individual analyses are deleted or erasure is requested.
- Technical logs are retained only for as long as necessary for security, abuse prevention and error diagnosis. Results in the global cache remain available while useful for analysis deduplication, unless deleted or the cache is technically renewed.
6. Security and seed limitations
Measures include HTTPS in production, HttpOnly, Secure and SameSite=Strict session cookies, Argon2id hashing and request rate limiting. The seed is the only access key: if you lose it there is no recovery by email or phone, and ChessFiore cannot reconstruct it. No system can guarantee absolute security.
7. Your rights
Where provided by the GDPR, you may request access, rectification, erasure, restriction, portability and objection, and lodge a complaint with the competent supervisory authority. Because the account is pseudonymous and collects no contact details, acting on an account may require proof of control through a valid session. Requests may be submitted to ChessFiore through the contact channels made available by the platform.
8. Transfers and automated decisions
Google and other providers may involve transfers outside the European Economic Area; in that case, safeguards required by applicable law and described by the provider apply, including adequacy decisions or standard contractual clauses where applicable. Automated chess analysis produces guidance about play and does not create legal or similarly significant effects for a person.
9. Changes
This notice will be updated when features, providers or retention periods change. The date above identifies the current version.