Privacy policy

Last updated 30 August 2026

This policy describes what the Chess Wizard extension and website collect, why, and what you can do about it. It is written to be read, not to be defensible.

The short version

• Position analysis happens entirely on your computer. Positions are never sent to us.
• If you connect an account, finished games are sent to us and stored, including the PGN.
• A PGN contains your opponent's username. That is third-party personal data, and we say so below.
• We do not sell anything to anyone, and there are no advertising or analytics cookies.
• You can export everything and delete everything, from Settings, at any time.

What we store

Account

• Email address — to identify your account, for password resets, and for transactional email. It is not used for marketing without a separate opt-in.
• Name — optional, only if you enter one.
• Password — stored only as a PBKDF2-HMAC-SHA256 hash with a per-user salt. We cannot read it and cannot recover it for you.

Games

When the extension is connected to your account, each game you play on a supported site is recorded:

• The platform, time control, the colour you played, and the result.
• The platform's own game identifier.
• The PGN — the full move list, plus whatever tags the platform included, which typically means both players' usernames and often their ratings.
• The final position.
• Derived analysis: an evaluation and classification for each move, and an accuracy figure.

Opponent usernames

This is the part most policies skip. The PGNs we store contain the usernames of the people you played against. Those people are not our users, have not agreed to anything with us, and in most cases do not know we exist. We are storing personal data about them because it is inseparable from the game record you asked us to keep.

We limit that to what the analytics genuinely need: we never contact them, never build a profile beyond "you played this person", and never expose their name to anyone but you. Opponent names are deleted along with your games when you delete your account.

Extension telemetry

The extension sends a small health report describing whether it could still find the board, the move list, and the clock on the page. It contains the hostname (for example lichess.org), the extension version, and a set of true/false checks. It contains no position, no move, and no username. It exists so that we notice within hours when a site changes its markup and the extension silently stops working.

These reports are pruned after 90 days.

Payment

Card details are handled entirely by Stripe and never reach our servers. We store your Stripe customer and subscription identifiers, your plan, and its status.

Cookies

One cookie: an essential, HttpOnly session cookie, set when you log in and cleared when you log out. There are no advertising, tracking, or third-party analytics cookies, which is why this site has no cookie banner. Site traffic is measured with Cloudflare Web Analytics, which is cookieless and does not fingerprint visitors.

What we do not store

• Positions you analyse while playing or reviewing. The engine runs locally; nothing is transmitted.
• Your browsing history, or any page you visit outside chess.com, lichess.org, and this site.
• Card numbers.

Who else processes your data

How long we keep it

• Account and games — until you delete them. Deletion is immediate and permanent.
• Health telemetry — 90 days.
• Billing records — retained by Stripe for as long as their own legal obligations require, independently of your account here.

Our database provider keeps 30 days of point-in-time backups. Deleted data can persist in those backups until they roll off.

Your rights

You can export everything we hold about you as JSON or PGN, and delete your account, from Settings. Both are self-service and take effect immediately — you do not need to email anyone or wait for us.

If you are in the UK, EU, or another jurisdiction with equivalent law, you also have rights of access, rectification, restriction, objection, and portability. The export and delete buttons cover most of these directly. For anything else, get in touch.

If you are an opponent of one of our users and want your username removed from records we hold, contact us and we will action it.

Children

Chess Wizard is not directed at children under 13, and we do not knowingly create accounts for them. If you believe a child has an account here, contact us and we will delete it.

Changes

If we change what we collect, we will update this page and change the date at the top. Material changes will also be emailed to registered users.

Contact

Privacy questions: the contact page.