Privacy policy
Last updated 31 August 2026
This policy describes what the Chess Wizard extension and website collect, why, and what you can do about it. It is written to be read, not to be defensible.
The short version
- Live overlay analysis is not written to your account. Finished games are stored if you connect one.
- If you connect an account, finished games are sent to us and stored, including the PGN.
- A PGN contains your opponent's username. That is third-party personal data, and we say so below.
- We do not sell anything to anyone, and there are no advertising or analytics cookies.
- You can export everything and delete everything, from Settings, at any time.
What we store
Account
- Email address — to identify your account, for password resets, and for transactional email. It is not used for marketing without a separate opt-in. If you sign in with Google we receive the email Google has on that account.
- Name — optional, only if you enter one, or the name Google sends on first sign-in.
- Password — stored only as a PBKDF2-HMAC-SHA256 hash with a per-user salt, and only if you set one. Google-only accounts have no password stored.
- Google account id — Google's stable user id (
sub), so we can recognise you on the next sign-in. We do not store your Google profile photo, and we do not keep a Google access token.
Games
When the extension is connected to your account, each game you play on a supported site is recorded:
- The platform, time control, the colour you played, and the result.
- The platform's own game identifier.
- The PGN — the full move list, plus whatever tags the platform included, which typically means both players' usernames and often their ratings.
- The final position.
- Derived analysis: an evaluation and classification for each move, and an accuracy figure.
Opponent usernames
This is the part most policies skip. The PGNs we store contain the usernames of the people you played against. Those people are not our users, have not agreed to anything with us, and in most cases do not know we exist. We are storing personal data about them because it is inseparable from the game record you asked us to keep.
We limit that to what the analytics genuinely need: we never contact them, never build a profile beyond "you played this person", and never expose their name to anyone but you. Opponent names are deleted along with your games when you delete your account.
Extension telemetry
The extension sends a small health report describing whether it could still find the board, the
move list, and the clock on the page. It contains the hostname (for example
lichess.org), the extension version, and a set of true/false checks. It contains no
position, no move, and no username. It exists so that we notice within hours when a site changes
its markup and the extension silently stops working.
These reports are pruned after 90 days.
Payment
Card details are handled entirely by Stripe and never reach our servers. We store your Stripe customer and subscription identifiers, your plan, and its status.
Cookies
One cookie: an essential, HttpOnly session cookie, set when you log in and cleared when you log out. There are no advertising, tracking, or third-party analytics cookies, which is why this site has no cookie banner. Site traffic is measured with Cloudflare Web Analytics, which is cookieless and does not fingerprint visitors.
What we do not store
- Positions from live overlay analysis while you play or review a game.
- Your browsing history, or any page you visit outside chess.com, lichess.org, and this site.
- Card numbers.
Who else processes your data
| Processor | What for |
|---|---|
| Cloudflare | Hosting, database, CDN, bot protection, cookieless analytics |
| Sign-in, if you choose Continue with Google | |
| Stripe | Payments and subscription management |
| Resend | Transactional email (verification, password reset) |
How long we keep it
- Account and games — until you delete them. Deletion is immediate and permanent.
- Health telemetry — 90 days.
- Billing records — retained by Stripe for as long as their own legal obligations require, independently of your account here.
Our database provider keeps 30 days of point-in-time backups. Deleted data can persist in those backups until they roll off.
Your rights
You can export everything we hold about you as JSON or PGN, and delete your account, from Settings. Both are self-service and take effect immediately — you do not need to email anyone or wait for us.
If you are in the UK, EU, or another jurisdiction with equivalent law, you also have rights of access, rectification, restriction, objection, and portability. The export and delete buttons cover most of these directly. For anything else, get in touch.
If you are an opponent of one of our users and want your username removed from records we hold, contact us and we will action it.
Children
Chess Wizard is not directed at children under 13, and we do not knowingly create accounts for them. If you believe a child has an account here, contact us and we will delete it.
Changes
If we change what we collect, we will update this page and change the date at the top. Material changes will also be emailed to registered users.
Contact
Privacy questions: the contact page.