Privacy Policy

Data controller

The data controller is Mathieu Morio (ChessPivot), 1 passage Saint-Sébastien, 75011 Paris, France.

Contact: contact@chesspivot.com.

Data we process

The Chess.com / Lichess usernames you provide, and the associated games, imported via their public APIs.

Your email address, if you contact us or subscribe.

Minimal technical data (pages viewed, country and device type), via in-house analytics, without cookies and without storing any IP address.

Feature usage: which features are used and how many times a day (for example a “Guess first” attempt, a hint requested, an Explorer search). This measurement is tied to the public username of the account imported on the device, or to the signed-in account; without either, it stays anonymous. It never contains what you type (the text of a search, the content of a game).

A log of the emails we send: message type, date, language and send status. The links in our emails carry no visible tracker, and no pixel measures whether they are opened.

Payment data for the Plus subscription is handled by Stripe; we never store your card number.

Technical error logs (the error message, the page involved, your username, browser and device display configuration), generated automatically when something goes wrong, to diagnose and fix malfunctions.

Purposes and legal bases

Providing the analysis and training service (performance of the contract).

Measuring audience anonymously (legitimate interest).

Improving the product: knowing which features are actually useful, which ones bring players back and which ones are ignored, to decide what to improve or remove (legitimate interest). To judge whether the review email is useful, a small share of accounts, drawn at random, does not receive it; the review stays available on the site. None of this is used for advertising, sold or shared.

Ensuring the reliability and security of the service and fixing faults, via a technical error log (legitimate interest).

Managing subscriptions and billing (performance of the contract and legal obligations).

Processors

Vercel (hosting and running the site), Neon (database), Render (the Stockfish evaluation service, which only receives chess positions), Stripe (payments), Resend (email delivery), Anthropic (coaching generation from your game positions) and Google (only if you choose to sign in with a Google account).

Each provider only accesses the data strictly necessary for its function.

Hosting and where your data lives

The site’s server functions — page rendering, API routes and scheduled jobs — run in Vercel’s fra1 region, in Frankfurt, Germany. The database is hosted by Neon in Germany as well, in the eu-central-1 region. Your games, your analyses and your account are therefore processed and stored inside the European Union.

Two caveats, which we would rather write down than leave out. The network that serves the site’s public files (cached pages, images, browser code) is worldwide by design, and generating the social sharing image is the one site function that runs on it: it reads no personal data. Separately, the Stockfish evaluation service hosted by Render only receives chess positions, with no identifying data at all, and its execution region is not guaranteed to be European.

Retention

Your games and analyses are kept while your account is active, within the service limits.

Technical error logs are kept for at most 90 days, then automatically deleted.

Feature usage measurement and the log of sent emails are kept for 13 months, then automatically deleted.

Billing data is kept in line with legal accounting obligations.

Your rights

You have the right to access, rectify, erase, object to, restrict and port your data.

To exercise them, email contact@chesspivot.com.

You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

Usage measurement is part of how the service works and requires nothing from you: if you do not accept it, you can choose not to use ChessPivot.

Cookies

The site loads no third-party script into your browser and sets no advertising cookie: no ad network, no social media pixel, no external analytics tool. The content security policy applied in production even forbids the browser from connecting to any domain other than ours, and our fonts are served from our own servers.

The cookies we do set are functional: your language preference, and the session cookies that keep you signed in to your account, to the coach space or to the student space.

One cookie falls outside that scope. When a campaign link is followed, an attribution cookie keeps the campaign identifier for 90 days, so we can tell which campaign made the service known. It holds no identity, no username and no browsing history, and it is cleared as soon as it has served its purpose.

Our analytics, in turn, are in-house and cookieless: each visit is counted under a non-reversible fingerprint, recomputed every day, whose IP address is never kept. Feature usage measurement sets no cookie either: it reuses the username the site already keeps on your device to show your games.