Privacy Policy

FlexiChess is built to run in your browser. You can use the board, engine analysis, and Game Search without an account and without sharing any personal data with us. Building a personal library — importing your own games, collections, and repertoire — needs a free account.

Your library is held in your browser’s storage, which is what makes opening a game instant — analysis runs on your machine rather than on ours. Once you are signed in with a verified email address, your library also backs up to your account automatically, so your games are on every device you use and survive clearing your browser. This backup is automatic and cannot be switched off — your library lives in your account, and the copy in your browser is a working cache of it.

When you import games from Lichess or Chess.com — yours, or an opponent’s when you scout them — we fetch those games from the platform’s public API and store them in your library, which is backed up to your account like anything else you import. Game records on those platforms are public. When we match an account to a player you are scouting, we also read the account’s public profile — its declared name, title and ratings — to confirm the match, and we show you that evidence rather than keeping it hidden. We rely on our legitimate interest in making Scout accurate, and you can remove any matched account from a report.

Two things can leave your account because you choose to publish them: a share link (a single game, readable by anyone who has the link, deletable and expiring) and a public collection (listed in Community databases with its name, game count and your creator credit, copyable by signed-in users). Making either private again stops new access; copies others already took are theirs.

Your library is not uploaded in three cases: while you are signed out, before your email address is verified, and for any single collection larger than your plan’s cloud limit. In each of those cases the collection stays on that device only, and the Library marks it as such. If you would rather nothing were stored with us, use FlexiChess signed out, or export your library to PGN and delete your account.

If you don’t sign in: we don’t create an account for you and your games and library stay in your browser. Two things still reach us: the text of your game searches, which is never linked to you or to your IP address, and your IP address itself, used transiently for rate limiting. We also collect anonymous, aggregated usage and error telemetry to keep the app working. Search query text is kept for at most 12 months and then deleted.

If you are signed in: the text of your game searches is also kept with your account for 30 days, so we can see what you were looking for if you ask us for help. After 30 days only the anonymous aggregate remains, and deleting your account deletes the log with it.

That telemetry includes a record of each signed-out visit: the page you arrived on, and the furthest of five steps you reached before you left. It is a count, not a trail. No identifier, no session, no referrer, no timings and nothing you typed are stored with it, so there is nothing in it that ties one visit to another, to a person, or to an account created later.

If you create an account: account identifiers (such as your email and authentication details) handled by our authentication provider; the chess data synced to your account (once your email address is verified, your collections, repertoire, training cards and settings back up automatically); and basic technical metadata (such as device/browser type and timestamps) needed to operate sync. We also keep, from your first visit only, the language your browser asked for, the country the visit came from, and roughly how big your browser window was — a band such as 1280–1439 pixels wide, never an exact size — so we know which languages and regions to build for and which screens the layouts have to fit. None of the three is updated afterwards.

If you subscribe to Pro: billing details are collected and processed by our payments provider, Polar, which acts as our Merchant of Record. We do not receive or store full card numbers.

If you ask Pallas a question: we keep a record of that call on our servers — the position on the board, the moves that led to it, which model answered, whether the answer passed our automatic checks, and the wording of your question together with the reply you were given. Reading a real exchange is how a bad answer becomes a fixed one. The record is linked to your account when you are signed in, and to nobody when you are not. Your question and the reply are erased after 30 days, leaving the rest of the record — position, model, checks — which we delete after 180 days. If you filed an accuracy report that is still open, both clocks wait until the report is resolved, since the question and the reply are the report. Deleting your account removes everything immediately, open report or not.

If you send us feedback or a support message: we keep what you wrote, the email address you give us so we can reply, and basic technical details — the page you were on, your browser and screen size — which is usually what makes a bug reproducible. If you are signed in, it is linked to your account and is deleted with your account. If you write to us signed out, it is not linked to any account; email support@flexichess.com to have it removed.

We use browser local storage to hold your FlexiChess data and remember your preferences (such as layout and board settings), and a small record of which accounts have signed in on this browser so each account’s data stays separate. Signing in sets authentication cookies provided by our auth provider. If you arrive from one of our ads or from a creator’s link, a first-party cookie remembers which one brought you, so we know which are worth running; the cookie itself identifies the ad or the creator, not you, lasts 30 days, and is never shared with ad platforms. If you go on to create an account, we record which ad or creator brought that account in — that link lives in your account record, and is deleted with it, not in the cookie. We do not use third-party advertising or cross-site tracking cookies.

Those attribution cookies are not set at all for visitors in the EU, EEA or UK. They are not strictly necessary to run the service, so consent would be required, and rather than ask for it we simply do without: the visit works identically, we just do not learn which ad it came from. Nothing else we store is used for advertising or analytics on your device — our usage and error telemetry is counted on our servers and writes nothing to your browser.

We rely on a small number of processors, each handling only the data needed for their function:

• Clerk — account authentication and session management.
• Polar — our Merchant of Record for Pro subscriptions: payment processing, billing, and sales-tax/VAT compliance.
• Cloudflare — hosting, content delivery, and cloud storage for synced game libraries and their backups.
• PlanetScale — managed database hosting for your synced collections, repertoire, training history, and account records.
• Resend — email delivery. Used when you invite someone to a collection (the invitee’s address and your account email are processed to send that invitation), and to send the weekly summary described below if you have it switched on.
• Anthropic — the AI behind our optional coaching and commentary, and behind the step in Game Search that works out what a phrase we don’t recognise was asking for. What we send is your question (or the words you typed into search) and the game or position context needed to answer it; no account identifiers are attached to these requests. Anthropic retains what we send, and what it returns, for a limited period — 30 days — for safety and security purposes, and by default does not use data sent through its API to train its models. Output is AI-generated and may be inaccurate.

FlexiChess provides a public reference database of historical and current chess games for study. These records originate from publicly available published sources and may include the names of players, along with event names, dates, and results. We process this publicly-available information for the legitimate purpose of providing a chess research and preparation tool. Features like Scout compute aggregate statistics over a player’s own published games — the openings they play, the structures they reach, how they score. We do not enrich the game database itself with personal data from other sources, and nothing here makes automated decisions about anyone. In-app reference cards for a small number of the world’s best-known professional players (name, country, career notes) are compiled from public sources — write to us to correct or remove an entry.

If you are a player whose games appear here, you have the right to object to that processing at any time on grounds relating to your situation. Tell us at support@flexichess.com and we will assess it promptly — within a month — and remove the records unless we can show compelling legitimate grounds that override your interests. You can also ask us to correct a record that is wrong — a misspelled name, a wrong result — which is usually the faster fix and the one people actually want.

To provide and maintain the service, authenticate you, back up and sync your data across devices when you’re signed in, meter plan allowances (such as coach questions and Scout reports), process subscriptions, respond to support requests, and diagnose and fix problems. We do not sell your personal data, and we do not use it to make automated decisions that produce legal or similarly significant effects about you.

Where the GDPR or UK GDPR applies, our legal basis depends on what we are doing:

• Running your account, syncing your library, and taking payment — performance of our contract with you.
• Keeping the service up and secure, metering plan allowances, and fixing what breaks — our legitimate interest in operating a service that works and is not abused.
• The reference game database — our legitimate interest in providing a chess research and preparation tool from published results (see below, including your right to object).
• Sending the weekly summary — our legitimate interest in telling account holders about their own training and their own openings. You can object at any time by switching it off, and every email carries a one-click link that does the same thing without signing in.
• Keeping billing records — compliance with our legal obligations.

None of it is a newsletter. Service emails come from the things you do — a collection invitation you sent, a receipt, a password or verification message.

The weekly summary is the only recurring one. It goes to account holders at most once a week, and only when there is something of yours to put in it: drills you have due, your own games once they have been scanned, or new master games in openings your repertoire actually covers. If none of those apply in a given week, no email is sent — there is no version of it padded with general news. It carries no advertising and no upgrade pitch.

There is one other automatic email, and you can only ever get it once. If you make an account, use it on one day and have not signed in again about a week later, we send a single note from the developer asking what you were looking for. Sign in again before then and it is never sent, and it is never sent to an account we have already emailed. There is no follow-up to it and no sequence behind it.

To send either of them we process your account email address, and we record that it was sent so it cannot be sent twice. We do not track whether you open it — there is no tracking pixel in it — and we do not share your address with anyone beyond the delivery provider named above.

One switch covers both. You can turn them off under Profile → Account, or with the one-click link in the footer of any of them, which works without signing in; service emails such as receipts and invitations you sent still arrive. New accounts start with them on; existing accounts were told before the first one went out.

Local data persists in your browser until you clear it. Synced and account data is retained while your account is active, apart from the records with their own clocks described above — coach records (180 days, and the question and reply inside them 30), search text (12 months, and 30 days attached to a signed-in account) and expired or revoked share links, which are deleted outright. If you delete your account or ask us to remove your data, we delete synced collections and account records, except where we must retain limited billing records to meet legal obligations.

Depending on where you live (including under the EU/UK GDPR and the CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can export or delete local data yourself at any time from the app, and delete your account and everything synced with it from your profile. For anything else, email support@flexichess.com and we will respond within one month. Where we rely on legitimate interests you can object (see the reference game database above); where we rely on your consent you can withdraw it at any time, which does not affect anything done before you withdrew it. If you are in the EU or UK, you also have the right to lodge a complaint with your data protection authority, and you can do that without coming to us first.

We operate from Australia and our providers process data in the United States and elsewhere, so if you are in the EU, EEA or UK your data leaves your region. Those transfers rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where the UK GDPR applies), which each of the providers listed above incorporates into its data processing agreement with us. You can ask us for a copy of the relevant terms at support@flexichess.com.

FlexiChess is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their personal data.

We may update this policy as the product evolves. Material changes will be reflected by the “Last updated” date above.

Privacy questions or requests: support@flexichess.com.