Privacy Policy

Who we are

Dam Chess is an AI chess coach. You give us your Chess.com or Lichess username, we pull in the games you played there, a chess engine works out what happened, and an AI writes it up in plain English.

The service is run by [PLACEHOLDER: COMPANY_LEGAL_NAME], a company registered in the Netherlands. In privacy law we are the controllerof your data. That is the formal word for “the ones who decide what gets collected and why, and who are responsible when it goes wrong”.

What we collect

Here is the whole list, grouped by where it comes from. Nothing is hidden in a footnote — if we hold it, it is in this table.

Two things we deliberately do not collect.We never hold a password or a login token for Chess.com or Lichess — connecting an account stores nothing but the username you typed, and all game fetching uses the same public pages anyone can open. And we never read or store your browser's user-agent string.

Cookies and browser storage have their own page: see the Cookie Policy for the complete list.

Why we are allowed to use it

The GDPR says we need a reason — a “legal basis” — for every single thing we do with your data. We have four, and they cover different things. Which one applies matters, because your rights change with it.

Contract — article 6(1)(b)

You asked us to coach your chess. We cannot do that without doing these things, so we do them on the basis of our agreement with you:

• creating and running your account
• fetching your games from Chess.com or Lichess
• analysing them with the engine and writing them up with the AI
• the coach chat and the practice drills
• delivering a paid subscription, once we have one

Consent — article 6(1)(a)

These only happen if you say yes first:

• PostHog product analytics
• the Meta advertising pixel
• recap digest emails — you pick the schedule, or you get none

Coaching tips and product news are notin that list, and we want to be straight about why rather than quietly leaving them out. They run on a separate rule in European e-privacy law for a company's own similar services, which does not need a tick-box but does require that saying no stays free and easy. The full explanation is under Emails we send you.

You can take that yes back at any time, and it has to be as easy to take back as it was to give. Withdrawing does not undo what we did while we had your permission.

Concretely: the two cookie ones come back through Cookie settings at the bottom of any page, and the two email ones through Email settings in your account, or the unsubscribe link in the footer of the email itself. Both are described under Emails we send you.

Legitimate interests — article 6(1)(f)

A few things we do because we have a genuine need and it does not override your privacy. We have thought about that balance for each one:

• keeping the service secure and limiting how fast it can be hit
• stopping people from farming the free trial over and over — this is the IP address described above
• audit logs of staff logging into the admin panel
• keeping the campaign labels from the link you first arrived on, so we know which adverts are worth paying for. It is the first one only, it is never replaced, and it goes after 12 months
• keeping one list of the email addresses that reach us — including the address you type to get a sign-in link. Holding it is one thing; sending you marketing is another, and that still needs your yes
• storing your opponents' usernames, ratings and games, and building the anonymous rating-bracket averages — both are described under People who have not used Dam Chess

You can object to any of these. See Your rights.

Legal obligation — article 6(1)(c)

Dutch tax law makes us keep billing records for seven years. We do not get a choice about that one, and neither do you.

Your games are sent to an AI

This is the part people do not expect, so it gets its own heading instead of a line in a table.

To write your coaching, we send your chess data to Google's Gemini service. There is no way around it — the coaching is written by that model. What goes to Google is:

• your chess username and your rating
• which site you play on, and which colour you played
• the move-by-move engine analysis of your game
• your opponent's username
• everything you type into the coach chat

Your email address is never sent to Google. Nor is anything else that identifies you off the chessboard.

We pay for Google's paid API tier, and that choice matters. On the paid tier, Google does not use what we send, or what it sends back, to train or improve its models. It keeps it only briefly, to catch abuse. You can read the terms yourself: ai.google.dev/gemini-api/terms.

One more thing worth knowing: because the coaching is written by a machine, it can be wrong. Our Terms spell out what that means.

Emails we send you

There are only three kinds, and you control two of them. We have listed all three because “we may send you service communications” is the sentence policies use when they would rather not be specific.

Why we are allowed to send the last three

Not because you ticked a box — we do not ask you to. European e-privacy law lets a company email its own similar products and services to someone who gave their address while using that service, as long as saying no is free and easy. You gave us your address to sign in to Dam Chess; what we send you is Dam Chess. That is the whole basis.

The condition attached to it is one we have to keep, and it is the reason for two things you will notice: there is a line under every box where we ask for your email telling you what we will send, and there is an unsubscribe link in the footer of every one of those emails. If we ever stopped doing either, we would lose the right to send them.

Two limits worth stating plainly. We only use this for our own product.We do not email you about anyone else's, and we do not sell, rent or share your address with another company so they can email you — see Who else sees your data. And it does not cover the recap emails: those only ever go out because you picked a schedule for them.

How to stop them

Three routes, all of which do the same thing:

• Email settings in your account. Open your dashboard and click Email settings. Every switch is there, including one that turns off everything at once
• The unsubscribe linkat the bottom of every recap and product-news email. It asks you to confirm first, so a mail app that silently opens links on your behalf cannot unsubscribe you by accident. If your email app shows its own “Unsubscribe” button, that works in one click
• Ask us. Email [PLACEHOLDER: PRIVACY_EMAIL] and we will do it for you

Stopping marketing and stopping recaps are separate switches, and both are separate from your cookie and advertising choices — turning the advertising cookie off does not stop email, and unsubscribing from email does not change your cookie settings.

Two things stop the emails without you asking. If a message bounces back as undeliverable, or if you mark one as spam, we stop sending to that address and record why. You can turn it back on in Email settings.

Who else sees your data

These companies do a job for us. They are not allowed to use your data for their own purposes. We do not sell your data, and we do not hand it to data brokers or ad networks beyond the Meta pixel described below — which only runs if you accept it.

Your browser talks to Chess.com and Lichess directly. On your dashboard, the box that shows your current rating is filled in by your own browser asking Chess.com or Lichess for it — the request does not go through us. That means those sites see your IP address and the username being looked up, exactly as if you had opened their site in a tab. What they do with that is covered by their privacy policies, not ours.

People who have not used Dam Chess

This section is for people who never signed up for anything here. Two kinds of people end up in our database without asking: the opponents our users played, and the public accounts we sample to build rating averages. If that is you, this is your notice — the GDPR calls it an article 14 notice, because we got your data from somewhere other than you.

If you played against a Dam Chess user

When someone asks us to analyse a game, we store that game. You are half of it, so we store your side too.

What we hold about you: your public username, your rating in that game, and the full text of the game itself — every move, the result, the time control and when it was played. We do not build a profile of you, we do not look you up anywhere else, and we do not contact you.

Where we got it: the public game record on Chess.com or Lichess, fetched because your opponent asked us to look at that game.

Your username goes to Google.To write the coaching, we send the game to Google's Gemini AI, and your username goes with the moves. See Your games are sent to an AI for exactly what is in that package.

Our legal basis: legitimate interests, article 6(1)(f). We cannot coach a game while pretending one player is not there, and the record is already public. Against that: it is one public game you already played in public.

How long: the same as our user's own games — see How long we keep things. It also goes when that user deletes their account.

If you would rather we did not: email [PLACEHOLDER: PRIVACY_EMAIL] with your username and platform. You can ask us to delete the games you appear in, or object to us holding them at all — see Your rights, which are yours just as much as our users'.

Players we sample for comparison

Once a month we pick random public accounts on Chess.com and Lichess across a spread of rating levels, and run their recent public rapid and blitz games through our chess engine. The point is to work out what a typical 1500-rated player does — how often they blunder, how they handle an endgame — so that a Dam Chess user can see how they compare with players at their own level.

What we hold about a sampled player: the public username, which platform it is on, the rating, and the full text of the public games. Nothing else. We do not look you up anywhere, and we do not contact you.

Where we got it:Lichess's public database exports, and the public Chess.com and Lichess interfaces that anyone can read.

Our legal basis: legitimate interests, article 6(1)(f) — building a comparison benchmark out of already-public game records. We weighed that against your privacy, which is why the points below exist.

What we ever publish:bracket-level averages only, and only when a bracket holds at least 30 players. No individual's numbers, username or games are ever shown to a user.

How long we keep it, honestly: as soon as the averages are worked out, we throw away the bulky part — the engine analysis of every position. That happens on every run. The usernames and the games themselves are still in our database: the automatic purge that clears them is something we are building, and we are not going to print a deadline we cannot yet keep. The averages themselves are anonymous and cannot be traced back to anyone.

If you would rather we did not: email [PLACEHOLDER: PRIVACY_EMAIL] with your username and which platform it is on, and we will delete what we hold for it — by hand today, within 30 days. You can also object to the whole thing — see Your rights, which apply to you just as much as to our own users. Until the purge exists, this is the route that actually gets your data out. Please use it.

Sending data outside the EU

Our servers and our database sit in [PLACEHOLDER: HOSTING_REGION]. Some of the companies listed above are American, though, so some data does leave the EU. Here is how that is covered.

Vercel, Google, Stripe, Meta and Resend are all certified under the EU–US Data Privacy Framework. That is an arrangement the European Commission has formally decided gives your data protection comparable to EU law.

Railway is a different case, and we would rather say so than blur it. Railway is not certified under that framework. Instead, our contract with them uses the European Commission's Standard Contractual Clauses (Modules Two and Three) — the standard legal wording for sending data abroad safely. Railway runs on Google Cloud infrastructure.

If you want to see the safeguards for yourself, ask us at [PLACEHOLDER: PRIVACY_EMAIL] and we will send you a copy.

How long we keep things

No vague promises about “as long as necessary”. These are the limits we hold ourselves to, written down so you can hold us to them too.

One thing we owe you straight. The automatic clean-up that enforces these periods is still being built. Until it is finished, most of this data sits in our database until a person removes it — so treat the table above as the limits we have committed to, not as a machine that is already running. In the meantime, ask us and we will delete your data within 30 days: Deleting your account tells you how.

If you are under 16

Chess is full of young players, so let us be clear about where we stand.

In the Netherlands the age at which you can agree to things like tracking on your own is 16 — the highest the GDPR allows, set by article 5 of the Uitvoeringswet AVG. Under 16, your parent or guardian has to give that permission for you.

In practice this mostly bites on tracking and marketing — the analytics, the advertising pixel and the marketing emails — because those are the parts that run on permission. The coaching itself runs on our agreement with you, not on permission.

We do not check anyone's age. We have no way of knowing how old you are, and we are not going to pretend otherwise.

If you are a parent or guardian and you want to see what we hold about your child, or want it deleted, email [PLACEHOLDER: PRIVACY_EMAIL] and we will sort it out.

Your rights

The GDPR gives you these. They are free to use, and using them will never get your account treated differently.

• Access — ask for a copy of everything we hold about you.
• Rectification — get something that is wrong fixed.
• Erasure — ask us to delete it. Sometimes called the right to be forgotten.
• Portability — get your data in a file you can take to someone else.
• Restriction — tell us to stop using your data while a disagreement is sorted out.
• Objection — object to anything we do on the basis of legitimate interests.
• Withdrawing consent — take back a yes at any time, as easily as you gave it.

Two of them you can use yourself, right now. To withdraw consent to email, open Email settings in your account, or use the unsubscribe link in any email we sent you — see Emails we send you. To withdraw consent to analytics or advertising cookies, use Cookie settings at the bottom of any page. Neither needs to go through us.

For the rest, email [PLACEHOLDER: PRIVACY_EMAIL]. We answer within one month. We may ask you to confirm who you are first, so that we do not hand your games to a stranger who knows your username.

If you are not happy with how we handled it, you can complain to the Dutch data protection authority. You do not have to come to us first, though we would rather have the chance to fix it.

Deleting your account

Straight answer: there is no delete button in the app yet. We are not going to describe one that does not exist.

To delete your account, email [PLACEHOLDER: PRIVACY_EMAIL] from the address you signed up with, or tell us the chess username you connected. We will do it within 30 days and confirm when it is done.

What gets erased: your account details, your games and their analyses, your coaching text, your chat threads, your style reviews, insights and improvement plans, your practice progress, and any feedback you left. Server logs are not organised by account, so we cannot pick your lines out of them; they roll over as the file fills up.

Backups take a little longer. Our database is backed up, and a copy of your data lives on in those backups after we have erased it from the live system. We do not restore them to get your data back, and they are overwritten within [PLACEHOLDER: BACKUP_RETENTION_DAYS] days.

What survives, and why:

• Billing records — Dutch tax law makes us keep them for seven years. This only applies once subscriptions launch; today there is nothing to keep.
• Anonymous totals — averages and counts that no longer point at you in any way. There is nothing left in them to delete.

Keeping your data safe

Everything between your browser and us travels encrypted. Access to the database is limited to the people who need it to do their job. Sign-in links expire after 15 minutes, and the code inside them is stored scrambled rather than in plain text.

No system is perfect and we are not going to claim ours is. If there is ever a breach that puts you at risk, we will tell you and the Autoriteit Persoonsgegevens, as the law requires.

Changes to this policy

If we change this policy, we update the date at the top of the page. If the change is a real one — a new kind of data, a new company getting your data, a new reason for using it — we will tell you in the app or by email before it takes effect, so you have a chance to react.

How to contact us

Privacy questions, data requests and deletion requests: [PLACEHOLDER: PRIVACY_EMAIL]

Anything else: [PLACEHOLDER: CONTACT_EMAIL]

We answer privacy requests within one month, and usually a lot sooner.