Privacy Policy

Last updated: 26 August 2026

Welcome to CheckChess! This Privacy Policy explains what data we collect, how we use it, and what rights you have over it, when you use the CheckChess application (the "App") and related services. If you have any questions, you can reach us at contact@chessnewlife.com.

1. Who We Are

The data controller is:

Legal name: ANSIROMAT S.R.L.
Tax ID (CUI): RO54628331
Trade Register no.: J2026029828003
Registered office: Sat Jilava, Comuna Jilava, Șos. Giurgiului, Nr. 29, Ilfov County, Romania, European Union
Contact email: contact@chessnewlife.com

We collect and process your personal data in accordance with the EU General Data Protection Regulation (GDPR) 2016/679 and applicable Romanian law.

2. What Data We Collect

2.1 Data you provide to us

Email address — when you register or sign in
Password — stored in hashed form by our authentication provider; we never see it in plain text
Analyses you run — the Chess.com or Lichess usernames you submit and the PGNs you analyse
AI chat messages — messages you send to the AI assistant and the replies generated for you

If you use the App as a guest, the first two items do not apply: a guest session is an anonymous account identified only by a random identifier issued by our authentication provider, with no email address and no password.

2.2 Data collected automatically

Analysis results and history — suspicion scores, verdicts and per-game metrics, synced to your account
Usage counters — how many analyses and chat messages you have used in the current period, to enforce plan limits. The period is the calendar month for guest and free users, the current billing week on the Weekly plan, and the current subscription year on the Yearly plan.
Push notification token — an identifier issued by Firebase Cloud Messaging for each installation that enables notifications, stored together with the device platform so that watchlist alerts can reach that device
Watchlist entries — the accounts you asked us to monitor, and the bookkeeping needed to detect new games (see section 2.3)
Subscription status — whether Premium is active, its source (App Store / Google Play) and expiry date, reported by RevenueCat
Technical data — app version, device platform (iOS / Android) and, if crash reporting is enabled in your build, basic crash diagnostics
IP address — temporarily processed by our backend provider for security and abuse prevention

2.3 Data about other chess players

On-demand scans. When you run an account scan, we process the public username and public game archive of the account you submit, retrieved from the Chess.com or Lichess public APIs. We process this publicly available data on the basis of legitimate interest, solely to compute statistical metrics.

Continuous monitoring (watchlist). When you add an account to your watchlist, the processing is no longer a single event. Our servers query the Chess.com or Lichess public API for that account approximately every 15 minutes, indefinitely, including while the App is closed. We store the username, the platform, the end time of the most recent game seen, and counts of recent and high-accuracy games. This continues until you remove the entry, until your account is deleted, or until we act on an objection from the monitored player.

We rely on legitimate interest for this processing as well, balanced against the interests of the monitored player: only data that is already public is read, we make no attempt to identify the person behind the account, the output is a probabilistic signal rather than a finding of fact, and any monitored player may object and have the monitoring stopped and the stored entries deleted — see Your Data Protection Rights.

The results are probabilistic signals, not factual accusations, and our Terms prohibit using them to publicly accuse anyone.

2.4 Data we do NOT collect

We do not collect your real name, biometric data or GPS location
We do not access your contacts, photos, camera or microphone
We do not use any advertising or cross-app tracking identifier
We never store your card number — payments are processed entirely by Apple or Google

OTB (over-the-board) PGN analysis runs entirely on your device using the Stockfish engine; the PGN itself is not uploaded for engine evaluation. The resulting report (and the PGN, if you start an AI chat about that game) is stored in your account history.

3. Why We Collect This Data (Legal Bases)

We process your data on the following GDPR legal bases:

Performance of a contract (Art. 6(1)(b)) — to provide the analyses, sync and chat features you request
Legitimate interest (Art. 6(1)(f)) — for security, fraud and abuse prevention, app improvement, and the processing of public game data described in section 2.3
Consent (Art. 6(1)(a)) — for optional marketing communications, if we ever send any
Legal obligation (Art. 6(1)(c)) — to retain accounting and fiscal records as required by Romanian law

We do not use your data for advertising, we do not profile you, and we never sell your data.

4. Who We Share Your Data With

We share data only with the technical providers necessary for the App to function:

Supabase, Inc. — database, authentication and backend functions. Location: USA (infrastructure region configurable) — transfers covered by Standard Contractual Clauses.
RevenueCat, Inc. — subscription management on iOS and Android. Location: USA — transfers covered by SCCs.
Anthropic, PBC — processes your AI chat messages (together with the analysis context you are chatting about) at the moment you send them, to generate the reply. Under our commercial terms, your data is not used to train their models. Location: USA — transfers covered by SCCs.
Google LLC (Firebase Cloud Messaging) — delivers push notifications to your device. Receives your installation's notification token and the content of the alerts we send, which includes the username of the watched account. Location: USA — transfers covered by SCCs.
Functional Software, Inc. (Sentry) — crash and error reports, in builds where crash reporting is enabled. Location: USA — transfers covered by SCCs.
Apple App Store / Google Play — process subscription payments. We only receive a purchase confirmation, never your payment details.
Chess.com, LLC / lichess.org — we send the username you submit to their public APIs to retrieve public game data. For watchlist entries these requests are made by our servers on a recurring schedule, not only when you press a button.

5. How Long We Retain Your Data

Account data, analyses, chat history: for the lifetime of the account; deleted permanently within 30 days of account deletion
Accounting and fiscal records: 10 years, as required by Romanian fiscal law (these do not include your analysis content)
Watchlist entries and push notification tokens: for as long as the entry or the installation exists; both are deleted automatically when the account is deleted
Technical logs and IP addresses: maximum 90 days
Crash reports (Sentry): maximum 90 days

When you delete your account (Settings → Delete account), your personally identifiable data is removed. Anonymised, aggregated statistics may remain and cannot be linked back to you.

6. Your Rights (GDPR)

Under the GDPR, you have the following rights:

Right of access — request a copy of the data we hold about you
Right to rectification — correct inaccurate data
Right to erasure ('right to be forgotten') — delete your account and associated data, directly from Settings → Delete account
Right to data portability — receive your data in a structured format (JSON)
Right to restriction of processing
Right to object — including to processing based on legitimate interest
Right to withdraw consent

To exercise your rights: contact@chessnewlife.com. We respond within 30 days. See also the Your Data Protection Rights document.

7. Security

We apply appropriate technical and organisational measures to protect your data: encryption in transit (HTTPS/TLS), passwords stored as hashes, row-level security on the database, least-privilege access to backend systems, and API keys kept server-side only.

8. Children

CheckChess is not directed at children under 13. If you believe a child under 13 has created an account, contact us and we will delete it.

9. Changes to This Policy

We may update this Privacy Policy. The date of the last update is shown at the top. Significant changes will be communicated via a notice in the app or by email.

10. Contact

Email: contact@chessnewlife.com

You may also lodge a complaint with the Romanian supervisory authority (ANSPDCP, www.dataprotection.ro) or the authority in your country of residence.