Privacy Policy
Last updated: November 5, 2026
1. Overview
Chess Coach (listed on the App Store as “CheesCoach: AI Chess Coach”) is a chess coaching application for Android and iOS developed by JuanfranDevs. This privacy policy explains how our application handles your data. We are committed to protecting your privacy and being transparent about our data practices.
Key principle: Chess Coach is local-first. Playing, puzzles, courses, game review and Stockfish analysis run on your device and are stored on your device. Some optional features — AI coaching through our backend, online multiplayer, and credit or premium purchases — require an account, and for those we store a small amount of personal data (your email address, your chosen nickname, and usage counters) on our servers. Sections 2 to 4 describe exactly what and why.
2. Data Collection
Chess Coach is offline-first: the core features (playing, puzzles, move review, Stockfish analysis, importing/exporting PGN) work without an internet connection and store everything locally on your device. No personal data is collected for these features, except the bot game statistics described below.
Some optional online features (AI coaching via our backend, online play via Lichess, endgame hints via the Lichess tablebase) transmit limited data to third parties. These features are described in sections 3 and 4 below. All of them are triggered only by an action of yours, and the account-based ones can be disabled at any time.
Data stored locally on your device:
| Data Type |
Purpose |
Storage |
| Chess games (PGN) |
Saving and reviewing your games |
Local database (Room) |
| Move analysis |
Caching AI analysis to avoid repeated API calls |
Local database (Room) |
| API keys |
Authenticating with AI providers you choose |
Encrypted (AES-256-GCM) |
| App preferences |
Theme, ELO level, board colors |
DataStore Preferences |
| Puzzle progress |
Tracking your puzzle rating and streaks |
DataStore Preferences |
Data collected when you sign in or use online features:
Signing in is optional — you can skip it and keep using the app offline. If you do sign in (Google Sign-In on Android, Sign in with Apple on iOS), the following is stored in our backend:
- Your email address — used as your account identifier, to restore your credits and premium status across devices and reinstalls, and to answer you if you send in-app feedback. With Sign in with Apple you may use Apple's private relay address instead.
- User identifiers — the account id created by our backend and the Google/Apple account id linked to it
- The nickname and country flag you choose for online multiplayer, together with your ratings and win/loss record. These are shown to other players in games and in the public ranking.
- A device identifier (Android ID on Android, vendor identifier on iOS) — used only to stop the same device from farming free AI analyses by reinstalling the app
- Purchase history — which credit or premium purchase you made and the Google Play / App Store transaction token, so we can grant, verify and restore what you bought and detect refunds or fraud
- Chess activity linked to your account — the usage log described in section 3, your online games, and a cache of positions with their AI hints so the same position is not re-analysed twice
Analytics and crash reporting:
The app includes Firebase Analytics, Firebase Crashlytics and Firebase Remote Config (Google). They collect usage events (which screens you open, puzzles solved, games played), crash logs and technical diagnostics, tied to a randomly generated Firebase installation identifier — never to your email address or nickname. We use this only to fix crashes and to understand which features are actually used. This data is not sold and not shared with anyone else.
Bot game statistics: when a game against a bot ends, the app sends our backend a short record (which bot, which engine played it, the result, the number of moves, your colour, the platform and when the game ended). It is tied to a random installation ID created by the app — not your advertising ID, Android ID or Apple vendor ID — and never to your account, even if you are signed in. We use it only to measure and tune how hard each bot is; it is not sold or shared. The installation ID is replaced every 13 months and records are deleted after 25 months.
Push notifications: if you allow notifications, the app registers a push notification identifier (a Firebase Cloud Messaging token on Android, an Apple Push Notification service token on iOS) with our backend, together with your time zone, language, app version, platform and which kinds of notification you have switched on. If you are signed in it is linked to your account, so the result of your online game reaches you and not someone else using the same phone. We use it only to send the notifications you chose (results of your online games, your monthly ranking position and, only if you opt in, tournaments and news), never ads or offers. It is unlinked from your account when you sign out, and deleted with your account, when Google or Apple report it is no longer valid, or after 270 days without the app being opened. You can switch each kind off in the app settings. Firebase Cloud Messaging (Google) on Android and Apple’s push service on iOS only deliver the message.
Data we do NOT collect:
- Your real name, phone number, postal address, date of birth or gender
- Location data — the country flag in your online profile is chosen by you, it is never read from your device or your IP address
- Advertising identifiers, ad networks or cross-app trackers — the app has no ads
- Payment details (card or bank data) — purchases are handled entirely by Google Play and the App Store, we never see them
- Contacts, photos, microphone, or any other personal files
3. AI Services, Backend & Purchases
Chess Coach offers optional AI-generated chess commentary. There are two independent ways to use it and you choose which one.
Mode A — Backend proxy (credits & free calls)
By default, every user gets 5 free AI analyses. Additional analyses require credits, which can be purchased inside the app via Google Play or the App Store. In this mode, your requests go through our backend hosted on Supabase (EU region), which forwards the chess data to the AI provider on your behalf.
To use Mode A you must sign in with Google or Apple, because we need a stable identifier to track your free-call and credit balance across reinstalls. We store the following on the backend:
- Your Google or Apple account email (identifier only, never shared with third parties)
- Credit balance, free calls consumed, and purchase history (for fraud prevention and refund support)
- A usage log (timestamp, analysis type, token counts, cost) for billing and abuse detection — does NOT contain the chess position itself
- A device identifier hash used exclusively to prevent free-call farming via reinstalls
The AI providers used by the backend are OpenAI (primary, United States), DeepSeek (first fallback, if OpenAI is unavailable) and Google Gemini (second fallback).
ⓘ
Data residency notice: OpenAI processes requests in the United States. DeepSeek, used only when OpenAI is unavailable, is a Chinese company and processes requests on servers located in the People's Republic of China. The backend only sends chess data (FEN position, move history in PGN, Stockfish evaluation, facts computed from the position, coach ELO) and, if you use the coach chat, the text you type there. Your email is NEVER included in the AI provider request — the backend uses it only internally to look up your credit balance. If you prefer to avoid DeepSeek entirely, use Mode B (your own API key) with any other provider. An administrative switch also lets us take DeepSeek out of the chain at any moment, in which case requests OpenAI cannot serve go straight to Gemini.
Mode B — Bring Your Own Key (BYOK)
If you have your own API key from a supported AI provider, you can configure it in Settings and the app will call the provider directly from your device, completely bypassing our backend. This mode does not require a Google account, does not consume credits, and does not involve any of our servers.
Supported BYOK providers:
ⓘ
A note on DeepSeek and Qwen: both are Chinese companies. In BYOK mode the request travels from your device straight to the provider you chose, under your own account and your own API key, so we never see it — but the data is processed under that provider's terms, not ours. Qwen keys issued through Alibaba Cloud Model Studio use the international endpoint (Singapore). If you would rather not use either, any of the other three providers works exactly the same way.
What data is sent to AI providers:
When you use the AI coaching feature, the following chess-specific data is sent to your chosen AI provider:
- The current chess position (FEN notation)
- The game move history (PGN notation)
- The Stockfish engine evaluation (numeric score)
- Facts the app computes from that position (material, checks, attacked and defended pieces)
- The messages you type in the coach chat, if you use it (please do not write personal information there)
- Your configured ELO level (for adjusting explanation complexity)
No personal information is ever sent to AI providers. Only chess positions and game data are transmitted. Your API key is sent as an authentication header but is never shared with us.
ⓘ
Important: Each AI provider has their own privacy policy governing how they handle data sent to their APIs. We encourage you to review the privacy policy of your chosen provider. Chess Coach has no control over how third-party AI providers process the chess data sent to them.
API key handling (Mode B only):
- Your API keys are stored exclusively on your device
- Keys are encrypted using AES-256-GCM via Android's EncryptedSharedPreferences
- Keys are only used to authenticate API requests — they are never logged, transmitted to us, or shared with any other party
- You can delete your API keys at any time from the app's Settings screen
Credit purchases (Mode A):
- Purchases are processed by Google Play Billing — we never see your payment details
- After purchase, Google Play sends us a purchase token which we verify server-side with the Google Play Developer API and then credit your account
- See Google's Privacy Policy for how Google Play handles payment data
4. Online Play
Chess Coach online multiplayer
Playing against other Chess Coach users is optional and requires signing in and choosing a nickname. Matchmaking and the moves of each game travel in real time to our own game server (a Hetzner VPS operated by us), which relays them to your opponent and stores the finished game, your ratings and your win/loss record in our Supabase backend.
Your nickname, country flag, ratings and results are visible to other players in the lobby, during games and in the public ranking. Your email address is never shown to other players.
Lichess integration
Chess Coach offers optional online play through Lichess.org, a free and open-source chess platform.
Authentication:
- Lichess login uses OAuth 2.0 with PKCE (industry-standard secure authentication)
- Chess Coach never sees or stores your Lichess password
- The OAuth token is stored encrypted on your device and can be revoked at any time
Data exchanged with Lichess:
- Your Lichess username and rating (for display in the app)
- Game moves and clock data during online matches
- Game seek parameters (time control, color preference)
Endgame tablebase (no account needed)
In the Endgame Lab, when you tap Hint, the app may look up the position in the public Lichess tablebase to give you the exact best move. This is separate from online play: it needs no Lichess account and no login.
- What is sent: only the chess position (a FEN string) of the exercise you are solving. As with any web request, Lichess also sees your IP address.
- What is NOT sent: no account, no email, no nickname, no device identifier and nothing that identifies you. The request carries no credentials of any kind.
- When: only when you ask for a hint. Never in the background, never while you simply play.
- If you are offline the lookup is skipped silently and the hint is computed on your device by the chess engine. The feature keeps working without an internet connection.
- We do not store these lookups. The position is kept in memory only, to avoid asking twice for the same one.
For details on how Lichess handles your data, see the Lichess Privacy Policy.
5. Data Storage & Security
- Your chess data is stored locally on your device (Android or iOS)
- Chess games and analysis are stored in a local SQLite database (Room)
- Sensitive data (API keys, OAuth tokens) is encrypted using AES-256-GCM
- Preferences are stored in Android's DataStore
- The Stockfish chess engine runs entirely on your device — no server processing
- Core features (Stockfish, puzzles, games) work fully offline; the only data they send is the bot game statistics described in section 2, queued and uploaded when there is a connection
- The optional AI backend (Mode A) runs on Supabase in the EU region and stores only the data listed in section 3 and the bot game statistics of section 2 (email, credit balance, usage log, device hash)
- All data in transit is encrypted with HTTPS/TLS — our backend, our game server, Firebase and every AI provider
6. Data Sharing
Chess Coach does not sell or rent your personal data. Data is only transmitted in the following cases:
- Chess position data sent to AI providers only when you actively request AI analysis (either via our backend in Mode A or directly from your device in Mode B)
- Your account email and credit/usage data stored in our Supabase backend (Mode A only, requires your explicit Google Sign-In on Android or Sign in with Apple on iOS)
- Your nickname, country flag, ratings and game moves sent to our game server and shown to other players during online multiplayer (optional feature)
- Usage events, crash logs and diagnostics sent to Firebase Analytics and Firebase Crashlytics (Google), never linked to your email or nickname
- Bot game statistics (bot, engine, result, number of moves, colour, platform and when the game ended) sent automatically to our backend with a random installation ID, never linked to your account (section 2)
- The push notification identifier stored in our backend and handed to Firebase Cloud Messaging (Google) on Android or Apple Push Notification service on iOS only to deliver the notifications you switched on (section 2)
- Purchase tokens sent to Google Play Developer API for server-side verification (only when you buy credits)
- Game data exchanged with Lichess during online play (optional feature, requires your Lichess OAuth login), and the chess position of the exercise sent to the Lichess tablebase when you ask for a hint in the Endgame Lab (no account, no identifiers)
The app contains no ads, no advertising identifiers and no cross-app trackers. The only third-party SDK that collects data is Google's Firebase (Analytics, Crashlytics, Remote Config and, on Android, Cloud Messaging), described in section 2. We never sell your data, and we only transfer it to the providers listed above so they can operate the feature you asked for on our behalf.
7. Children's Privacy
Chess Coach is not directed at children under 13 and we do not knowingly collect personal information from them. The offline part of the app collects no personal data, except the bot game statistics described in section 2, which are never linked to an account, and the push notification identifier if notifications are allowed. The optional features that do — signing in, AI coaching, online multiplayer and purchases — require an account and are described above; if you are a parent and believe your child created an account, contact us using section 10 and we will delete it.
Parents or guardians should be aware that the AI coaching feature involves third-party AI providers and, in Mode A, in-app purchases via Google Play Billing. We recommend parental supervision and enabling Google Play parental controls for this feature.
8. Your Rights
You retain full control over your data. Under GDPR (if you are in the EU) you have the rights of access, rectification, erasure, restriction, portability, and objection with respect to any data we store about you. To exercise any of these rights, contact us using the details in section 10.
- Delete local data: Clear app data from Android Settings, or uninstall the app (on iOS, deleting the app removes its local data)
- Delete BYOK API keys: Remove them from the Settings screen within the app
- Sign out: Settings → Account → Sign out. Before signing out, the app saves your progress to your account. Your local data stays on this device; if a different account then signs in on it, your progress stays in your account (it is not merged into the other one) and your games stay on the device, hidden, until you sign in again. The backend account and credit balance remain available if you sign in again.
- Delete your account and the data linked to it: see the section below
- Bot game statistics: they are not linked to your account, so deleting it does not remove them; they are deleted automatically after 25 months
- Push notifications: switch each kind off in the app settings, or turn notifications off for the app in your phone settings. The identifier is unlinked from your account when you sign out and deleted with your account
- Revoke Lichess access: Disconnect from Settings or revoke the token from your Lichess account
- Export your games: Games can be exported as PGN files at any time
- Disable AI features: Skip the sign-in step (Mode A stays disabled) and don't configure a BYOK API key — the app works fully offline
Account and data deletion
This section explains how to delete your Chess Coach account (app published by JuanfranDevs) and the data linked to it. There are two ways, and both erase exactly the same data.
From inside the app (immediate): open Settings → Account → Delete my account, read the confirmation screen and confirm. The deletion happens right away and you are signed out. This is the fastest route and needs no email.
By email (up to 30 days): use this if you no longer have the app installed, or if the in-app deletion fails.
- Send an email to juanfrandevs@gmail.com from the address you signed in with, with the subject "Delete my account". No other proof is needed — sending the request from your own address is what identifies you.
- We delete your account within 30 days and reply to that same address to confirm it is done.
- What is deleted: your user record (email, account ids, nickname, country, ratings and results), your synced games and progress (courses, puzzles, labs, openings and opponents), your usage log and the record of your failed AI requests, your cached AI hints, your device-grant records and your push notification identifiers. What is stored on your device, including your games and progress, stays there: to remove it, clear the app data or uninstall the app (on Android, a Google backup can restore it if you reinstall)
- One detail about online games: a finished multiplayer game is a single record that belongs to both players, so we cannot destroy your opponent's copy of it. Your side of that record is detached instead — your account id is removed and your nickname is replaced with a placeholder — so the game survives for your opponent but is no longer linked to you. Your opponent also keeps their own copy of the game in their app and synced history, which still shows the nickname you had.
- What is kept, and for how long: the accounting record of your purchases (amount, date and transaction id), which Spanish commercial and tax law obliges us to keep for up to 6 years from the transaction. It is anonymised at deletion time — the email address and account id are stripped, so the record can no longer be traced back to you. Reports you filed against other players are also kept, without your account id, so the moderation history stays complete.
- Analytics and crash data are not affected: they were never linked to your email or nickname, and Firebase deletes them automatically according to its own retention window
- Note: deleting your account also deletes any unused credits and does not entitle you to a refund; refunds are handled by Google Play or the App Store
9. Changes to This Policy
We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically. Continued use of the app after any changes constitutes acceptance of the updated policy.
If you have any questions or concerns about this privacy policy, please contact us: