ChessveraPrivacy policy
Chessvera ("the app") is made by Isaac Smith (Isaac Smith Labs). This policy explains what the app and its optional online service collect, why, and what you can do about it.
The short version
- Without an account, Chessvera collects nothing about you. Your games, reviews, puzzles, progress and settings stay on your phone.
- No ads, no analytics, no crash reporting, no tracking, and no data sold or shared for advertising.
- An account is optional. It needs only a username and a password, and holds what you do in online features (ratings, friends, online games, Rush scores). An email address and a first name are optional and private: never shown to other players. No phone number.
- You can also sign in with Apple, Google or Lichess, and link several of them to one account.
- You can delete your account in the app at any time, or ask us to do it (see Delete your account).
What stays on your device
Your games against the bots, game reviews, imported games, puzzle progress, streaks, ratings against the bots, training plan and settings are saved only on your phone. Uninstalling the app deletes them. The chess engine (Stockfish) runs entirely on your device; your games are not uploaded for analysis.
Update check
At most every 12 hours, when the app opens, it asks our server which app version is current, so it can tell you when an update is ready. The request contains nothing about you, and our server does not store it. Like every internet request it reveals your IP address to our server and to Cloudflare (see Service providers). Opening the public leaderboards works the same way.
The optional Chessvera account
If you create an account, our server stores:
| Data | Why | Who can see it |
|---|---|---|
| Username | Sign-in, leaderboards, friends | Other players (leaderboards, friends, opponents) |
| Password, stored only as a salted PBKDF2-SHA256 hash, never in plain text | Sign-in | Nobody |
| Session token (only a hash on the server; the token itself is kept in your phone's secure storage) and expires after 180 days unused | Keeping you signed in | Nobody |
| When the account was created and last used | "Member since", active-player counts, session expiry | Your created date, on your own profile |
| Rated games against the bots (level, colour, time control, moves, result, rating change) and your rating | Ratings and the bot ladder | Your rating and win/draw/loss record on leaderboards and to friends. Moves are not shown to others. |
| Puzzle Rush scores played while signed in (single runs are deleted after 21 days; your best score per mode is kept) | Rush leaderboards | Scores: everyone |
| Friends and friend requests | Friends list, friend leaderboards, challenges | Only the two people involved |
| Challenges and games with friends or other players (moves, clocks, result, draw offers) | Running the game fairly | The two players |
| Whether you own Pro ("Supporter") and whether you show the badge | A cosmetic badge only | The badge, if you leave it on |
| Your linked Lichess username, if you link Lichess | Showing it on your profile | Everyone, on your profile |
| Your first name, if you add it (optional) | Greeting you in the app ("Welcome back, Isaac") | Nobody else |
| Your email address, if you add it (optional), saved only after you confirm it with a 6-digit code; or the email Apple or Google shares when you sign up with them (an Apple Hide My Email relay address is marked as such) | Password reset only | Nobody else |
| Linked sign-in methods: which provider (Apple, Google, Lichess), that provider's account id for you, the email it shares or your Lichess username, and when you linked it | Signing in with that provider and keeping one account. Accounts are never merged automatically; linking or unlinking asks you to confirm it's you. | Nobody else (your Lichess username is shown, as above) |
| Email confirmation and password reset codes, stored only as a hash | Proving you own the email | Nobody. They expire after 15 minutes and are deleted when used. |
| Your IP address | Stopping password guessing and abuse (rate limits) | Nobody. Kept only in server memory for about an hour (up to a day after repeated wrong passwords), never written to disk or logs by our server. |
Leaderboards are public inside the app, so pick a username that is not your real name if you want to stay anonymous. There is no chat between players. A forgotten password can be reset only if your account has a confirmed email; without one it cannot be recovered. If you sign in with Apple, Google or Lichess, you get back in by signing in with them.
Emails
Chessvera sends two types of automated email at launch, and only when you ask for them: email confirmation (a code when you add or change your email) and password reset (a code when you forget your password). No newsletters or marketing. They are delivered by our email provider, Resend, which receives your address and the message to send it.
Sign in with Apple or Google
You sign in on Apple's or Google's own sheet; we never see those passwords. From Apple we ask only for your name and email, and you may choose Hide My Email (we then receive a private relay address that forwards to you). Your name goes only to the app, to suggest the optional first name. From Google we ask only for basic sign-in (openid, email, profile). Our server checks the sign-in token, keeps your provider account id and the email shared, and does not keep the token. If you delete an account that uses Sign in with Apple, we revoke Chessvera's access with Apple.
Lichess
- Watching and browsing. The home screen can show a live game from the public Lichess TV feed, and the opening explorer looks up positions in the public Lichess opening database. These requests send the position or nothing about you, beyond what any internet request reveals (such as your IP address), which Lichess may log under its privacy policy.
- Importing games by username. The app asks Lichess for that player's public games. The games are saved on your phone only.
- Sign in with Lichess. If you choose this, you sign in on Lichess's own page and Lichess gives the app a token that lets it play games for you. The token stays in your phone's secure storage. If you sign in to Chessvera with Lichess or link Lichess to your account, the app sends the token to our server once: the server uses it for one request to Lichess to read your Lichess user id and username, then discards it. It is never stored on our server. Games you play this way are Lichess games, covered by Lichess's own terms and privacy policy. Signing out in the app revokes the token; you can also revoke access in your Lichess account security settings.
- Linking Lichess to a Chessvera account. Our server stores your Lichess user id and username (Chessvera ratings stay separate from Lichess ratings). For fair play, the app and our server first check with Lichess that the account is open and in good standing (our server sends Lichess only that username); accounts Lichess has closed or marked for breaking its terms can't be linked and are not stored.
Chess.com username
If you enter a Chess.com username, the app downloads that player's public finished games and ratings from Chess.com's public data service, and saves them on your phone. You do not sign in to Chess.com through Chessvera and we receive no password or token. The username is stored on your phone only; you can unlink it in the app and choose whether to delete its imported games. Chess.com may log these requests under its own privacy policy.
Streak reminders
If you turn on streak reminders (Progress, Notifications), the app schedules a local notification on your phone at the time you choose. They are off until you turn them on, and your phone asks for permission only then. Nothing about them is sent to our server or to any push service.
Purchases
Chessvera Pro is bought through the Apple App Store or Google Play. The store handles the payment; we never see your name, payment card or billing address. The app only learns whether Pro was purchased and remembers that on your device. If you are signed in, the server stores only the Supporter flag described above.
Service providers
- Cloudflare carries traffic between the app and our server and serves this website. It sees IP addresses and request details under its own privacy policy.
- Akamai (Linode) hosts our server and its database.
- Resend delivers the email confirmation and password reset emails.
These providers process data on our behalf. We do not sell personal data or share it for advertising.
This website uses no cookies, analytics or third-party scripts. It remembers your light or dark theme choice in your own browser only.
Keeping and deleting data
- Delete account (in the app: Home, the profile button, your username, then Delete account) immediately deletes your account and everything linked to it: sessions, rated games and ratings, Rush scores, friendships, challenges and online games (including the opponent's copy of a game you played together), your email and first name, your linked sign-in methods and any email codes, and it signs out every device.
- Nightly server backups are kept for up to 7 days, so deleted data is gone from backups within 8 days.
- Signing out removes the session from your phone and the server.
- If you no longer have the app, see Delete your account.
Your rights
Depending on where you live, you may have rights to access, correct, export or delete your data, or to object to its use. Most of this you can do directly in the app. For anything else, email us at [email protected]. You may also complain to your local data protection authority.
Children
Chessvera is suitable for all ages. Without an account it collects no data from anyone. Accounts need no contact details (an email is optional and private), and there is no chat between players. If you believe a child has created an account and you want it removed, contact us.
Changes
If this policy changes, the new version will be posted on this page with a new date. Significant changes will also be mentioned in the app's release notes.
Contact
Isaac Smith (Isaac Smith Labs), the developer of Chessvera: [email protected].