Privacy Policy

Last updated: 2026-06-24 · Applies to gambitcoach.com

This Privacy Policy explains how GambitCoach ("we", "us") processes your personal data when you use the service at gambitcoach.com. We comply with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the California Consumer Privacy Act (CCPA/CPRA) where applicable.

1. Data controller

The data controller within the meaning of GDPR Art. 4(7) is:

[REPLACE BEFORE LAUNCH - full legal name]
[REPLACE BEFORE LAUNCH - postal address, street + house number]
[REPLACE BEFORE LAUNCH - postal code + city, Germany]
Email: privacy@gambitcoach.com

We do not have a designated Data Protection Officer (DPO) because we do not meet the thresholds in GDPR Art. 37 / BDSG § 38. You may contact us directly at the email above for any data-protection question.

2. Hosting location

The service is hosted on Microsoft Azure in the Germany West Central region (Frankfurt am Main, Germany). All personal data is stored on servers located within the European Union. We do not transfer personal data outside the EEA.

3. Data we collect and lawful basis (GDPR Art. 6)

Data	Purpose	Lawful basis
Email address (when you sign in)	Identify your account, secure sign-in, send magic-link / one-time codes	Art. 6(1)(b) - contract
Account identifier (a key derived from your verified email or sign-in provider) and an admin flag	Link your data to one account across sign-in providers; gate administrative features	Art. 6(1)(b) - contract
Chess.com username	Identify your data + fetch your public games	Art. 6(1)(b) - contract
Your public chess.com games (PGN + metadata)	Run Stockfish analysis, persist results	Art. 6(1)(b) - contract
Games you import (pasted PGN) and games you play against our bots	Store and analyse the games you add yourself	Art. 6(1)(b) - contract
Deep-analysis results (Stockfish evaluations of your games)	Show your move-quality feedback without re-running the engine each visit	Art. 6(1)(b) - contract
IP address (in-memory, transient)	Per-IP rate limiting; abuse prevention	Art. 6(1)(f) - legitimate interest
Server-side request logs (URL, status, timing)	Operational diagnostics; security	Art. 6(1)(f) - legitimate interest
Telemetry via Azure Application Insights (only enabled in production; not on dev)	Detect errors and performance regressions	Art. 6(1)(f) - legitimate interest

4. Cookies and similar technologies

We use only strictly necessary cookies. No tracking cookies, no advertising cookies, no third-party analytics cookies. The following cookies are set:

cm_user - your chess.com username; required to look up your cached games. HttpOnly, SameSite=Lax, Secure in production. Lifetime: 1 year.
gc_session - your signed-in session after you log in. It is a short, server-signed token (HMAC); it carries no password and no server-side session is stored. HttpOnly, SameSite=Lax, Secure in production. Lifetime: up to 7 days; it is automatically renewed while you keep using the app, and is cleared when you log out.
csrf_token - a random anti-forgery token that protects form submissions (double-submit pattern). HttpOnly, Secure in production. Lifetime: 1 year.
gc_auth_state - a short-lived value that protects the sign-in redirect against cross-site request forgery. Set only during a login round-trip. Lifetime: ~10 minutes.
gc_otp - a signed challenge used to verify an email magic-link or one-time code. Set only during email sign-in and scoped to the email authentication routes. Short-lived.

Because all cookies we set are strictly necessary for the service you request (ePrivacy Directive Art. 5(3), TTDSG § 25(2) Nr. 2), no separate consent banner is shown. You can clear them at any time via your browser settings; doing so will sign you out.

5. Retention

Account data - your email address, derived account identifier, and admin flag are kept for as long as your account exists. They are deleted when you delete your account or request erasure (see §7).
Analysis cache - your game data and Stockfish results are stored on our server indefinitely until you request deletion (see §7). We will introduce automatic deletion after 24 months of account inactivity before the General Availability launch.
Rate-limit buckets - held in process memory only; discarded on every restart (typically within hours).
Server logs - retained for 30 days for operational purposes, then automatically deleted.
Application Insights telemetry - Azure default 90-day retention for traces and metrics.

6. Recipients and third parties

Microsoft Azure (Microsoft Ireland Operations Ltd.) - hosting and managed services (compute, the PostgreSQL database that holds your account and games, encrypted Blob storage that holds your deep-analysis results, and Application Insights) in the EU. Acts as our processor under GDPR Art. 28; a Data Processing Addendum is in place via Microsoft's Products and Services DPA.
Sign-in providers (Google and Microsoft) - when you choose to sign in with Google or with a Microsoft account (via Microsoft Entra External ID), that provider authenticates you and returns your verified email to us. Your sign-in is subject to that provider's own privacy policy (Google, Microsoft). You can instead sign in by email magic-link / one-time code without using either provider.
Azure Communication Services - used to send sign-in emails (magic links and one-time codes) to the address you provide. Operated by Microsoft as our processor in the EU under the same DPA.
Chess.com, Inc. - we read your public games from the chess.com Published-Data API on your behalf. Your interaction with that API is subject to chess.com's own Privacy Policy.
Lichess.org - for the puzzle and opening-explorer features, content is loaded from database.lichess.org / explorer.lichess.ovh. See the Lichess privacy policy.
Stockfish (in-browser, optional) - when you enable in-browser engine mode, Stockfish runs as WebAssembly inside your browser. No move data leaves your browser in that mode.

All other engine analysis runs on our servers in Germany; the inputs (positions, moves) are not shared with any third party.

We do not sell or rent your personal data. We do not run third-party advertising. We do not use third-party analytics or social media trackers.

7. Your rights

Under GDPR you have the right to:

Access (Art. 15) - request a copy of the personal data we hold about you.
Rectification (Art. 16) - correct inaccurate data.
Erasure / "right to be forgotten" (Art. 17) - delete your account and all associated data yourself, at any time, from Settings → Your account → Delete my account. This immediately and permanently removes your account, connected chess.com workspaces, imported games, engine analyses, and learning progress.
Restriction of processing (Art. 18).
Data portability (Art. 20) - receive your data in a machine-readable format.
Object (Art. 21) - object to processing based on legitimate interest.
Withdraw consent (Art. 7(3)) - where processing is based on consent (currently: none).

To exercise any of these rights, email privacy@gambitcoach.com. We will respond within 30 days as required by GDPR Art. 12(3).

California residents have equivalent rights under CCPA/CPRA, including the right to know, the right to delete, and the right to opt out of sale (we do not sell personal information).

8. Right to lodge a complaint

If you believe our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority (GDPR Art. 77). The competent authority in Germany depends on the state in which the controller is based; for federal-level matters this is:

Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)
Graurheindorfer Straße 153, 53117 Bonn, Germany
www.bfdi.bund.de

9. Children

GambitCoach is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact privacy@gambitcoach.com and we will delete it.

10. Security

We use HTTPS / TLS for all data in transit. Server-side data is stored on Azure-managed encrypted storage. We follow the principle of data minimisation: we collect only what is required to operate the service.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated in-app before they take effect.

GambitCoach is an independent project, not affiliated with, endorsed by, or sponsored by Chess.com, Inc. or the Lichess organisation.