Privacy notice

Controller

Servet Akdemir is the controller of ChessOpening account and learning data. This notice covers chessopening.app, its staging subdomain and the web trainer. Polar separately processes payment and billing data under its own notice.

Data we collect

Guest settings, level, language, goals, opening choices, lesson results, review history and resume positions are stored in your browser. When you sign in, learning progress can be synchronized with your account.

When you sign in with Google or Apple, we may receive the provider account identifier, name, email address and profile image. Apple may supply a relay email address. Session and provider authorization records are stored on the server. If password sign-in is enabled, only a password hash is stored.

We receive customer/subscription identifiers, trial and membership status, plan, currency and period dates from Polar to provide access. Our application does not store full card numbers or security codes; these are handled in Polar’s checkout.

Hosting and security systems may process IP address, browser/device details, requested path, time and response status. Support messages include the information and contact details you choose to send.

Purposes and legal bases

We process data necessary to provide accounts, sign-in, progress synchronization and purchased access to perform or enter into our service agreement. Security, abuse prevention and support rely on legitimate interests balanced against your rights; mandatory records and requests rely on legal obligations.

Optional usage analytics is enabled only with consent. Withdrawing consent does not affect the lawfulness of prior processing. This notice itself is not a request for blanket consent.

Use of Google and Apple data

Google access uses only the openid, email and profile scopes for account sign-in. We do not request Gmail, Drive, contacts or calendar access. We do not sell this data, use it for advertising targeting, or use it to train AI models. Our use and transfer of Google data follows the applicable Google API Services User Data Policy, including Limited Use requirements. Apple data is also used for account sign-in and delivery of the service.

Analytics and browser storage

With permission, Google Analytics 4 on the production site may measure limited events such as page views, lesson starts/completions and subscription steps. Our event payloads do not include names, email addresses, passwords, card details or sign-in tokens. Google Signals and advertising personalization are disabled. DNT/GPC preferences are respected; GA4 is disabled on staging. Cloudflare security services may separately process technical data. See Cookie and local storage notice.

Recipients and international processing

We use Hetzner hosting in Germany, Cloudflare for DNS/delivery/security, Google or Apple for the sign-in method you choose, and Polar and its payment providers for subscriptions/billing. Google Analytics is used only with permission. Support email is forwarded through Cloudflare Email Routing to Google Gmail and processed by those providers. See Polar Privacy Policy.

These services may process data in Türkiye, the European Economic Area, the United States and other countries. Transfers must rely on safeguards or valid exceptions required by applicable law. Contact us for information about relevant transfer arrangements. Limited disclosure to service providers or competent authorities may also be necessary for legal obligations.

Retention and security

Account and learning data is kept while needed for your account or until a deletion request is fulfilled. Records required for legal obligations, disputes or abuse prevention may need longer retention. Sessions can last up to 30 days. Guest data may remain on your device until you clear browser data.

Deleted records may remain in isolated backups until those backups are replaced. Data should not be retained longer than necessary; we explain applicable exceptions when responding to requests. We use measures including HTTPS, restricted access and private server files; no system can guarantee absolute security.

Your rights and requests

Depending on applicable law, you may request access, information and a copy, correction, deletion, restriction, objection, portability and withdrawal of consent. Rights under Türkiye’s KVKK include learning whether and why data is processed, recipients, notification of corrections/deletions to recipients, objection to an adverse outcome based solely on automated analysis, and compensation for unlawful processing. Send requests to support@chessopening.app. Proportionate identity verification may be necessary; we respond within applicable legal deadlines.

You can request account deletion using the same contact address. Account deletion and subscription cancellation are separate steps; also cancel through Polar’s portal to avoid unwanted renewals. You can revoke ChessOpening’s connection in your sign-in provider’s account settings. You may complain to Türkiye’s data protection authority or the competent authority where you live.

Children and changes

The service is intended for users able to consent to data processing under the law where they live; minors need parental permission and supervision where required. Contact us if you believe a child’s data was collected without required permission. We update the date of this notice for changes and provide additional notice or request fresh consent when required.