ChessMentor Privacy Policy
ChessMentor (“the app”) is developed by Vaara Mobile, Oulu, Finland (“we”, “us”). We are the data controller for the personal data described in this policy. Contact: vaaramobile@gmail.com.
ChessMentor is built local-first: your games, training progress, and coach data live on your device. Nothing in the app is sent anywhere without either your explicit action or your explicit consent. This policy explains the few cases where data does leave your device, and your rights over it.
- Your chess data stays on your phone. Games, puzzles, progress, coach memory — stored locally. We run no game server and cannot see them.
- An account is optional. Guest mode is fully local. If you create an account, we process your email address for sign-in and verification.
- The online coach is opt-in. Only with your one-time consent does your question and a short chess summary go to Anthropic to generate a reply.
- Telemetry is opt-in. Anonymous usage counts and crash reports are sent only if you say yes, and you can turn them off any time.
- No ads. No advertising ID. No sale of data. No tracking across apps.
What we process, and why
1. Account data (optional)
If you create an account, your email address and password are processed by Google Firebase Authentication to provide sign-in and email verification. We never see or store your password. Guest mode requires no account and keeps everything local.
- Purpose / legal basis: providing the account you request (GDPR Art. 6(1)(b), contract).
- Retention: until you delete your account. You can delete it directly in the app (Profile → Delete account, effective immediately) or by emailing vaaramobile@gmail.com from the account’s address (removed within 30 days). Uninstalling the app removes all local data from your device.
2. Game and training data (local)
Your games, moves, analysis, puzzles, ratings, streaks, onboarding answers, and the coach’s memory of your play are stored only on your device. They are not transmitted to us. Backup files you export are created at your request and remain in your control; treat them as containing your training history.
3. Online AI coach (optional, consent-gated)
The built-in coach works fully offline. If you choose to use the online coach, then — after a one-time consent prompt — the following is sent to Anthropic PBC (the AI provider) over an encrypted connection to generate the coaching reply: your typed question, a compact chess profile summary (rating, strengths and weaknesses, recent results, training goals), the positions or moves under discussion, and recent conversation turns for continuity. This is chess data, not identity data; your email address and account details are not included.
If you supply your own Anthropic API key, it is stored in your device’s secure storage (Android Keystore) and used only to call Anthropic directly from your device. It is never sent to us.
- Purpose / legal basis: your consent (GDPR Art. 6(1)(a)). You can decline and keep the offline coach; you can withdraw consent in Settings.
- Anthropic’s processing is described in the Anthropic Privacy Policy.
4. Lichess connection (optional)
If you connect a Lichess account (OAuth — you approve on lichess.org, we never see your Lichess password), the app receives your Lichess username, ratings, and the games you play or import, and can perform the actions you authorise (playing board moves, joining tournaments, challenges, messages the app sends on your behalf). The access token is stored in your device’s secure storage and can be revoked in the app or from your Lichess account settings at any time.
- Purpose / legal basis: providing the connection you request (Art. 6(1)(b)).
- Lichess’s processing is described in the Lichess Privacy Policy.
5. Beta telemetry (optional, opt-in)
To measure the beta’s stability and which features get used, the app can send anonymous usage events (screen and feature names, e.g. “game_finished”) and crash reports (technical stack traces with a short trail of recent screen names) via Google Firebase Analytics and Crashlytics. This is off by default; the app asks once, and a Settings toggle (“Share usage & crash data”) controls it thereafter. No account details, no game content, and no advertising ID (the app removes the AD_ID permission entirely) are included.
- Purpose / legal basis: your consent (Art. 6(1)(a)), withdrawable any time in Settings.
- Retention: crash data up to 90 days; analytics data up to 14 months (Google Firebase defaults).
6. Bug reports (user-initiated)
The in-app “Report a problem” tool composes a diagnostic report — app version, device model and OS version, recent in-app activity (screen and feature names), and any captured errors. You see the report content and nothing is sent until you choose to send it (by email or share sheet).
7. Coach voices (on-device)
Text-to-speech runs entirely on your device. Voice model files are downloaded once from a public model repository (GitHub) on first use — a standard file download that includes no personal data beyond the network request itself.
8. Notifications
The daily training reminder is a local, on-device notification you enable in Settings. There is no push-notification infrastructure and no device token is sent anywhere.
What we don’t do
No advertising or ad SDKs. No advertising ID. No sale or sharing of personal data for marketing. No tracking across other apps or websites. No payments are processed in the beta (store prices are display-only).
Processors and recipients
| Recipient | What | When |
|---|---|---|
| Google (Firebase Authentication, Analytics, Crashlytics) | account email; opt-in telemetry | account creation; telemetry opt-in |
| Anthropic PBC | coaching questions + chess profile summary | online-coach consent |
| Lichess.org | your Lichess account interactions | Lichess connection |
These providers act as processors or independent services under their own policies (linked above). We share nothing with anyone else.
International transfers
Google and Anthropic may process data in the United States. Transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses as applicable to those providers.
Your rights (GDPR)
You have the right to access, rectify, and erase your personal data, to restrict or object to processing, to data portability, and to withdraw any consent at any time (Settings, or by email). Contact vaaramobile@gmail.com to exercise these rights. You also have the right to lodge a complaint with a supervisory authority — in Finland, the Office of the Data Protection Ombudsman (tietosuoja.fi).
Children
ChessMentor is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.
Security
Data in transit is encrypted (TLS). Tokens and API keys are stored in the device’s secure storage (Android Keystore). Release builds are obfuscated. Your chess data never leaves the device except as described above.
Changes
We may update this policy as the beta evolves; material changes will be announced in the app or by email to account holders, with the effective date above updated. Earlier versions are available on request.