Privacy Policy

Last updated: 10 October 2026

This policy explains which personal data ReviewMyChess (reviewmychess.com) processes, why, and what rights you have under the GDPR.

Controller

Philipp Scheer ("we"), Montleartstraße 1b, 1140 Vienna, Austria. Email: hello@reviewmychess.com

Free game review

You can review a single Chess.com game without an account. Your browser fetches the game directly from Chess.com's public Published-Data API, so Chess.com receives your IP address for that request. Stockfish 19 then analyzes the game on your device. The review page loads its icons and pieces from our servers, unless we switch the site to Chess.com's icons or your account to Chess.com's pieces; then Chess.com's servers receive your IP address for those too.

For convenience, your browser saves the last Chess.com username you typed into a form, and whether you paused the analysis of your games, in its localStorage. Both stay on your device.

AI assistants

You can use ReviewMyChess from AI assistants such as Claude or ChatGPT through our MCP connector or our text pages for assistants. The assistant's provider sends us only what a tool needs: a Chess.com username, a game link or id, or a PGN. We don't receive your conversation.

• Free game reviews: our server looks up the game, and who played it if the assistant only sent a link, on Chess.com and analyzes it with Stockfish. We store the analysis of public Chess.com games, so the next review of the same game is instant. PGNs you send are analyzed and not stored.
• Connecting your account: if you sign in from your assistant, we store a sign-in grant with your account ID, the app's name and its access tokens. It lets the assistant read the statistics of the profiles you subscribe to.

How your assistant handles your conversation is up to its provider's privacy policy.

Account and profile analysis

For the paid profile analysis, we process:

• Email address: for your account, to send you login links and to remind you before your free trial ends. There are no passwords.
• Session cookie: a strictly necessary httpOnly cookie that keeps you signed in for 30 days. We use no other cookies.
• Chess.com usernames that you claim as your profiles.
• Public game data: we mirror all public games of your claimed profiles from Chess.com's public API onto our servers and update them hourly.
• Analysis results: your browser analyzes the games with Stockfish and uploads the results, which we store to show your statistics, accuracy and move classifications.
• Subscription data: Stripe customer and subscription IDs and your subscription status.

Payment data such as card numbers is processed by Stripe and Link, never by us. You need an email address to create an account; without one, we can't provide the profile analysis.

Analytics

We use PostHog (EU Cloud, Frankfurt) in cookieless mode: it sets no cookies, stores nothing on your device and records anonymous page views and product events. Our server also sends events about sign-ups and subscription changes, linked to your internal account ID.

Legal bases

• Art. 6(1)(b) GDPR (contract): your account, subscription and analysis, including access for an AI assistant you connect to your account.
• Art. 6(1)(f) GDPR (legitimate interests): cookieless analytics to understand how the service is used, free game reviews for AI assistants, and security, including rate limiting login emails by IP address and Cloudflare Turnstile checks on the sign-in and withdrawal forms.
• Art. 6(1)(c) GDPR (legal obligation): billing records required by tax law.

Recipients

• Cloudflare, Inc.: hosting, database and file storage in the EU jurisdiction, email delivery via Cloudflare Email Service, and Cloudflare Turnstile, which checks that the sign-in and withdrawal forms are sent by a person.
• Stripe and Link (by Stripe): payments. Link is the merchant of record.
• PostHog: analytics, hosted in the EU.

Cloudflare, Stripe and PostHog are US companies; transfers to them are based on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. Chess.com is only the source of the public game data, not a recipient of your account data.

Retention

• Account data and your analysis results: until you delete your account, which you can do yourself on the account page. Deleting your account also cancels your subscriptions.
• AI assistant sign-in grants: until you delete your account, which revokes them.
• Login links: 15 minutes.
• Sessions: 30 days.
• Mirrored public games and their server-side analyses: indefinitely, as they are public game records.
• Billing records: kept by Stripe and Link for the statutory periods (e.g. 7 years under Austrian tax law).

Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability (you can export your data as JSON on the account page), and you can withdraw any consent you have given at any time. To exercise your rights, email hello@reviewmychess.com.

Right to object: you can object at any time to processing based on our legitimate interests, such as analytics.

You can also lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Wien, www.dsb.gv.at.

Automated decision-making

There is no automated decision-making within the meaning of Art. 22 GDPR.