Privacy Policy
Effective date: 20th of September 2026.
This policy explains what personal data chess42.xyz collects, why, who else handles it, how long it is kept, and what you can do about it. It is written to be read, not just accepted.
1. Who is responsible
chess42.xyz is built and run by Olgica Djuric, an independent developer in Serbia, as a contribution to the chess community. There is no company behind it. In this policy, "chess42.xyz" means that person, who is the controller of your personal data under the General Data Protection Regulation (GDPR) and the Serbian Law on Personal Data Protection. Contact: privacy@chess42.xyz.
2. The short version
- chess42.xyz collects what is needed to run lessons, homework, analysis and
play — and very little beyond that.
- **Your private analysis games, the games you play, your mental-fitness
journal and the chat in your lessons are encrypted** before they are stored, so a copy of the database on its own does not reveal them.
- Chess engines (Stockfish and Maia) run in your browser. The positions you
analyse are not sent anywhere for evaluation.
- Video and audio in live lessons are not recorded.
- The AI coach, once it is available, answers from books written by
coaches on chess42.xyz. It only helps; it never decides anything about you.
- There is no advertising and no tracking cookie. Your data is not sold.
- chess42.xyz is free to use.
3. What chess42.xyz collects and why
| Data | What it includes | Why | Legal basis (GDPR) |
|---|---|---|---|
| Your account and profile | Email address and sign-in (handled by Firebase Authentication — chess42.xyz never sees your password), or name, email and photo from Google; display name, photo, name, bio, country, FIDE ID and rating, Lichess and Chess.com usernames, preferences, online status; for coaches, the application and its review | To create your account, show you to your coach or students, and decide who may coach | Contract, Art. 6(1)(b); optional profile fields by your choice |
| Learning with a coach | Curriculums, homework and reviews; availability, lesson requests and sessions; board positions and chat during a lesson (the chat is encrypted); a student's email address entered by their coach, possibly before the student has an account | To teach, book and run lessons, keep the written record of each lesson, and link a student to their coach | Contract, Art. 6(1)(b); the invitation by legitimate interest, Art. 6(1)(f) |
| Live video and audio | Camera and microphone streams | To hold the lesson. Sent directly between participants' browsers; a Google STUN server helps them connect and sees only IP addresses, never the video. Not recorded or stored | Contract, Art. 6(1)(b) |
| Your private chess work — encrypted | Analysis games and notes, games you played on the site (including opponent names), mental-fitness journal entries | So your work is saved between visits | Contract, Art. 6(1)(b) |
| Library and AI coach | Books, studies and puzzles you create — visible to others only if you choose "link" or "public"; questions you ask the AI coach, the position on your board, the book passages used, and the answers. Spoken questions become text and the recording is not kept; your questions do not train AI models | To store and publish your work, and to answer your question | Contract, Art. 6(1)(b) |
| Messages to you | In-app notifications, a push token if you allow browser notifications, and emails about invitations, lessons and homework | To tell you what needs your attention | Contract, Art. 6(1)(b); push notifications only with your browser permission, Art. 6(1)(a) |
| Safety and running the site | Reports you make or that concern you; IP address, browser and time of request in server logs; page views counted without cookies, with a visitor hash that resets every 24 hours | To act on reports, keep the service secure, and see which parts are used | Legitimate interest, Art. 6(1)(f); legal obligation where the law requires action, Art. 6(1)(c) |
chess42.xyz does not intentionally collect special categories of data (health, religion, political opinion and similar). Please do not write them into free-text fields such as the journal, chat, bio or questions to the AI coach.
chess42.xyz makes no decisions about you by automated means. Engine evaluations, ratings and the AI coach describe chess positions, games and ideas, not people. The AI coach does not review reports, restrict accounts or decide anything about you, and reports are reviewed by a person.
chess42.xyz does not process biometric data — camera images are not analysed, and lesson video is not recorded. It does not use AI for surveillance, and it does not build profiles of you for advertising.
4. Storage in your browser
chess42.xyz stores small items in your browser: your sign-in session (Firebase Authentication), and interface preferences such as board theme, panel layout and notation view. These are needed for the app to work as you set it up. There are no advertising or cross-site tracking cookies, and the usage statistics set no cookie at all.
5. Who else handles your data
chess42.xyz uses the following service providers. Google, Hetzner and Resend process data only on the instructions of chess42.xyz, under a data processing agreement. Vercel hosts the website under its own terms of service and privacy notice: chess42.xyz uses Vercel's free plan, for which Vercel does not offer a data processing agreement.
| Provider | What they do | Where | Transfer safeguard |
|---|---|---|---|
| Google (Firebase Authentication, Cloud Firestore, Firebase Cloud Messaging, STUN) | Sign-in, user profiles, notifications, push delivery; helps browsers connect for live lessons | United States (Authentication is processed only in the US) | Standard Contractual Clauses under the GDPR or the Serbian Law on Personal Data Protection, and the EU-US Data Privacy Framework where it applies |
| Vercel Inc. | Hosts the website; cookieless usage statistics | United States and global edge network | EU-US Data Privacy Framework where it applies |
| Hetzner Online GmbH | Hosts the application server, the database and the AI coach's knowledge base | Helsinki, Finland (EU) | Within the EU |
| Resend | Sends invitation and notification emails from the chess42.xyz domain | Sent from the EU (Ireland); Resend is a US company | Standard Contractual Clauses under the GDPR or the Serbian Law on Personal Data Protection, and the EU-US Data Privacy Framework where it applies |
The AI coach's language model is run by a separate provider. It is added to this table — with where it processes data and the safeguard used — before the AI coach is switched on, and no data is sent to it before then.
Other people in the app also see some of your data, because that is the service: your coach sees your homework, sessions and profile; your students see your profile and what you assign them; anyone can see a library item you publish.
chess42.xyz discloses data to authorities only when the law requires it.
6. How long it is kept
| Data | How long |
|---|---|
| Account, profile, teaching, library, private chess work, journal | For as long as your account exists |
| Lesson chat and board records | For as long as the lesson exists in the coach's and student's accounts |
| Lesson requests | Expire automatically once the requested time has passed |
| AI coach conversations | 30 days, then deleted; spoken questions are not kept at all |
| Reports | Up to one year after the report is closed, or longer only if needed for a legal claim |
| Server logs | Rotated automatically; kept only for days |
| Usage statistics identifiers | 24 hours |
| Database copies taken before a software update | Kept on the same server until they are no longer needed, then deleted |
When you ask for your account to be deleted, your data is removed from the live database within 30 days. A database copy taken before a software update is used only to recover from a failed update, and is never used to bring deleted data back. chess42.xyz does not keep an off-site backup, so keep your own copies of anything important to you.
7. How it is protected
- All connections to chess42.xyz are encrypted (HTTPS/TLS).
- Private analysis games, played games and mental-fitness journal entries are
encrypted with AES-256-GCM before they reach the database, and each entry is cryptographically bound to its owner.
- Lesson chat is encrypted the same way, and each message is bound to its
lesson and to the person who wrote it, so it cannot be moved to another lesson or attributed to someone else.
- The database runs on a server in the EU and cannot be reached from the
internet; only the application talks to it.
- Access to data is checked on the server for every request; a user can reach
only their own data and data shared with them. The AI coach answers only from content the person asking is allowed to see.
- The content of your games, notes and messages is not written to logs.
No system is perfectly secure. If a breach puts your rights at risk, chess42.xyz will notify the supervisory authority and, where the risk is high, you — as the law requires.
8. Children
chess42.xyz is chess for all generations, and children are welcome — with these safeguards:
- You must be at least 13 to have your own account. chess42.xyz does not
knowingly collect personal data from a child under 13 through an account of their own. Children under 13 learn here through the account of a parent or guardian, who is responsible for it.
- If chess42.xyz learns that an account belongs to a child under 13, the
account is closed and its data deleted.
- A user who is 13 or older but below the age of digital consent in their
country — 15 in Serbia, and between 13 and 16 in EU member states — may use chess42.xyz only with the consent of a parent or guardian, who can exercise all the rights below on the child's behalf.
If you believe a child is using chess42.xyz without the right account or consent, contact privacy@chess42.xyz and it will be acted on.
9. Your rights
Under the GDPR and the Serbian Law on Personal Data Protection, you have the right to:
- Access — get a copy of the personal data chess42.xyz holds about you
- Rectification — correct inaccurate data (most of it you can edit in your profile)
- Erasure — have your account and data deleted
- Restriction — have processing paused while a question is resolved
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — at any time, for anything based on consent (for
example, turn off push notifications in your browser)
To exercise any of these, email privacy@chess42.xyz from the address on your account. You will get an answer without undue delay and within 30 days. If a request needs longer for a good reason, you will be told within those 30 days, and the answer will follow within a further 30 days at most. You may be asked to confirm your identity first, so that nobody else can obtain your data.
You also have the right to lodge a complaint with a supervisory authority — where you live, where you work, or where the problem happened. In Serbia this is the Commissioner for Information of Public Importance and Personal Data Protection; in the EU it is your national data protection authority.
10. Changes
If this policy changes in a way that matters, you will be told in the app or by email before the change takes effect. The date at the top shows the current version.