Privacy policy

Last updated: 5 October 2026

League of Chess is a chess career management game in development. This policy covers the website, the list for the closed beta, game accounts, and the League of Chess apps for iPhone and Android. It explains what we process, why, for how long, who helps us, and your rights.

1. Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

Yannick Koitzsch
Franz-Hinterholzer-Kai 42
5020 Salzburg
Austria
Email: [email protected]

We are not required to appoint a data protection officer. For any privacy question or request, write to [email protected].

2. Visiting the website

What: when you open a page, your browser sends technical data: your Internet Protocol (IP) address, the date and time, the page requested, the referring page, and your browser and operating system.

Why: to deliver the website, protect it against attacks and abuse (for example by limiting how often one address can submit the form), and find faults.

Legal basis: our legitimate interest in a secure, working website (Article 6(1)(f) GDPR).

How long: server and proxy logs are deleted after at most 14 days, unless an entry is needed to investigate a specific attack. To limit how often the form can be used, we count requests per IP address and per email address; we store only a keyed hash of them, never the address itself, and each count expires within a day.

Bot check on the form: before the pre-registration form sends your address, Cloudflare Turnstile checks that a person, not an automated script, is using it. It runs in a small frame loaded from Cloudflare and reads technical signals from your browser and device, such as your IP address, browser properties and how the page is used. We receive only the answer "passed" or "failed". Why: to stop the form from being used to send emails to people who never asked for them. Legal basis: our legitimate interest in protecting the form and the people whose addresses could be entered into it (Article 6(1)(f) GDPR); reading those signals on your device is strictly necessary for this security function (§ 165(3) of the Austrian Telecommunications Act 2021). Cloudflare processes this data as our processor under the Turnstile Privacy Addendum.

3. Pre-registration for the closed beta

What: your email address, whether and when you confirmed it, and when you last asked for a confirmation link; and, if you came to the page through one of our links, a short code for that link (for example "tt" for TikTok). The code names a channel, never a person. We store no name and no IP address with it.

Why: to invite you to the closed beta when your wave opens, and to tell you when League of Chess launches. The channel code tells us which of our channels bring people to the list. We use your address for nothing else. We do not send a general newsletter, we do not sell or share the list, and we do not track whether you open our emails.

How it works: after you enter your address, we send one email with a confirmation link. Your address is on the list only after you open that link. The link works once, for 24 hours. If you never confirm, we delete the address after 7 days. If the address is already on the list, we tell you so by email rather than on the website, so nobody can use the form to find out who has signed up.

Legal basis: your consent (Article 6(1)(a) GDPR, and § 174 of the Austrian Telecommunications Act 2021 for the emails). The confirmed double opt-in is our record of that consent (Article 7(1) GDPR). Sending the single confirmation email is based on our legitimate interest in checking that the address really belongs to the person who entered it (Article 6(1)(f) GDPR).

Withdrawing consent: you can leave the list at any time through the link in every email, or by writing to [email protected]. We then delete your address at once. Leaving does not make earlier processing unlawful.

How long: until the first of these:

• you leave the list;
• you create a game account with the same address (the account is then covered by the privacy notice you see when you create it);
• 30 days after we sent you your beta invite;
• we send the launch email, after which the whole list is deleted.

Deleted addresses remain in our encrypted backups for up to 30 more days, until those backups expire.

Age: you must be at least 16 years old to pre-register. The list runs on your consent, and under Article 8 GDPR a child's consent to an online service needs the approval of a parent or guardian below an age that each European Union (EU) member state sets between 13 and 16 (14 in Austria, for example). We do not ask where you live, so we apply 16 to everyone, which meets every member state's rule, and we apply it whatever your country, because this policy covers all of our processing. If you are younger, ask a parent or guardian to pre-register with their own email address; the invite then reaches them. We store no date of birth with the list; the game asks the player's age separately when an account is created (section 6).

4. Your game account

What: every account has an account number that we generate, the dates it was created and last changed, a role (player, or operator for the people who run the game), and your answer to the age question (section 6). Depending on how you sign in (section 5), the account also holds:

• your email address, and whether it has been confirmed;
• the name your Google or Apple account gives us;
• the identifier Google or Apple uses for you (section 5).

A guest account holds no email address and no name. It gets a placeholder address in our own domain (guest.leagueofchess.com) and the name "Anonymous", so it holds only the account number, the age answer and its sessions (section 5).

Why: to create your account, sign you in, and keep your game with it. Only you (and our operators, when they help you) can see your name from Google or Apple. It is never shown to other players and never copied into your player's career.

Record of account events: the game keeps a permanent log of what happens in it. For accounts it records only the account number, the sign-in method (guest, email, Google or Apple), the platform (website, iPhone or Android) when known, and the time when:

• the account was created;
• a guest account was saved into another account (with both account numbers);
• the age question was answered (without the answer);
• you opened your personal invite link (your account number only), or an account was created with someone's invite link (both account numbers; see "Invite links" below).

When we delete an account, the log records the account number, the reason (for example, an unused guest account, an age under 13, or your request) and the time, and, if the account managed a player, that the player was handed to the game (with the account number and the career number). The log never contains your email address, name or year of birth.

Legal basis: performing our contract with you, that is, providing the game you signed up for (Article 6(1)(b) GDPR). For the log of account events: our legitimate interest in a complete and reliable history of the game (Article 6(1)(f) GDPR).

How long: until the account is deleted (section 12). A guest account is deleted automatically, with its age answer and its sessions, once nobody can sign in to it any more and it has not been used for 30 days. While you keep playing, this never happens. If you stop, the guest's session expires 30 days after your last use, and the account is deleted within about an hour after that. If you sign out of a guest account, nobody can sign in to it again: it is then deleted within about an hour, but never earlier than 30 days after it was created. To keep a guest account, save it (section 5). When you save a guest account into a full account, the guest account is deleted; its age answer moves to the full account only if that account has none yet. If you save a guest into an account that already exists, the guest is deleted in the same way. The log of account events stays after an account is deleted; the account number in it then refers to no one. Deleted data remains in our encrypted backups for up to 30 more days, until those backups expire.

Your player: your account manages one player, a fictional chess player identified by a random career number. The game keeps the name and nationality you chose for it, its class and look, its ratings, games and results, its training plans and routine, and the game values the game calculates for it, some of which no player ever sees (such as its true strength). Other players see your player's name, nationality, class, rating, results and public profile, never your account's email address or name. The log of account events also records your account number with your player's career number when you create the player, when it moves from a guest account to the account you saved it into, and when it is handed to the game; after your account is deleted, that number refers to no one (section 12).

Why: to run the game you signed up for. Legal basis: performing our contract with you (Article 6(1)(b) GDPR).

Weekly records for balancing the game: once a week the game also records, for every player, its game values and how it was managed that week: the training routine, how many sessions and rest days it had, how many plans were changed and on how many days its manager acted in the game, and how rested it was before each match. A record carries the career number, never your email address or name. We use these records for one purpose only: to balance the game's rules, that is, to check whether the choices players make pay off as designed and to correct the rules when they do not. They are summed into reports that only the people who run the game read, and no decision about you or your player is made from them. They stay in our database at Hetzner in Germany (section 10) and are shared with no one else. Legal basis: our legitimate interest in a fair and well-balanced game (Article 6(1)(f) GDPR). You can object to this processing (section 12).

Invite links: a player aged 16 or over can invite friends with a personal link (once invites are open; they are not yet). We store your account number with a hash of your link, never the link itself, and count how many accounts joined with it; during a closed beta, each link admits a limited number of new accounts. When someone creates an account with your link, we store their account number with yours and the time. You then see, on the welcome screen and in Settings, the name of the player they created (or that they have not created one yet), and they see nothing about you through the link. You share the link yourself, by copying it or through your device's share menu; we never send an email to an address you type in, and an invite earns nothing in the game. Why: to show you who joined with your link and, during a closed beta, to admit them and keep each player to their number of invites. Legal basis: performing our contract with you, that is, providing the invite feature you use, or the account you asked for with a link (Article 6(1)(b) GDPR). How long: your link until your account is deleted; the record that an account joined with a link until either of the two accounts is deleted.

How long: your player and its weekly records are kept for the life of the game world. When your account is deleted, your player stays in the game under a generated name and no longer belongs to any account, so its records then refer to no one.

5. Signing in

You can sign in with Google, with Apple, by email, or as a guest.

Google and Apple: you sign in on a page or in a window of Google or Apple. They handle that step under their own privacy policies, as independent controllers (section 10). They then send us a signed message (an "ID token") with the identifier they use for you, your email address, whether it is confirmed, and your name; Google also sends the web address of your profile picture, which we discard without storing it. Apple lets you hide your email address: we then receive an address at Apple's relay service, which forwards our emails to you. Apple sends your name only at your first sign-in, and only if you choose to share it. When you sign in through a browser, we also receive an access token and, from Apple, a refresh token. We store none of these tokens, not even the ID token, and we never access your Google or Apple account. We keep only the identifier, your email address, whether it is confirmed, and your name (section 4). If your Google or Apple account has the same confirmed email address as an existing League of Chess account with a confirmed address, you are signed in to that account.

Email: we send you an email with a sign-in link (on the website; it works once, for 15 minutes) or a 6-digit code (in the apps; it works for 10 minutes and allows 3 attempts). The email contains only the link or the code. Our email service, Resend, keeps a record of each email it sends for us for 30 days (section 10). While a link or code is open, we store your email address with a hash of the link or code, never the link or code itself. That record is deleted when it is used, or within about an hour after it expires. The first sign-in with an address creates an account with it. While new accounts are limited to invited players, an address without an invite is refused before any email is sent, and we store nothing of it beyond the request counts described under "Limits against abuse". If you sign up with someone's invite link (section 4), we also store, for 15 minutes, a hash of your email address with a hash of the link, so the sign-in link or code still finds the invite, even when you open the link in another browser; it is deleted within about an hour after it expires.

Guest: you can play without an email address. You can save a guest account at any time with Google, Apple or email (section 4).

Limits against abuse: to limit how often sign-in emails can be requested and sign-in can be tried, we count requests per email address and per IP address. We store only a keyed hash of them, never the address itself, and each count is deleted within about two hours.

Sessions: when you sign in, we create a session. It consists of a random token, its expiry date, and when it was created and last renewed. We do not store your IP address or your browser or device description (user agent) with it. On the website the session is held in a cookie; in the apps, in your device's secure storage (section 9). A session lasts 30 days and is extended by each day on which you use the game.

• Why: the token keeps you signed in.
• Legal basis: performing our contract with you (Article 6(1)(b) GDPR).
• How long: the session record is deleted when you sign out. In the apps, signing out always removes the session from your device; if our server cannot be reached at that moment, the record on the server simply expires after at most 30 days. Records of expired sessions are deleted within about an hour.

Sign-in handover in the apps: when an app signs you in through the browser (section 7), our server keeps a few single-use records for the handover: a one-time number for the sign-in (5 minutes), a ticket (5 minutes, with the guest account number if you are saving a guest, and the platform), the browser step (10 minutes), and a code that hands the sign-in back to the app (3 minutes, with your account number). They are stored under a hash, deleted when used, and otherwise deleted within about an hour after they expire.

6. Your age

Minimum ages: you must be at least 13 years old to have a game account. Chat, messages, being visible to other players and, later, purchases will open only to players aged 16 and over. To join the list for the closed beta you must be at least 16 (section 3).

What: after you sign in for the first time, we ask every account once, guests too, for the year of birth. If that year places you close to 13 or to 16, we also ask for the month. We store the year, the month if we asked for it, and when you answered. We never ask for your full date of birth or an identity document. The log of account events records only that the question was answered (section 4). The game can only be used once the question is answered. The answer cannot be changed in the game; if it is wrong, write to [email protected] (Article 16 GDPR).

If you are under 13: we do not store your answer. We delete the account you just started at once, with its sign-in methods and its session, and sign you out. The log of account events records only the account number, the reason and the time (section 4). Apart from that, the only traces left are the ones every visit or sign-in leaves for a short time: the server and proxy logs (section 2), a sign-in email that our email service keeps for 30 days (section 5), and sign-in links and codes you have not used, which expire (section 5). Deleted data remains in our encrypted backups for up to 30 more days, until those backups expire.

Why: to keep the game to players aged 13 and over, and to open each social feature only to players old enough for it. Right now the game has no chat or other social features. When they arrive, they will open only to players whose answer shows they are 16 or over.

Legal basis: our legitimate interest in protecting children and young people and in offering the game and each feature only to players old enough for it (Article 6(1)(f) GDPR). Where a feature later relies on your consent, the answer also tells us whether a parent or guardian has to agree for you (Article 8 GDPR).

How long: as long as the account exists (section 4). An answer under 13 is never stored.

7. The iPhone and Android apps

Download: you download the apps from Apple's App Store or Google Play. Apple and Google process the download and your store account under their own privacy policies; we receive no personal data about you from them.

Permissions: the apps use the internet and nothing else on your device: no location, contacts, camera, microphone or photos, and no advertising identifier. They contain no analytics or advertising components. They send no push notifications yet.

Sign-in: on the iPhone, Google and Apple sign-in open their own windows; on Android, Google sign-in runs through Android's sign-in service, which is part of Google Play services. Sign in with Apple on Android opens Apple's page in your phone's browser, and the browser hands the sign-in back to the app through our server with a single-use code (section 5). Google, Apple and Google Play services act under their own privacy policies (section 10). When you sign out, the app also signs out of its Google sign-in, so the next sign-in lets you choose an account again.

Updates to the game's interface: most of the app is the game's interface, which we can update without a new store release. Each time the app starts or returns to the screen, its update component asks our server whether a newer version exists. The request contains:

• the app's identifier and the platform (iPhone or Android);
• the version of the app and of the interface it runs;
• the version of your operating system and of the update component, whether the app runs on an emulator and as a store build, and how it was installed;
• a random device identifier that the update component creates and keeps on the device. On the iPhone it stays in the device's Keychain even after the app is uninstalled.

Our server reads only the app identifier, the platform and the two versions. It stores nothing from the request, and removes the device identifier from its logs. Like every request, the request passes through Cloudflare and our server and proxy logs (section 2). If a newer version exists, the app downloads it directly from our storage at Hetzner in Falkenstein, Germany, not through Cloudflare, and installs it the next time you leave or restart the app. Hetzner receives your IP address with that download, as it does with any request, in order to deliver the file; we have not switched on access logs for that storage. A version that fails to start is rolled back, and the app remembers its version number so that it does not try it again.

• Why: to deliver fixes quickly and keep the app working and secure.
• Legal basis: our legitimate interest in a working and secure app (Article 6(1)(f) GDPR). Keeping the device identifier and the update data on your device is strictly necessary for this function (§ 165(3) of the Austrian Telecommunications Act 2021).

Error reports: see section 8. What the apps store on your device is listed in section 9.

8. Error reports

If something breaks, the website, the apps or our server may send an error report to our error-tracking service, Sentry. A report contains the error, the page, and your browser and operating system; from the apps it also contains the platform (iPhone or Android), the version of the app and of its interface. Reports from the apps come only from the game's interface, not from the app's own system code. A report contains no IP address, no email address and no sign-in data: we remove email addresses, sign-in links, codes and tokens before a report is sent, and our server's reports carry no user, cookies or request contents. Legal basis: our legitimate interest in finding and fixing faults (Article 6(1)(f) GDPR). Reports are deleted after at most 90 days.

9. Cookies and storage on your device

We use no analytics or advertising trackers, so we do not ask for cookie consent. Everything listed here is strictly necessary to provide the service you asked for (§ 165(3) of the Austrian Telecommunications Act 2021).

On the website:

• Your session (the cookie __Secure-better-auth.session_token): keeps you signed in (section 5). Your browser's scripts cannot read it, and it is sent only over encrypted connections. It lasts 30 days and is renewed by each day on which you use the game; it is deleted when you sign out.
• During a sign-in with Google or Apple (the cookie __Secure-better-auth.state): ties the answer from Google or Apple to the sign-in you started. It lasts 5 minutes.
• During an app sign-in through the browser (the cookie __Secure-better-auth.app_flow, set in your phone's browser): ties the browser step to the app that started it (section 5). It lasts 10 minutes.
• For the duration of a browser tab (session storage, deleted when you close the tab): the email address you entered for a sign-in link or code (loc.lastEmail), so the next screen can send it again; when a code was last sent (loc.codeSentAt); that you closed the guest notice (loc.guestBanner); that the page already reloaded once for a new version (loc.updateReload); and, after you open someone's invite link, that link's code (loc.invite), so your sign-up can use it; it is removed once you are signed in.
• What you have already seen on this device (local storage, kept until you clear it): the player the welcome screen was shown for (loc.youreIn), your progress through the first steps on Home (loc.road), the last game whose result was revealed to you (loc.reveal) and the last level shown for your player (loc.levelSeen), each as a career, game or level number, so that each moment plays once. While you create your player, your choices so far (loc.creation, session storage, deleted when you close the tab).
• Security cookies and storage from Cloudflare (__cf_bm, cf_clearance, and the cookies and local storage that Cloudflare Turnstile uses in its frame on the pre-registration form): they tell people apart from bots. __cf_bm lasts at most 30 minutes and cf_clearance for the time set on a security check you passed; Turnstile's entries are set and managed by Cloudflare for the check itself.
• Your theme choice: if you switch between the light and dark theme, your browser stores that choice (the entry loc.theme in local storage), so the page does not flash on the next visit. It never leaves your device.

In the apps:

• Secure storage (the Keychain on the iPhone, readable only on this device after it was first unlocked and never synced to iCloud; the Keystore on Android): your session (loc.session), deleted when you sign out; and, only while a sign-in runs in the browser, a secret that proves the sign-in belongs to this app (loc.handoffVerifier).
• App settings (not secret): that the app has been set up after installation (loc.installed), so that a reinstalled app never finds an earlier session; and the version numbers of interface updates that failed on this device (loc.ota.failed, at most ten).
• The update component keeps its device identifier and the downloaded interface versions (section 7).
• The same session storage and local storage entries as on the website, the theme choice included: the session storage entries for the duration of the app session, together with the screen to return to after an update (loc.otaReturnTo), and the local storage entries until you uninstall the app.
• Google's and Apple's sign-in components may keep their own sign-in state on your device, under their own policies.

You can delete the website's entries at any time in your browser settings. Uninstalling an app deletes its data, except the update component's device identifier in the iPhone Keychain; a reinstalled app clears its own secure storage when it first starts.

A "ref" code in a link you follow to the website is read from the address bar and sent with your pre-registration only; nothing is stored on your device for it.

Our fonts are served from our own servers; your browser does not contact a font provider.

10. Who processes data for us

We work with these providers under data processing agreements (Article 28 GDPR). They may use the data only on our behalf and on our instructions.

The European Commission has decided that the United States provides an adequate level of protection for companies certified under the EU-US Data Privacy Framework (Article 45 GDPR). Each US provider above is certified and has also signed the EU standard contractual clauses with us (Article 46(2)(c) GDPR), which stay in force if the framework should fall.

Sign-in with Google and Apple, and the app stores: Google and Apple are not our processors. When you sign in with them, or download an app from their stores, they process your data as independent controllers under their own privacy policies, and decide themselves where they store it: for people in the EU, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (privacy policy), and Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland (privacy policy). We receive from them only what section 5 lists.

Beyond these providers, we pass on personal data only if the law requires us to.

11. Links to social networks

The website links to our pages on Discord, Instagram, TikTok and X. These are plain links: nothing is loaded from those networks until you click one. Once you are on their sites, their own privacy policies apply.

12. Your rights

You have the right to:

• access the data we hold about you (Article 15 GDPR);
• rectification of wrong data (Article 16);
• erasure (Article 17);
• restriction of processing (Article 18);
• data portability (Article 20);
• object to processing based on our legitimate interest (Article 21);
• withdraw consent at any time, with effect for the future (Article 7(3)).

To use them, write to [email protected]. We answer within one month. We may ask you to confirm the request from the address in question, so that nobody else can get your data.

Deleting your account: until the game has its own deletion button, write to [email protected] from the email address of your account (for a Google or Apple account, the address that service gave us). We delete the account within one month: the account record with your email address, name and age answer, its sign-in methods, its sessions, your invite link and the record of who joined with it. Open sign-in links and codes expire within 15 minutes, and their records are deleted within about an hour after that (section 5). The log of account events keeps the account number, which then refers to no one (section 4), and deleted data remains in our encrypted backups for up to 30 more days. Your player stays in the game under a generated name and is no longer linked to you (section 4). You can also ask for a copy of your account data (Articles 15 and 20 GDPR) in the same way. Guest accounts that are no longer used are deleted automatically (section 4).

You also have the right to lodge a complaint with a supervisory authority. In Austria that is:

Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Vienna, Austria
[email protected], www.dsb.gv.at

13. No automated decisions

We make no automated decisions and do no profiling within the meaning of Article 22 GDPR. The weekly records of section 4 describe how players are managed only to balance the game's rules; nothing is decided about you from them.

14. Security

All connections are encrypted with Transport Layer Security (TLS). The server is reachable only through Cloudflare, and access to the database is limited to what running the service needs. Sign-in links, codes and the apps' handover records are stored only as hashes. Sessions are signed, and the apps keep theirs only in the device's secure storage, never in ordinary app storage.

15. Changes

We will update this policy before the game starts to do more with personal data, for example before it adds chat, push notifications, analytics or purchases. The date at the top shows the current version. If a change affects what we do with your account data, we will tell you in the game or by email before it applies. If a change affects what we do with your address on the beta list, we will tell you by email before it applies.