Privacy Policy

Effective date: August 7, 2026

1. Who we are

AxiomChess ("AxiomChess," "the app," "we," "us," or "our") is an independent chess-improvement web application. It analyzes your chess games using a Stockfish chess engine that runs inside your own web browser (compiled to WebAssembly). By default your games are not sent to us to be analyzed — the analysis happens on your device. You can optionally switch on Fast analysis, which sends board positions from the games being analyzed to an analysis server we operate so that large batches finish faster. It is off unless you turn it on, and section 2(e) sets out exactly what it sends.

We are independent and are not affiliated with, endorsed by, or sponsored by Chess.com, Lichess, or the Stockfish project. Those names are third-party trademarks used only to describe what the app does.

The person responsible for the app and for personal data processed through it (the "data controller") is:

• Joshua Seiler, an individual sole proprietor, based in Bradenton, Florida, USA.
• Contact (the best way to reach us on any privacy question): joshuadseiler@gmail.com

Email is the fastest and best way to reach us, and under EU/UK data-protection law a monitored contact email is a valid contact point. We will publish a postal or registered-agent address here once one is established.

The app is free today. A paid tier is planned for the future; if and when it launches, we will update this policy to describe any billing-related data before we charge anyone.

2. The data we process, and why

The app is local-first. That means the main place your data lives is your own browser, on your own device — not our servers. Below we split the picture into five ways data is handled: (a) data your browser fetches from public chess services, (b) optional account data stored with Supabase, (c) data stored locally in your browser, (d) privacy-bounded operational error events, and (e) the optional Fast analysis service.

(a) Data your browser fetches from public chess services

Chess.com games. When you ask the app to analyze games for a Chess.com username, your own browser contacts Chess.com's public Published-Data API (api.chess.com) directly and downloads those games. Our servers never receive, proxy, or store your Chess.com games. The downloaded games land in your browser's local storage (see section (c)). Because your browser talks to Chess.com directly, that game download is between you and Chess.com and is also governed by Chess.com's own terms and privacy policy.

Lichess games. Lichess imports work the same way: your own browser requests your games directly from Lichess's public game-export API, and the downloaded games land in your browser's local storage. Our servers never receive, proxy, or store them, and the download is governed by Lichess's own terms and privacy policy.

PGN files you import. You can also import a game file (PGN) by selecting it or pasting the game text. The file is read and parsed entirely in your browser and stored in your browser's local storage (see section (c)). It is not uploaded to our servers, and games imported this way stay on your device — they are not synced to the cloud store described in section (b).

Opening explorer ("how masters played here"). When you use the opening-explorer feature, the app sends only a board position (a FEN string — a compact description of where the pieces stand) to Lichess through a small server component of ours. No personal data, no usernames, and no information about you or your opponent is included in that request — just the position on the board.

A note on third-party / opponent data. A game record you download naturally names both players and lists the moves both players made. If you analyze your own games, that record will include your opponents. If you look up another player's public username, the games you retrieve will include that player and their opponents. We keep this to a minimum and handle it honestly:

• This third-party game data is processed in your browser, so the app can display and analyze the game, and it is never stored on our servers or in our cloud database. If you switch on the optional Fast analysis setting (section 2(e)), the board positions from those games — exactly as with your own — are sent to our stateless analysis server to be evaluated, and are discarded as soon as the evaluation is returned.
• We do not build profiles of opponents, and opponent identities are never saved to our cloud database (see section (b)).

Analyzing publicly available games — including looking up another player's public games through a public API — is a deliberate design choice for a chess-study tool, and we believe it is a reasonable and expected use of information those services already publish. You are responsible for only requesting data you are entitled to look up. See our Terms of Service for more on acceptable use.

(b) Optional account data (stored with Supabase)

You can use the app without an account. Accounts are an optional feature (and may not be enabled in every version of the app). If you choose to create one in a version where Accounts is enabled, we use Supabase to provide sign-in and to store a small amount of data so your work can sync across your devices. The feature is designed to use row-level security so each authenticated account can access only its own eligible rows. The operator must keep Accounts disabled until the real database migrations and two-user isolation behavior have been verified; repository code alone does not prove an external database is configured correctly.

Verifying a linked handle. When you link a Chess.com or Lichess handle, you place a short verification code in your public profile (your Chess.com Location field or your Lichess Biography field). To confirm the handle is yours, our server requests that platform's public API to read your own public profile field and check that the code is present. Proof lasts 30 days. After it expires, handle-scoped analysis and library-coverage sync pause until you renew with a rotated code and another profile lookup; signed-in, account-global puzzle sync continues, and expiry does not itself delete retained cloud rows. Apart from the position-only Lichess opening-explorer requests described in section 2(a), these initial and renewal lookups are the server contacts with those platforms on your behalf. They read only your own public profile, not your games or any opponent data; game downloads still go browser-to-platform directly.

Two things we want to be explicit and honest about regarding the cloud store:

• We do not store your raw games, a PGN file, or your opponents, on our servers. The analysis records above are your engine's derived output. They do not contain a stored PGN file, and they do not store either player's username. The analysis does record the moves of the game in engine notation (SAN/UCI/FEN), because move-by-move evaluation is the whole point of the tool — but those moves are never tied to a name, and no opponent is identified. The original game files themselves stay in your browser and can be re-fetched from the source platform.
• The stored analyses are keyed to your own linked chess handle so they sync to the right library. Your own handle is therefore stored; your opponents' identities are not.

(c) Data stored locally in your browser

The primary copy of your data lives on your device, in your browser's IndexedDB and localStorage. This includes:

• your game libraries (the games your browser downloaded or that you imported),
• the computed analyses,
• your puzzle progress and app settings.

This local data is under your control. It stays on your device until you clear it (for example, by clearing your browser's site data), and we cannot read it remotely. If you never create an account, this local storage — plus the direct game downloads, position-only Lichess requests, ordinary hosting request logs, and operational events described below — is essentially all the data handling the app involves.

(d) Operational error events

When the app encounters a crash or a handled operational failure (for example, exhausted sync retries, browser-storage failure, or upstream outage), it can send a small first-party diagnostic event to our server. At the server trust boundary, event type, route, operation, cause, runtime category, subsystem, boundary, and error name are reconstructed from fixed allowlists; unrecognized values fall back to generic labels. The server discards client-supplied release identifiers, structured codes, fingerprints, messages, stacks, and free-form fields, then supplies its own timestamp, release identifier, and deduplication fingerprint. The resulting event is limited to those coarse labels plus an incident reference and, when valid, a framework digest. It does not include the error message or stack, URL query string, chess handle, email, game moves, PGN, board position, analysis payload, cookie, access token, or local-storage contents.

The server writes this event to structured hosting logs. If we configure an HTTPS error-event destination, the same bounded event is forwarded there so an operator can be alerted. Remote delivery uses fingerprint deduplication, a short timeout, and exponential circuit backoff after destination failures; runtime logs continue while the circuit is open. We must name that provider and its retention/transfer terms in this policy before enabling it for a public environment. Browser delivery is best-effort and an incident reference is not proof that a remote destination accepted the event.

(e) Optional "Fast analysis" service

Analyzing a game in your browser can take a few minutes on a slower device. Fast analysis is an optional setting that shares the work with an analysis server we operate, so a game finishes in around ten seconds instead. It is switched off by default — nothing is sent to the analysis server unless you turn it on in Settings.

What is sent. Only board positions (FEN strings: the arrangement of the pieces, whose turn it is, castling and en-passant rights, and the move counters) from the games you are analyzing, together with the engine search settings. This includes positions from games you look at that are not your own, since those are analyzed the same way.

What is not sent.* We do not send your chess handle, your email, your account identifier, the game's players or result, the PGN, any cookie, or any local-storage contents. A board position on its own does not identify you.

Where it goes and how long it is kept. The service runs on Google Cloud Run in the United States (region us-east1). It is stateless: positions exist only in memory for the seconds it takes to evaluate them, are returned to your browser, and are then gone. Nothing is written to disk and nothing is stored or logged with the position data. We keep only coarse operational logs (request counts, durations, error counts) with no board positions in them. Google acts as our hosting subprocessor — see section 5.

Your control. Turn the setting off at any time in Settings and analysis returns entirely to your device. If the service is unreachable, the app falls back to analyzing on your device automatically, so the setting never blocks you from using the app. Results are identical either way — the server runs the same engine at the same depth.

3. Our legal bases (for EU / UK users)

If you are in the European Economic Area or the United Kingdom, the GDPR / UK GDPR requires us to have a lawful basis for each purpose. Here is ours, in plain terms:

• To provide the account and cloud-sync features you sign up for — performance of a contract (GDPR Article 6(1)(b)). When you create an account, we process your email, password, profile, linked handle, analyses, library state, and puzzle progress to deliver the service you asked for.
• Recording the account agreement and minimum-age attestation — performance of the account contract (Article 6(1)(b)) and our legitimate interests (Article 6(1)(f)) in documenting the terms accepted and whether the stated eligibility condition was met. This is not a request for blanket consent to unrelated processing.
• Analyzing your own games and running the core study tools — our and your legitimate interests (Article 6(1)(f)) in providing and improving a functional chess-improvement tool, balanced against your rights. Because analysis runs in your browser and most data never leaves your device, the privacy impact is low.
• Verifying that a linked handle is yours — legitimate interests in preventing misuse and keeping optional cloud sync tied to a platform identity you control. This includes the initial and periodic 30-day renewal requests to the platform's public API to read your own public profile field (section 2(b)).
• Detecting and responding to operational failures and abuse — our legitimate interests in securing and maintaining the Service. We minimize these events as described in section 2(d) and do not use them for advertising or behavioral analytics.

An honest note on looking up a third party's public games. When you look up another player's public games through a public API, we rely on legitimate interests (Article 6(1)(f)) for the transient, in-browser handling needed to display and study those games. This is an accepted design choice for a study tool that reads only already-public information, does not store that third party's data on our servers, and does not build profiles of them. You remain responsible for only requesting data you are entitled to access.

We do not use your data for advertising, and we do not carry out automated decision-making that produces legal or similarly significant effects about you.

4. No AI providers — the coach is deterministic

The app's coaching and feedback are produced by a deterministic, rules-and-templates engine. There is no AI/LLM service involved, and none of your data is ever sent to any third-party AI provider. The chess analysis itself is computed by the Stockfish engine in your browser. Your games and analyses are not transmitted to any outside service for the purpose of generating coaching.

5. Who else is involved (subprocessors and other recipients)

We keep third parties to a minimum. We do not use advertising networks, product analytics, cross-site trackers, or Google Analytics. We do not sell or rent your personal data (see section 10). Operational diagnostics are limited to the events described in section 2(d), not product-behavior tracking.

The parties involved in running the service are:

• Supabase — our authentication, database, and hosting provider for account data. If you create an account, Supabase processes and stores the account data described in section 2(b) on our behalf, under our instructions.
• Our hosting provider — a web-hosting/CDN provider that serves the app's files and runs our thin server components (including the position-only Lichess proxy and initial/renewal handle-verification lookups). It handles standard technical request data (such as IP addresses in server logs) needed to deliver and secure the site.
• An optional operational-event destination — if configured, receives only the privacy-bounded fields listed in section 2(d). We will name the provider and applicable retention/transfer terms here before enabling that destination for a public environment. Runtime hosting logs remain the default when no destination is configured.
• Google Cloud (Cloud Run, United States) — hosts the optional Fast analysis service described in section 2(e). If you switch that setting on, it receives only board positions (FEN) and engine settings, with no personal data, holds them in memory for the seconds needed to evaluate them, and stores nothing. If the setting is off, Google receives nothing from this feature.
• Lichess — receives only board positions (FEN), with no personal data, for the opening-explorer feature. Separately, when you link or renew a Lichess handle, our server reads your own public Lichess profile to confirm your verification code (section 2(b)).
• Chess.com — a data source for your games contacted directly by your own browser, not by our servers, when you download your games. The exception is handle proof: when you link or renew a Chess.com handle, our server reads your own public Chess.com profile to confirm your verification code (section 2(b)). We do not send Chess.com private account or game data.

6. International data transfers

We are based in the United States, and our hosting provider may process ordinary request and operational-log data in the United States. The repository does not establish a live Supabase project's region. Before Accounts is enabled, we will select and disclose the actual account-data region here; we will not infer it from a setup recommendation. Any configured operational-event destination must likewise be disclosed before public use.

Where such transfers require a safeguard under the GDPR / UK GDPR, we will not enable the relevant optional account or diagnostic provider until the applicable mechanism has been confirmed and documented — for example, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and/or a relevant adequacy determination.

7. EU / UK representative (Article 27) — status

We currently have no establishment in the EU or the UK. Under GDPR / UK GDPR Article 27, a controller with no EU/UK establishment that offers services to people there generally must appoint a representative in each region, unless a narrow exemption for occasional, low-risk processing applies.

We have not yet appointed an EU or UK representative. The Service is operated from the United States and is not currently marketed to or targeted at the EU or UK. If and when we begin actively offering accounts to users in the EU or UK, we will appoint the required representatives and name them here. In the meantime, users in the EU or UK can raise any data-protection matter with us directly at joshuadseiler@gmail.com, and always retain the right to contact their supervisory authority (section 12).

8. Cookies and local storage

We do not use advertising cookies, analytics cookies, or any cross-site tracking. We do not follow you around the web.

The only browser storage we use is:

• A Supabase authentication session token — stored in your browser's localStorage when you are signed in, so you stay logged in. It exists only for signed-in users.
• A first-party, HttpOnly cookie (`coach_sid`) — strictly functional. It is set only by the opening-explorer ("how masters played here") lookups that reach our server, so we can apply fair-use rate limits and protect that endpoint from abuse. It is not set by the in-browser analysis or coaching (those never contact us), and it is not used to track you across other sites.

We also use IndexedDB and localStorage as described in section 2(c) to store your games, analyses, and progress on your own device.

9. How long we keep data

• Account data (Supabase): There is currently no general time-based deletion schedule. Only the release registered by the database may be written. Once a registered-version analysis write is accepted, stale versions for that exact platform/game are removed; older versions for games that are not rewritten can remain and are ignored by product restore. Analysis storage is bounded to 2 MiB of uncompressed UTF-8 JSON text per row, 500 rows, and 20 MiB per account; rejected writes do not create a retention schedule. We otherwise keep account data until you unlink the applicable handle or delete your account. Account deletion cascades and removes your associated rows (profile, linked handles, analyses, library coverage, puzzle progress, and signup acceptance evidence). We do not retain a separate copy after that, other than anything we are required to keep by law or that persists briefly in routine backups before rotating out.
• Unlinked handle data: Unlinking a chess handle deletes the cloud analyses and library-state rows attached to that handle. It does not delete the Supabase Auth account, profile, or account-global puzzle progress; account deletion removes those remaining rows.
• Local data (your browser): Data stored on your device stays there until you clear it — for example, by using the app's controls, clearing your browser's site data, or deleting the browser profile. It is under your control.
• Operational events and request logs: The app has no separate operational-event database or in-app retention job. Hosting-log retention follows the hosting account's configured policy. An optional error-event destination must not be enabled publicly until its provider and retention period are recorded in this policy.

If we adopt a fixed retention period in the future, we will describe it here.

10. We do not sell or share your data

We do not sell your personal data, and we do not share it for cross-context behavioral advertising. We run no ads, no analytics, and no third-party trackers. The only parties that ever handle your data are the service providers listed in section 5, and only to make the app work.

11. Your rights and how to use them

Depending on where you live, you may have some or all of the following rights over your personal data: access, rectification (correction), erasure (deletion), restriction of processing, data portability, objection to processing, and withdrawal of consent. You also have the right to lodge a complaint with a data-protection authority (see section 12).

Because the app is local-first, it helps to know which data these rights attach to for us:

• Data in your browser (local): You control this directly. You can view and remove it through the app's controls and your browser's settings, without needing to contact us — we cannot access it remotely.
• Account data in our Supabase cloud store: This is the data we hold and control, so our access/export/deletion duties apply to it.

Self-service tools (for account holders). From your account page you can:

• Export your account data. After our server revalidates your current sign-in token, the export combines the derived Supabase Auth subject fields (ID; email/phone if present; account, confirmation, and sign-in timestamps; anonymous status; provider/app/user metadata; and identities) with one database snapshot of your public-table profile, signup acceptance evidence, linked chess handles, every retained analysis version, library coverage, and puzzle progress. It also includes handle-scoped rows retained but hidden from normal product sync after proof expiry. The database snapshot function is available only to the service role and obtains all public-table sections in one MVCC snapshot; the separately fetched Auth subject is derived from the validated token rather than request content. The export never includes your readable password or password verifier. If you believe anything we hold is missing, email us using the contact below.
• Delete your account. Deletion removes your account and cascades to delete your associated data rows as described in section 9.

By email. For any right you can't fully exercise in the app — including rectification, objection, restriction, withdrawing consent, or a complete copy in a different usable form — email joshuadseiler@gmail.com. We will respond within the timeframe required by applicable law. We may need to verify your identity (for example, by confirming control of the account email) before acting, to protect your data.

12. Complaints

If you are in the EU or the UK and believe we have mishandled your personal data, you have the right to complain to a supervisory authority. In the UK, that is the Information Commissioner's Office (ICO). In the EU, it is the data-protection authority in your country of residence, work, or where the issue arose. We'd appreciate the chance to address your concern first — please email us — but you are not required to contact us before complaining to an authority.

13. Security and data breaches

We take reasonable technical and organizational measures to protect your data, including encryption in transit (HTTPS), hashed passwords, keeping raw game files, PGN, and opponent identities off our servers by design, and a row-level-security schema for optional Accounts. Accounts must remain disabled until those policies and migrations are verified against the real database; we do not treat checked-in SQL as proof that an external environment is secure. Supabase, when enabled as our authentication and database provider, maintains its own security controls.

No online service can promise perfect security, and we do not claim your data is 100% secure. If a personal-data breach occurs that is likely to affect you, we will act on our legal obligations — including, where the GDPR / UK GDPR applies, notifying the relevant supervisory authority without undue delay and, where feasible, within 72 hours, and notifying affected users where the law requires it.

14. Children

The app is a general-audience service and is not directed to children. You must be at least 13 years old to use it. If you are under the age of majority where you live, you may use it only with the involvement and consent of a parent or guardian.

If you are in the EU or the UK, please note that in some countries users under 16 need a parent or guardian's consent for online services; where that applies, please only use the app with that consent.

We do not knowingly collect personal data from children under 13. If we learn that we have collected personal data from a child under 13 without the required consent, we will delete it promptly. If you believe a child under 13 has provided us personal data, please email joshuadseiler@gmail.com.

Sign-up requires accepting the Terms of Service and this Privacy Policy, and the Terms include the minimum-age requirement above — accepting them represents that you meet it. For an account, we store that acceptance boolean together with the accepted policy versions and a server-recorded time. We do not ask for, store, or verify your date of birth or exact age.

15. United States privacy notes (California and other states)

We are a small independent operator. We do not sell or share your personal data, and we run no advertising, analytics, or trackers.

We are below the size and activity thresholds at which laws like the California Consumer Privacy Act (CCPA/CPRA) and the Florida Digital Bill of Rights impose their business obligations, so those specific statutory frameworks do not currently apply to us. We are not claiming to be a "business" under those laws, and we are not adopting their formal request procedures here. That said, the rights and self-service tools in section 11 are available to all users regardless of where you live, and our commitment in section 10 (no sale, no sharing, no trackers) applies to everyone.

16. Changes to this policy

We may update this policy from time to time — for example, when we appoint an EU/UK representative, launch a paid tier, or change how the app works. When we do, we will revise the Effective date at the top. For material changes, we will take reasonable steps to make the change more visible (such as an in-app notice or, for account holders, an email). Your continued use of the app after an update means you accept the revised policy, to the extent permitted by law.

17. Contact

Questions, requests, or concerns about this policy or your data:

Email: joshuadseiler@gmail.com

Version 1.1 — published July 13, 2026.