Effective date: 30 September 2026
This notice is given under article 10 of Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. The Turkish version, KVKK Aydınlatma Metni, prevails in case of any difference.
1. Data controller
Data controller: Hasan Süzen (an individual)
Email: [email protected]
2. Categories of personal data
| Category | Data |
|---|---|
| Identity | Name (the display name on your Google account), profile picture link |
| Contact | Email address |
| Customer transactions | Studied variations and review schedule, favourite openings, quiz results and quiz answers, usage events (when an account was created, a variation studied, a quiz finished, a game report asked for and received, interest in Premium given), email language and reminder setting, Premium period, when the free report was used and when interest in Premium was given |
| Chess account and game data | lichess and Chess.com usernames; in game reports, the date, time control, rated status, result, link, opening played, and the move and position where the theory was left of public games; in a report on one’s own games, opponents’ usernames and ratings; in opponent prep, the target player’s username and the ratings of the players they met; a name given to a report |
| Transaction security | Google account identifier, email verification status, session key, IP address (in session records and in request counters kept for a few minutes), browser and device information, session and last-use times, administrative action records, admin notes and suspension reason |
| Analytics | Only with your explicit consent: online identifiers and page-view information |
3. Purposes
- Running membership and verifying your identity,
- Providing the Service: keeping and showing your progress, favourites, quizzes and mistake analysis,
- Making the game reports and opponent prep you ask for, for which public games are fetched from lichess and Chess.com,
- Managing Premium access, the free report and the daily report limit,
- Sending welcome, review reminder and account-closure emails (no commercial electronic messages are sent),
- Information security and abuse prevention,
- Aggregate statistics to improve the Service,
- Handling requests and complaints, legal proceedings and information requests from authorities,
- With your explicit consent, measuring use of the site.
4. Legal bases and method of collection
Your personal data is collected electronically and by automated means: from Google when you sign in with Google, from you and your browser when you use the Service, and, for game reports, from the public interfaces (APIs) of lichess and Chess.com. It is processed on the following grounds in article 5(2) of the KVKK:
- (c) it is directly necessary for concluding or performing a contract: membership and learning records, the game reports you ask for, your chess usernames and your Premium details,
- (ç) it is necessary for the controller to meet a legal obligation: requests from authorities,
- (d) it has been made public by the person concerned: the usernames, ratings and game details published for anyone to see on lichess and Chess.com that appear in game reports and opponent prep,
- (e) it is necessary to establish, exercise or protect a right: correspondence and administrative records,
- (f) it is necessary for the controller’s legitimate interests, provided your fundamental rights are not harmed: security records and request counters, usage events and aggregate statistics, review reminder emails, and processing other players’ public data in game reports for chess preparation, as little as needed.
Data processed through analytics cookies is processed only on the basis of your explicit consent under article 5(1) of the KVKK. Not giving consent does not stop you from using the Service.
5. Transfers
Limited to the purposes above, your data may be transferred to Google LLC (USA) for Sign in with Google, to Resend, Inc. (USA) for email delivery, to Cloudflare, Inc. (USA), through which the site’s traffic passes and where blog images are stored, to the provider hosting our servers and database, to Lichess (France) or Chess.com, LLC (USA), limited to the username typed for a game report, to the measurement provider (Google LLC) if you consented, and to competent public authorities where the law requires. Some of these providers’ servers are outside Turkey, so transfers rely on the conditions in article 9 of the KVKK, in particular appropriate safeguards such as the standard contracts published by the Board.
6. Retention
Data is kept for as long as its purpose requires: membership and learning records while your account is open; game reports, at most the latest 10 per account and at most 90 days each (you can delete them sooner); request counters holding IP addresses for a few minutes; expired session records for 30 days; usage events and administrative records for 2 years; correspondence for up to 2 years after the request is resolved; analytics data in the measurement service for up to 14 months. When your account is deleted, your learning records and usage events are deleted at once, and your personal details are removed from administrative records. These periods are applied by a clean-up job that runs every night. Data past its retention period is deleted, destroyed or anonymised.
7. Players whose games are analysed
At a user’s request, the public username, rating and opening details of the games of people whose games are published for anyone to see on lichess and Chess.com (the target player in opponent prep, and opponents in game reports) are processed only for chess preparation and for at most 90 days. These people can exercise the rights below, and ask for reports about them to be deleted, even without a TheoryChess account.
8. Your rights under article 11 of the KVKK
By applying to the data controller you may:
- learn whether your personal data is processed,
- request information if it is,
- learn the purpose of processing and whether it is used accordingly,
- know the third parties in Turkey or abroad to whom it is transferred,
- request correction if it is incomplete or inaccurate,
- request its deletion or destruction under the conditions in article 7 of the KVKK,
- request that actions under (e) and (f) be notified to third parties it was transferred to,
- object to a result against you produced solely by automated analysis of the data,
- claim compensation if you suffer damage from unlawful processing.
9. How to apply
To download a copy of your data or delete your account, use the account settings page once signed in; these need no application and take effect at once. For any other request, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, your application should include your name and surname, your Turkish ID number (or, for foreign nationals, nationality and passport number), a postal or email address for the reply and your request. Send it to [email protected]:
- from the email address registered to your TheoryChess account (without an account, with details showing the request comes from you), or
- signed with a secure electronic signature or mobile signature.
Your application is resolved free of charge within 30 days at the latest; if the request involves an additional cost, the fee set by the Personal Data Protection Board may be charged. If your application is refused, the answer is insufficient or no answer is given in time, you may complain to the Personal Data Protection Board.