KVKK Privacy Notice

Effective date: 1 October 2026
Last updated: 12 November 2026

This notice is given under article 10 of Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. The Turkish version, KVKK Aydınlatma Metni, prevails in case of any difference.

1. Data controller

Data controller: Hasan Süzen (an individual)
Email: [email protected]

2. Categories of personal data

3. Purposes

• Running membership and verifying your identity,
• Providing the Service: keeping and showing your progress, favourites, quizzes and mistake analysis,
• Running the coach system: reviewing coach applications, linking students to their coach through private invite links, showing a student’s opening study and when they were last on the site to the coach or coaches they are linked to, coaches giving their linked students assignments, coaches making their own openings and having their students study them through those assignments, and assignments being completed on their own from the student’s study, handling password resets for accounts made with a username with the approval of the coach or an admin, and showing the “Coach” and “Works with a coach” marks on the leaderboards,
• Making the game reports and opponent prep you ask for, for which public games are fetched from lichess and Chess.com,
• Managing Premium access, the free report and the daily report limit,
• Sending welcome, review reminder and account-closure emails (account holders are sent no commercial electronic messages),
• Introducing the coach system to chess clubs, schools and similar organisations with introduction emails an administrator writes one at a time, each with a refusal link, and never writing again to addresses that refused (details in section 8),
• Information security and abuse prevention,
• Aggregate statistics to improve the Service, including measuring how the site is used without cookies and without recognising anyone (visit counts, sources, countries, actions taken) and recording which source new accounts came from,
• Reviewing ideas and bug reports sent with the feedback form, and answering them if you wish,
• Handling requests and complaints, legal proceedings and information requests from authorities,
• With your explicit consent, measuring use of the site and how many new accounts our ads bring.

4. Legal bases and method of collection

Your personal data is collected electronically and by automated means: from Google when you sign in with Google, from you and your browser when you use the Service, from the coach you are linked to in the coach system (the label they give you, the assignments they give you, the notes they write on them, the openings they make, and their approval of a password reset), for game reports, from the public interfaces (APIs) of lichess and Chess.com; and the details of organisations and people sent introduction emails are collected by hand by an administrator, from the organisations’ public websites, from emails they sent us or from the person who introduced us. It is processed on the following grounds in article 5(2) of the KVKK:

• (c) it is directly necessary for concluding or performing a contract: membership and learning records, accounts made with a username, coach applications, invite links and coach–student links, showing a student’s opening study to the coach they are linked to, assignments and their notes, coaches’ own openings, the coach marks on the leaderboards, password-reset requests, the game reports you ask for, your chess usernames and your Premium details,
• (ç) it is necessary for the controller to meet a legal obligation: requests from authorities,
• (d) it has been made public by the person concerned: the usernames, ratings and game details published for anyone to see on lichess and Chess.com that appear in game reports and opponent prep; the corporate contact details that organisations we send introduction emails to publish on their own websites for anyone to see,
• (e) it is necessary to establish, exercise or protect a right: correspondence and administrative records,
• (f) it is necessary for the controller’s legitimate interests, provided your fundamental rights are not harmed: security records and request counters, usage events and aggregate statistics, cookieless visit statistics and the source an account came from, feedback messages, review reminder emails, introduction emails and the block list of addresses that refused, and processing other players’ public data in game reports for chess preparation, as little as needed.

Data processed through analytics cookies is processed only on the basis of your explicit consent under article 5(1) of the KVKK. Not giving consent does not stop you from using the Service.

Accounts made with a username mostly belong to students under 18. They can only be made through an invite link a coach sends to that one student, and at sign-up the student is asked to confirm that their parent or guardian has agreed. The time of this confirmation is recorded with the account, deleted with it and included in its data export. These accounts are not asked for an email address and are never sent any email.

5. Transfers

Limited to the purposes above, your data may be transferred to Google LLC (USA) for Sign in with Google, to Resend, Inc. (USA) for email delivery, to Cloudflare, Inc. (USA), through which the site’s traffic passes and where blog images are stored, to the provider hosting our servers and database, to Lichess (France) or Chess.com, LLC (USA), limited to the username typed for a game report, to the measurement provider (Google LLC) if you consented, and to competent public authorities where the law requires. Some of these providers’ servers are outside Turkey, so transfers rely on the conditions in article 9 of the KVKK, in particular appropriate safeguards such as the standard contracts published by the Board.

If you accepted a coach’s invite, the following is shown only to the coach or coaches you are linked to, on the site: your display name and profile picture, whether it is an account made with a username, the label the coach gave you, the date you linked, when and on which day you were last on the site, your study of the catalogue openings and of that coach’s own openings (including what you studied before you linked; the openings and variations you studied, your mistakes, your review schedule, your quiz results per opening, the positions you answered wrongly most often in quizzes over the last 90 days, the days you were on the site in the last 30 days, how many times you played a variation to the end in the last 7 days), and the assignments that coach gave you, your progress on them and how many of that coach’s assignments you have open and done. Your email address, game reports and opponent prep are never shown to a coach. If you are linked to several coaches, each sees your study of the catalogue openings, your study of their own openings and the assignments and notes they themselves gave you, never another coach’s openings, your study of them, or that coach’s assignments or notes. Quizzes you took for another coach’s assignment of a catalogue opening appear, like your other quizzes, in your quiz results per opening and the positions you answered wrongly, without saying which coach it was for. If a coach assigned you an opening they made themselves, its name, moves and line names are seen only by that coach and the students the coach assigned it to, and by no one else unless a complaint has to be reviewed (students do not see the coach’s notes on moves along the way; a note on the last move of a line becomes that line’s name, which students see, and the same goes for a note on a move that later becomes the last move of a line); it is shown to you for as long as the assignment is active, you are still linked to the coach and the coach’s coaching is approved, and it is never shown publicly in the catalogue, in search or in sharing. The assignments your coach gives you and their notes are shown to you with the coach’s display name and profile picture; if a coach’s coaching is suspended, their assignments of catalogue openings stay in your list, their own openings and the assignments of them leave it until the coach is restored, and their notes are not shown to you while the suspension lasts. Apart from you, only the coach who gave an assignment sees it and its note; TheoryChess may see assignments and notes only when looking into a complaint or carrying out a data request. Under the Coach Terms, coaches must use this only to work with you on TheoryChess. When you ask for a password reset, your username is shown to the approved coaches you are linked to (each of them, if you have several; if you have no approved coach, to the admins); the check code is not shown to them, only on your own screen, and whoever approves learns it from you and types it in. Your password is never shown to anyone. The display name, profile picture and club of coaches are shown to their students and to anyone who opens their invite link. A parent or guardian who works with their own child and whose application is approved also counts as a coach in this notice. If you appear on the leaderboards, a “Coach” mark if you are an approved coach, or a “Works with a coach” mark if you are linked to an approved coach, is shown publicly beside your name; which coach you work with is never shown anywhere public. Accounts made with a username start hidden on the leaderboards. If you do not want to appear there, you can hide yourself in your account settings.

6. Retention

Data is kept for as long as its purpose requires: membership and learning records while your account is open; game reports, at most the latest 10 per account and at most 90 days each (you can delete them sooner); request counters holding IP addresses for a few minutes; expired session records for 30 days; usage events, days on the site and administrative records for 2 years; feedback messages for 2 years; cookieless visit records for 90 days (the daily totals made from them, which cannot be linked to anyone, are kept), the daily secret key used to count visitors for at most 2 days; the source an account came from while the account is open; coach applications while the applicant’s account is open, rejected ones until 180 days after the decision (together with any invite links and student links tied to that application); invite links, used or not, until 90 days after they expire (14 days after they are made); a coach–student link until the student leaves the coach, the coach removes the student or either account is deleted (when the student who used an invite link deletes their account, the coach’s label on that link record is cleared at once); password-reset requests until 7 days after they expire (24 hours after they are made); the count of failed username sign-ins until 15 minutes after the first failure (used to protect sign-in); username accounts left behind by an invite sign-up that was not finished, which are linked to no coach and have no study and no days on the site, until the first nightly clean-up at least 1 hour after they were made (this clean-up covers an account’s first 7 days); coaches’ own openings until the coach deletes them or the coach’s account is deleted (when an opening is deleted, its assignments are archived, and students’ study records on it stay in the database but are no longer shown); assignments until the student’s or the coach’s account is deleted, but when the coach deletes an assignment or the coach–student link ends, the assignment is archived with its note, is no longer shown to the student or the coach and is deleted 90 days after it was archived (when an assignment is deleted, the results of quizzes taken for it stay in the student’s learning records and are only unlinked from it); correspondence for up to 2 years after the request is resolved; the records of organisations and people sent introduction emails, and the emails sent, for at most 2 years after the last email, while addresses that refused stay on the block list for good so that we never write to them again (only the email address, the date of the refusal and how it was made); analytics data in the measurement service for up to 14 months. When your account is deleted, your learning records, usage events, days on the site, coach links, the assignments given to you and your password-reset requests, and, if you are a coach, your coach application, the invite links you made, your links to your students, the openings you made and the assignments you gave are deleted at once; an invite link you accepted as a student is unlinked from your account, and your personal details are removed from administrative records, and your feedback messages are unlinked from your account. These periods are applied by a clean-up job that runs every night. Data past its retention period is deleted, destroyed or anonymised.

7. Players whose games are analysed

At a user’s request, the public username, rating and opening details of the games of people whose games are published for anyone to see on lichess and Chess.com (the target player in opponent prep, and opponents in game reports) are processed only for chess preparation and for at most 90 days. These people can exercise the rights below, and ask for reports about them to be deleted, even without a TheoryChess account.

8. Organisations and people we send introduction emails to

To introduce the coach system (Coach Beta), TheoryChess may send introduction emails to chess clubs, schools, academies and courses, and later to chess content creators. These emails are never sent in bulk: an administrator writes, reviews and sends each one by hand, and the number sent per day is limited. We only write to the corporate contact address an organisation publishes on its own website for anyone to see, to an address that wrote to us first, or to an address we were introduced to through someone we know. Data from site accounts is not used for this.

Data processed: the name of the organisation or person, the email address, its kind (club, school, academy, course, content creator and so on), city, website and phone number; why we wrote to the address and, if it came from a website, the link to the page it was taken from; the administrator’s own note; whether a reply came or the email bounced; and for each email sent, its subject, text, time sent, status and its ID at the email service. Opens and clicks are not tracked. This data is used only to introduce TheoryChess and to carry on the correspondence, is never sold and never shared with anyone else; the emails are sent through Resend, Inc. (USA).

Legal basis: for corporate contact details published for anyone to see, that the person concerned made them public and our legitimate interests (KVKK art. 5(2)(d) and 5(2)(f)); for people who wrote to us first or whom we were introduced to, our legitimate interests (KVKK art. 5(2)(f)).

Every email ends with the sender’s name, a contact address, why we wrote to this address and a free refusal link that needs no sign-in. Opening the link and confirming, pressing your mail app’s “unsubscribe” button, or replying to say you do not want these emails is enough (a refusal sent by reply is entered by an administrator): your address goes on a permanent block list and the system never sends it another introduction email; the block cannot be lifted from the admin panel either.

Retention: the record of the organisation or person and the emails sent are kept for at most 2 years after the last email; sending, cancelling and blocking are kept in the administrative records for 2 years. Addresses that refused are kept on the block list for good, so that we never write to them again; the list holds only the email address, the date of the refusal and how it was made. Even without a TheoryChess account you can exercise the rights below and ask for your records to be deleted by writing to [email protected]; everything except the address on the block list is then deleted.

9. Your rights under article 11 of the KVKK

By applying to the data controller you may:

1. learn whether your personal data is processed,
2. request information if it is,
3. learn the purpose of processing and whether it is used accordingly,
4. know the third parties in Turkey or abroad to whom it is transferred,
5. request correction if it is incomplete or inaccurate,
6. request its deletion or destruction under the conditions in article 7 of the KVKK,
7. request that actions under (e) and (f) be notified to third parties it was transferred to,
8. object to a result against you produced solely by automated analysis of the data,
9. claim compensation if you suffer damage from unlawful processing.

10. How to apply

To download a copy of your data or delete your account, use the account settings page once signed in; these need no application and take effect at once. For any other request, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, your application should include your name and surname, your Turkish ID number (or, for foreign nationals, nationality and passport number), a postal or email address for the reply and your request. Send it to [email protected]:

• from the email address registered to your TheoryChess account (without an account, or if your account was made with a username, with your username and details showing the request comes from you; a parent or guardian may also apply on behalf of someone under 18), or
• signed with a secure electronic signature or mobile signature.

Your application is resolved free of charge within 30 days at the latest; if the request involves an additional cost, the fee set by the Personal Data Protection Board may be charged. If your application is refused, the answer is insufficient or no answer is given in time, you may complain to the Personal Data Protection Board.