Privacy Policy | TheoryChess

Effective date: 30 September 2026

This policy explains how your personal data is processed when you use the TheoryChess website and service (the “Service”). For the detailed notice required by Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), see the KVKK Privacy Notice; for cookies, see the Cookie Policy.

Data controller

Your personal data is processed by Hasan Süzen, an individual, as data controller. Contact: [email protected].

Data we process

When you create an account

When you sign in with Google, Google sends us the following, which is stored with your account:

Identity and contact: the name, email address and profile picture link on your Google account.
Account data: your Google account identifier, whether Google has verified your email address, when the account was created and the account’s role. The access and ID tokens Google issues during sign-in are not kept.

When you use the Service

Learning records: the variations you studied and their review schedule, your favourite openings, your quiz results and the move you gave for each quiz question.
Session and security records: the session key, the IP address and browser/device information (user agent) of the session, when the session started and expires, and when the account was last used. To prevent abuse, your IP address is also held for a few minutes in a counter of requests.
Usage events: when you created your account, studied a variation, finished a quiz, asked for and received a game report, and said you were interested in Premium (with the opening, variation, site and kind of report, and the mistakes or score). They are kept in our own database to measure whether the Service works for people and to apply the daily report limit; no cookie is used and they are not shared with third parties.
Your chess accounts: the lichess and Chess.com usernames you type for a game report or add in your account settings. A username is saved to your account, spelled as that site spells it, once its report has been made; you can change or remove it in your settings.
Game reports: when you ask for a report, the latest public games (up to 20) of the username you give are fetched from the public interfaces (APIs) of lichess or Chess.com and compared with opening theory. The report keeps, for each game, its date, time control, whether it was rated, its result, its link, the opening played, and the move and position where the theory was left; a report on your own games also holds your opponents’ usernames and ratings. Whole games (all the moves) are not kept. A name you give the report is kept too.
Opponent prep: when you type another player’s username, that player’s public games are processed the same way. This report does not keep the usernames of the people that player met, only their ratings. Information for the people whose games are analysed is under “Players whose games are analysed” below.
Premium details: your Premium period (if one was given), when you used your free report, and when you said you were interested in Premium, if you did.
Email settings: the language of your emails, whether review reminders are on, and when the last reminder was sent.
Administrative records: notes admins keep about your account, the reason for a suspension if there was one, and a record of administrative actions on your account (which may include your email address).
Preferences: language, board theme, sound, move commentary, hint and engine-suggestion settings. These are not stored on our servers; they are kept as cookies in your browser.
Correspondence: your message and email address if you email us.
Analytics (only with your consent): if a measurement tool is enabled and you accept it in the cookie notice, the pages you visit and online identifiers assigned to your browser.

Data we do not process

We do not process payment data, national ID numbers, precise location or any special category of personal data. We never ask for the password or login of your lichess or Chess.com account; only public usernames and games are used. The chess engine runs in your browser; moves you play while signed out are never sent to our servers. The list of variations you finish while signed out (variation, number of mistakes and date) is kept only in your browser, and is moved into your account when you sign in so that your progress is not lost.

Why we use it

To create your account, recognise you and keep you signed in.
To show you your progress, favourites, quiz scores and mistake analysis, and to remind you of lines that are due for review, on the site and (unless you turn it off) by at most one email a day.
To make game reports and opponent prep: fetching public games from lichess and Chess.com, comparing them with the theory and showing you the report.
To manage Premium access: the beta, the free report, the daily report limit and Premium periods given by an admin.
To send the emails your account needs: a welcome email, and a confirmation when you close your account.
To keep the Service secure, prevent abuse and suspend accounts that break the rules.
To improve the Service using aggregate statistics (for example, which openings are studied most, and how many new accounts come back).
To answer your questions and requests, meet legal obligations and protect our rights in a dispute.

Your data is never sold and never used to build advertising profiles. We send no commercial electronic messages (email, SMS or the like with advertising, offers or promotion); the only emails we send are the service messages listed above. Saying you are interested in Premium does not mean you will be emailed; news about Premium is announced on the site only.

Legal bases

Performance of a contract (KVKK art. 5(2)(c); GDPR art. 6(1)(b)): account, session and learning records; the game reports you ask for, your chess usernames and your Premium details.
Data made public by the person, and legitimate interests (KVKK art. 5(2)(d) and 5(2)(f); GDPR art. 6(1)(f)): the usernames, ratings and game details of other players in opponent prep and in your own game report, which lichess and Chess.com publish for anyone to see. They are processed only for chess preparation, as little as needed and for a limited time.
Legitimate interests (KVKK art. 5(2)(f); GDPR art. 6(1)(f)): security records, request counters and abuse prevention, usage events and aggregate statistics, review reminder emails.
Establishing, exercising or defending a right (KVKK art. 5(2)(e)): records of administrative actions and correspondence.
Legal obligation (KVKK art. 5(2)(ç); GDPR art. 6(1)(c)): lawful requests from competent authorities.
Consent (KVKK art. 5(1); GDPR art. 6(1)(a)): analytics cookies. You can withdraw consent at any time from the “Cookie preferences” link at the bottom of every page.

Google: to provide Sign in with Google. Google is a separate controller for its own processing; see the Google Privacy Policy.
Email delivery: Resend, Inc. (USA). Your name, email address and the content of the email are passed on to send welcome, reminder and account-closure emails.
Infrastructure providers: the provider hosting our servers and database, and Cloudflare, Inc. (USA). All traffic to the site passes through Cloudflare for security, speed and content delivery, which means Cloudflare processes your IP address and request details; blog images are also stored at Cloudflare (R2). These providers process data only on our behalf and on our instructions.
lichess and Chess.com: when you ask for a game report or opponent prep, the username you type is sent to the public interface of lichess.org (Lichess, France) or Chess.com (Chess.com, LLC, USA) to get the public games. Your name, email or any other detail of your TheoryChess account is never sent to them.
Measurement services: Google Analytics / Google Tag Manager, only if enabled and only with your consent.
Competent authorities: where the law requires it, limited to what is requested.

The admins who run the Service may export the list of accounts (CSV) or one account’s data for support and security; every export is written to the audit log.

International transfers

Sign in with Google and measurement services (Google LLC, USA), email delivery (Resend, Inc., USA), content delivery and security (Cloudflare, Inc., USA) and some infrastructure services may run on servers outside Turkey and outside your country; for game reports, usernames are sent to lichess (France) or Chess.com (USA). These transfers rely on the conditions in article 9 of the KVKK, in particular appropriate safeguards such as the standard contracts published by the Turkish Personal Data Protection Board, and, for EEA users, on the safeguards required by Chapter V of the GDPR.

How long we keep it

Account and learning records: for as long as your account is open. When you close your account yourself in your account settings it is deleted at once; when you ask by email, within 30 days of your request.
Sessions: a session expires after 7 days without use; using it renews it. The record of an expired session (with its IP address and browser information) is deleted 30 days later.
Usage events: 2 years; deleted at once when your account is deleted.
Game reports: at most the latest 10 reports per account, each for at most 90 days; older ones are deleted on their own. You can delete a report from the My games page at any time; all your reports are deleted at once when your account is.
Chess usernames and Premium details: until you change or remove them, or while your account is open. Withdrawing your interest in Premium deletes that record.
Request counters: counters holding your IP address expire on their own within a few minutes.
Administrative records: a record of administrative actions on accounts (such as a suspension) is kept for 2 years to keep the Service secure. When your account is deleted, personal details such as your email address and any suspension reason are removed from these records at once.
Correspondence: up to 2 years after your request is resolved.
Analytics data: up to 14 months in the measurement service.

Where the law requires a longer period, or while a dispute is ongoing, data may be kept for that period. Data past its retention period is deleted or anonymised.

Players whose games are analysed

At a user’s request, TheoryChess analyses chess games published for anyone to see on lichess and Chess.com. If a user types your username for opponent prep, or you appear as an opponent in their own game report, your public username, rating and the opening details of your games (date, time control, result, opening played, the move where the theory was left) may be processed in that user’s report. This is used only for chess preparation, is never sold or used for advertising, and is kept for at most 90 days. Your name, email or anything on your account on those sites that is not public is never processed. Even without a TheoryChess account you can exercise the rights below, object to the processing and ask for reports about you to be deleted by writing to [email protected].

Your rights

Under article 11 of the KVKK you may ask whether your data is processed, request information about it, learn the purpose of the processing and who it has been transferred to, have incomplete or inaccurate data corrected, have your data deleted or destroyed, have those corrections or deletions notified to recipients, object to a result against you produced solely by automated analysis, and claim compensation for damage caused by unlawful processing.

If you use the Service from the European Economic Area, you also have the GDPR rights of access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent, and you may lodge a complaint with the supervisory authority in your country.

Once signed in, you can use the account settings page to download a copy of your data (JSON), correct your name and chess usernames, turn email reminders off and delete your account yourself; you can also delete your account from your profile page. You can delete game reports one by one on the My games page. Other ways to make a request are explained in the KVKK Privacy Notice.

Security

Connections are encrypted with HTTPS, and session cookies are kept out of reach of page scripts (HttpOnly). Only authorised accounts can reach the admin panel, and administrative actions are logged. No system is entirely without risk; if a data breach occurs, the Board and the people affected are notified as the KVKK requires.

Children

The Service is not directed at children under 13, and children under 13 may not create an account. If you are between 13 and 18, ask a parent or guardian before creating an account. If we learn that an account belongs to a child under 13, we delete it. Players whose games are analysed in opponent prep may be minors; that is why these reports process only public chess data, as little as needed.

Changes

We may update this policy as the Service changes. The current version is always published on this page; for significant changes the effective date is updated and the change is announced on the site.

Contact

For any privacy question: [email protected].