Privacy policy

Who we are

Chess411 is made by MPL Ventures, LLC, 330 N Wabash Ave, Floor 23, Chicago, IL 60611-7619, United States. For anything about this policy or about your personal information, write to [email protected].

Under the UK and EU General Data Protection Regulation, MPL Ventures, LLC is the data controller for the processing described below.

This policy covers the website at chess411.com, the Chess411 app for iPhone and iPad, listed on the App Store as Chess411 - Puzzles & Analysis, and the Chess411 app for Android on Google Play. Our other products, including The Word Finder, Crossplay Solver by TWF and Crossword Solver by TWF, have their own policies.

1. The short version

• No accounts, no sign-in, and nothing is ever sold or rented to data brokers.
• No advertising or tracking code of ours, in the app or on the website. The website counts visits, and the part of that which uses cookies happens only after you agree.
• When a game review runs, we count it: which kind of device asked, how long it took, and how much of the work your device did instead of our server. It carries no name, no game and nothing that links one review to another.
• Positions and games you analyse are sent to our engine server so Stockfish can look at them. They carry no identifier we control. Much of that work now happens on your own device instead, and when it does, nothing is sent at all.
• Board photos you scan on the website never leave your browser. In the app they are sent to our server, read, and discarded.
• No file on any of our servers records your IP address. Section 7 explains the two places one exists briefly and what happens to it.
• Feedback you send is stored so we can read it and reply. Everything in it that points to you is erased after 12 months, automatically.
• There is no advertising in Chess411 today. We expect to add it, and Section 9 says now what will happen when we do.

The detail is below, and the detail governs.

2. What we do not collect

We would rather be specific than say we respect your privacy, which does no work on its own. Chess411 does not collect:

• Your name, phone number or postal address
• Your precise location, meaning GPS-level location
• Your contacts, calendar, or anything else from elsewhere on your device
• Your photo library. The app sees only the single image you choose
• Any account or password, because there are none
• Any payment details. Nothing in Chess411 is for sale and there is no payment code in it at all

3. Positions and games

Game review sends the moves of the game, including any player names and headers that came with it, to our engine server at sf.chess411.com, where Stockfish evaluates every move and sends the verdicts back. The website's next move calculator and analysis board send the position on the board the same way.

A growing part of this happens on your own device, and sends nothing. In the app, the next move calculator and the analysis board run Stockfish on your phone, and only ask the server if the on-device engine cannot start. A whole game review can run on your phone too: it does so when you choose "On this phone" in Settings, and automatically when the engine server is full. On the website, game review can run in your browser the same way. When a review runs locally, the game is never sent anywhere.

Our engine server is in Finland, which means that if you are in Europe your chess analysis does not leave the European Economic Area.

The engine server does not ask who you are and attaches no account, session or device identifier to a request. The games themselves are not stored. Two things are kept:

Counts. How many requests were served each day and how long they took, so we know when the server needs more hardware. These are plain numbers with no address or identifier attached, and they are kept for 400 days.

An anonymous position library. Evaluating a position is expensive, so once the engine has looked at one properly we keep the answer and reuse it. The library holds up to 200,000 positions, and when it is full the least recently used one is dropped to make room. It lives in the server's memory and is written to a file on that server's own disk every few minutes, so it survives a restart rather than being rebuilt from scratch. An entry is a chess position and an evaluation. It holds no address, no identifier, and no link to any other position, so it cannot be traced to a person and a game cannot be reconstructed from it.

We do this because it is what you asked the service to do. Where the law asks us to name a legal basis, ours is our legitimate interest in providing the analysis you requested and in keeping the service fast and working.

If you paste in someone else's game, you are sending us information about them. Player names in a PGN file are personal data belonging to those players, not to you. We do not store games, so nothing persists, and it is worth knowing before you upload a tournament file.

4. Importing games from Chess.com and Lichess

When you type a username to import games, your browser or phone asks Chess.com's or Lichess's public interface for that player's recent games directly. The username is sent to them, under their own privacy policies. We do not store it.

One part of a Chess.com import on the website passes through our server. Chess.com's published archives sit behind a cache that can run an hour behind, so a game you finished minutes ago is missing from them. The uncached list is one a browser cannot call directly, so the website asks our API server at server.chess411.com, which passes the username to Chess.com and hands the newest games straight back. We keep neither the username nor the games, and no log of ours records them. In the app that call is made by your phone itself, so nothing about it reaches us.

5. Board photos and screenshots

The position scanner only runs when you choose to scan.

On the website the image is read in your browser and never uploaded. The recognition runs locally using ONNX Runtime Web, and both the runtime and the model are served from chess411.com, so the picture and the reading of it stay on your machine.

In the app the image is sent to our server at server.chess411.com, which finds the board, reads the pieces, returns the position and discards the image. We do not store it and we keep no copy. That server is in New York. The app asks for camera or photo library access only at that moment and never reads your library otherwise. If you decline, everything else in the app keeps working.

6. Puzzles, the daily challenge and your progress

Puzzles and the daily challenge are fetched from server.chess411.com with no identifier attached.

Your progress, streak, lives and settings live on your device, in the app's storage or your browser's local storage. Deleting the app or clearing the site's data removes them. We hold no copy of them, which also means we cannot restore them.

The daily challenge scoreboard is different, because a score you submit comes to us. What is stored is the day, how many puzzles you solved, the highest rating you reached and how long you took, together with the keyed one-way code of your IP address described in Section 7, which is there to stop one person filling the board and is erased 30 days after the submission. No account is attached to it, because there are no accounts, and we do not ask you for your name.

7. What happens to your IP address

Every device that talks to a server on the internet reveals its IP address in the process. What matters is what the server does with it, so here is all of it.

Nothing on any of our servers writes your IP address to a file. Not in full, not shortened.

It exists in memory, briefly, to stop abuse. Our servers count requests per address in 60-second windows, clear those counts every two minutes, and lose them entirely when the server restarts. Nothing is written down.

It is sent to Cloudflare when a bot check runs. The website's feedback form and its engine requests are protected by Cloudflare Turnstile. Verifying that you are not a bot means our server passes your IP address to Cloudflare's verification service, which handles it under Cloudflare's privacy policy. The app has no page to run that check on, so it proves itself with a key built into the app instead, and its requests pass no address to Cloudflare.

A one-way code of it is stored with feedback and with submitted scores. So that one person cannot flood the form or the scoreboard, we store a keyed code derived from your address rather than the address itself. It is produced with a secret only our server holds, which means a row in our database cannot be worked backwards into an IP address by anyone who obtains the database. It is used only for the daily submission limit, it is never shown in any tool or export, and it is erased 30 days after the submission it belongs to.

Our legal basis for all of this is our legitimate interest in keeping the service available and free of abuse.

8. Server logs

Most websites keep an access log recording every request. Ours do not. Access logging is switched off on both servers.

Our own application logs record what the software did: the type of request, the path, whether it succeeded, and how long it took. They contain no IP addresses and nothing that identifies a visitor. They are kept for 14 days and then deleted automatically.

9. Advertising

There is no advertising in Chess411 today, and the app contains no advertising software.

We expect to add advertising, and we would rather tell you now what that will involve than change this page quietly later.

When it arrives, our advertising will be served through an advertising network, and we will name that network and anyone managing it on our behalf on this page before the first advert appears. For advertising to work, information about your device and your visit is shared with advertising companies. That will include an advertising identifier, your approximate location worked out from your internet connection, and information about which pages or screens you looked at. It will not include your name, because we do not have it.

Before any personalised advertising is shown in the European Economic Area, the United Kingdom or Switzerland, you will be asked whether you agree. You can say no, and Chess411 will keep working. You will still see advertising, chosen without using information about you. You will be able to change your answer at any time.

On iPhone and iPad, you will separately be asked through Apple's App Tracking Transparency prompt before any tracking across other apps and websites. Declining is a complete answer. No part of Chess411 will be withheld from you for declining, and nothing will be asked of you in exchange.

None of this happens before the version containing advertising is released. When it is, we will update this page and our App Store and Google Play declarations first, and we will ask for consent where the law requires it rather than relying on you having read this page.

10. Website analytics and cookies

chess411.com counts visits with two tools. One needs your permission and one does not touch your device at all.

Cloudflare Web Analytics measures how quickly pages load and where visits came from. Cloudflare's own documentation states that it "does not use any client-side state, such as cookies or localStorage", and that it does not build a fingerprint from your IP address or user agent. Nothing is stored on your device, so nothing is asked of you. It sends page timing, the referring page, your browser's user agent and your approximate country to Cloudflare, under Cloudflare's privacy policy.

Google Analytics 4 (property G-YN8Z7NX135) tells us which pages are read and on what kind of device. It uses cookies, so it sets them only after you agree. Analytics cookies are refused by default. Until you choose Allow, Google Analytics runs in a mode that stores nothing on your device. If you do agree, it sends pages viewed, approximate location and browser details to Google under Google's privacy policy, and our retention is set to 14 months, after which Google deletes it. It is not used to identify you.

You can change your mind at any time. The Cookie choices link in the site menu reopens the choice, and withdrawing deletes the Google Analytics cookies from your browser.

We count game reviews, in both the app and the website. Game review is our most used tool and the only one whose cost is shared between our engine server and your own device, so when a review finishes or fails we record one line about it: whether it came from the website or the app, whether that was a phone, tablet or computer, the browser or device model and operating system, the app's version, where the game came from (Chess.com, Lichess or a pasted PGN), the players' ratings and time control from the game itself, how many positions were searched on our server versus on your device, how long it took, and whether it failed and why.

That line contains no identifier of any kind — no name, no account, no game, no moves, no IP address, not even a random one of our own. It sets no cookie and reads none. Two reviews you run cannot be told apart from two reviews by two different people, which is also why there is no way to withdraw it or ask for its deletion: there is nothing in it to find you by. We keep the ratings because how deeply we search a game is decided from rating and time control, and setting that well means knowing the real spread of who is asking.

The Chess411 app carries no other analytics of ours, and no advertising or tracking code. Section 12 covers what Apple and Google collect at the operating system and store level.

11. Feedback

The Send feedback form is on every page of the website and inside the app. It stores what you type, and some context about where you were, so that a report about a broken puzzle is useful without us having to ask you follow-up questions.

What you give us on purpose: which category of feedback it is, your message, and an email address if you choose to leave one.

What the form collects with it on the website: the page you were on and its address; the position, puzzle, rating and solution in front of you, or the game and move if you were in game review; how many lives you had left; your screen and window size and whether it is a touch screen; your board theme and piece set; how long you had been on the page; your browser's language setting and your device's time zone; the page you arrived from; your browser's user agent; the last few script errors from your visit; and a screenshot if you attach one. Section 7 covers the one-way code of your IP address.

The app sends much less: which screen you opened the form from, whether it is the iPhone or the Android app, and the app's version number. No user agent, no language or time zone, no screen size, no board position. A screenshot only if you attach one from your photo library.

Everything that points to you is erased after 12 months. A job inside our own server does this every day, without anyone having to remember. At 12 months a submission loses:

• Your email address
• Your browser's user agent, language setting and time zone
• The page you arrived from
• Anything after the question mark in the page address, because on the analysis pages that can contain the Chess.com or Lichess username you typed in
• Your screenshot

What is left is the message, the category, the page it came from, and the chess position or puzzle involved. We keep that for as long as it is useful, because at that point it is a bug report with nothing in it pointing to a person. Ask us sooner and we will delete yours.

Leaving an email address is your choice, and consent is the basis we rely on for it. You can withdraw that at any time by writing to [email protected]. For the rest, our basis is our legitimate interest in fixing what is broken.

Feedback is read by the people who make Chess411. Screenshots are stored at unlisted addresses on our content network, in the European Union. The addresses are long and random, so they are not findable and not linked from anywhere. They are not behind a password, so anyone given the link could open one, and they are deleted after 12 months along with everything else above.

12. Who else is involved

Five companies hold or handle something on our behalf. None of them is an advertising network or a data broker.

Cloudflare, Inc. Serves the website. Stores feedback screenshots and blog images, kept under Cloudflare's European Union jurisdiction setting so they stay in the EU. Runs the Turnstile bot check, which receives your IP address as Section 7 describes. Provides Cloudflare Web Analytics. Cloudflare acts as our processor for hosting and storage, and as a controller for its own security data.

Hetzner Online GmbH. A German company. Our engine server runs on a machine we rent from them in Finland. They provide the infrastructure and do not handle the content of your requests.

DigitalOcean. Our API server, which handles board scanning, puzzles, the daily challenge and the game review count sheet, runs on a machine we rent from them in New York.

Google LLC. Two separate things. Google Cloud SQL, in Iowa, is the database that holds feedback submissions, daily challenge scores and the game review count sheet. And Google Analytics on the website, as Section 10 describes, only after you agree.

Microsoft, through ONNX Runtime Web. The website's board scanning uses it. It runs entirely in your browser, from files served by us, so no information about you reaches Microsoft. We name it so the claim in Section 5 can be checked.

Others are involved only because you asked them to be, or because of where you got the app:

Chess.com and Lichess. Only when you choose to import games. Your device talks to their public interfaces directly, with the one exception described in Section 4.

Apple and Google, as the app stores. They distribute the app and operate the App Store and Google Play. Each collects its own information about downloads and, if you have opted in at the operating system level, app usage and crash diagnostics, and shows us aggregate reports built from that. We receive nothing that identifies you and we cannot see what any individual did. That processing is theirs rather than ours, and is governed by Apple's privacy policy and Google's privacy policy. You can turn it off in your device settings.

13. What we don't do

• We never sell, rent or trade your data.
• We do not track you across other apps or websites, and Chess411 uses no advertising identifier today.
• We do not build profiles. There is nothing to build one from.

On "sell" and "share" in United States law. We do not sell personal information in the ordinary sense of the word. Several US state privacy laws use wider statutory definitions of "sell" and "share" that can catch advertising of the kind described in Section 9. Today Chess411 shows no advertising, so there is nothing caught by them. When advertising arrives, we will add a "Do not sell or share my personal information" link and this section will change to match.

14. Children

Chess411 is not directed at children. Our declared target audience begins at 16. We do not knowingly collect personal information from anyone under 16.

We do not verify anyone's age, and the one route by which a child could give us personal information is by typing an email address into the feedback form. If you believe a child has given us personal information, write to [email protected] and we will delete it.

15. Your rights

We hold very little about you. There is no account, no identifier we control, and no file anywhere recording your IP address. In practice the only thing we hold that is likely to be yours is feedback you have sent within the last 12 months.

If you are in the European Economic Area or the United Kingdom, you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where processing relies on it. You also have the right to complain to your national supervisory authority. In the UK that is the Information Commissioner's Office.

If you are in California, you have the right to know what personal information is collected, to delete it, to correct it, and to opt out of sale or sharing. We neither sell nor share personal information, so there is nothing to opt out of. We will not treat you differently for exercising any of these rights.

If you are in another US state with a comprehensive privacy law, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Kentucky, Rhode Island and Indiana, you have broadly similar rights. The exact list varies by state. Ask us and we will tell you what your state provides.

Everything the app remembers is on your device. Delete the app to remove it. On the website, clear the site's data in your browser. Neither needs our involvement.

To make a request, email [email protected] or use the Send feedback link in the site menu. We aim to respond within one month. Where a request is complex, or where you have made several, the law allows us two further months, and we will tell you within the first month if we need them.

Because there is no account, we often cannot verify that particular data relates to you, and where that is the case we will explain why rather than simply refusing.

16. Where information is processed

MPL Ventures, LLC is based in the United States. Where the work happens depends on what you are doing, and it is worth setting out precisely.

So if you are in Europe, your chess analysis stays in Europe and your screenshots stay in the EU, and feedback you choose to send us is stored in the United States.

Some of that means personal data leaving the European Economic Area and the United Kingdom for the United States. The European Commission has decided that the United States offers adequate protection, but only for organisations certified under the EU-US Data Privacy Framework. Where our provider is certified, we rely on that. Where it is not, we rely on the European Commission's standard contractual clauses, which are the safeguards it has approved for exactly this situation.

Write to us at the address above and we will tell you which of the two applies to a particular transfer, and give you a copy of the relevant safeguards.

17. How long we keep things

18. Security

Traffic between Chess411 and our servers is encrypted in transit using HTTPS. Because there is no account and no stored profile, there is very little of yours for us to protect.

Feedback and scores are held in our own database. They are not in a third-party helpdesk, a shared spreadsheet or any other outside service. Two people can read them, and reaching them programmatically requires a key we issue and can withdraw. The one-way IP codes described in Section 7 are stripped from every response that key can retrieve, so they cannot be exported at all. Screenshots sit on our content network in the EU at unlisted addresses.

19. Changes

If what Chess411 does with data changes, this page changes with it and the date at the top moves.

Where a change is material, particularly one that introduces new data collection or advertising, we will publish the updated policy and update our App Store and Google Play declarations before the new version is released. Where the law requires consent, we will ask for it rather than relying on you having read this page.

20. Contact

MPL Ventures, LLC
330 N Wabash Ave, Floor 23
Chicago, IL 60611-7619
United States

[email protected]

The terms of use are the other half of this.