Privacy Policy

ChessAI · Effective date: May 15, 2025 · Last updated: May 15, 2025

    Short version: ChessAI does not create user accounts, does not collect your name or email, and does not sell your data. The only identifier we use is a random device UUID stored in your device's Keychain. Messages you send to the AI coach are forwarded to Anthropic to generate responses and are not stored by us.
  

1. Who We Are

ChessAI ("Company," "we," "us," "our") operates the ChessAI mobile application (the "App"). Questions about this policy may be directed to privacy@projectchess.app.

2. Information We Collect

Data	How collected	Purpose	Stored where
Device UUID	Generated on first launch; stored in iOS Keychain	Identify your device for rate limiting and token issuance. Never linked to your identity.	Your device Keychain + Cloudflare KV (hashed key only)
Subscription tier	Derived from your Apple StoreKit 2 receipt at token mint time	Determine which features you have access to. Baked into a short-lived signed token; not stored by us separately.	Signed JWT on your device (7-day TTL)
API usage counters	Incremented server-side each time you make an AI request	Enforce daily rate limits per subscription tier. Keys are keyed to device UUID + date only.	Cloudflare KV (auto-expires after 25 hours)
AI conversation messages	Typed by you in the AI coach or analysis features	Sent to Anthropic's API to generate a response. We do not log or store message content.	Transmitted to Anthropic; not retained by us
Game history & statistics	Recorded locally as you play	Display your stats, rating history, and win/loss record in the app.	On your device only (UserDefaults / local storage)
Online game state	Created when you play online multiplayer	Synchronise board state between two players in real time.	Firebase Realtime Database (deleted when the game ends)
IP address	Provided by Cloudflare on every request	Prevent abuse of the token endpoint (max 10 token requests per IP per hour). Not logged or stored by us beyond the counter.	Cloudflare KV counter key (auto-expires after 2 hours)

We do not collect your name, email address, phone number, location, contacts, camera or microphone data, device advertising ID, or any other personal identifiers beyond what is listed above.

3. How We Use Information

We use the information described above solely to:

Operate and deliver the Service (process AI requests, enforce rate limits, serve online gameplay).
Verify active subscriptions and apply the correct feature access.
Detect and prevent abuse, fraud, or violations of our Terms of Service.
Diagnose and fix technical problems with the Service.

We do not use your data for advertising, profiling, or sale to third parties.

4. Third-Party Services

The Service relies on the following third-party processors. By using the Service you acknowledge that data described above is transmitted to these parties under their own privacy terms:

Apple Inc. — App distribution, in-app purchases, and StoreKit transaction verification. Apple Privacy Policy
Anthropic, PBC — AI inference. Messages you send to AI features are processed by Anthropic's Claude API. Anthropic's data handling is governed by their Privacy Policy. We do not send any personal identifiers to Anthropic — requests carry no user ID, name, or email.
Cloudflare, Inc. — Backend worker hosting and KV storage for rate-limit counters. Cloudflare Privacy Policy
Google LLC (Firebase) — Realtime Database used for online multiplayer game state. Firebase Privacy Policy

5. Data Retention

Rate-limit counters expire automatically after 25 hours (daily counters) or 2 hours (IP counters).
Online game records in Firebase are intended to be deleted when a game ends. Orphaned records may persist briefly.
JWTs have a 7-day TTL and are not retained server-side after issuance.
Local game data remains on your device until you delete the app or clear app data.
We do not maintain any server-side database of users or their game histories.

6. Data Security

We take reasonable technical measures to protect the data we process:

Your device UUID and JWT are stored in the iOS Keychain, which is encrypted by the operating system.
All communication between the App and our backend uses HTTPS/TLS.
JWTs are signed with HMAC-SHA256; the signing key is stored as a Cloudflare Worker secret.
We do not log the contents of AI messages.

No method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of data transmitted to or from the App.

7. Children's Privacy

The Service is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us information, please contact us at privacy@projectchess.app and we will take steps to delete that information.

8. Your Rights

Because we do not collect personal information beyond an anonymous device UUID, most traditional data subject rights (access, correction, portability) are not applicable — we simply cannot link a UUID to your identity. However:

Deletion. Deleting and reinstalling the app generates a new device UUID, which permanently orphans any prior rate-limit counters (which expire anyway).
Opt-out of AI features. You may choose not to use AI coach, analysis, or hint features entirely. No AI-related data is transmitted if you do not invoke those features.
California residents (CCPA). We do not sell personal information. We do not share personal information for cross-context behavioral advertising. You have the right to request disclosure of data we hold linked to you; because we hold only an anonymous UUID, the practical scope of this right is limited.
EEA / UK residents (GDPR / UK GDPR). Our lawful basis for processing is legitimate interest (operating the Service and preventing abuse). You may lodge a complaint with your local supervisory authority.

9. International Transfers

Our backend services (Cloudflare Workers, Firebase) may process data in data centers located outside your country, including the United States. By using the Service, you consent to the transfer of information to countries that may have different data protection laws than your country of residence.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page. Your continued use of the Service after any change constitutes your acceptance of the updated policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at:

privacy@projectchess.app