Privacy Policy

NabuChess Ltd, 27 Bridgewater Street, Manchester M1 5AR, United Kingdom, is the data controller for personal data processed through the service. Our ICO registration number is ZB512744.

• Account data — name, email, password hash, country, chess title and platform usernames you choose to link.
• Coaching data — plans, tasks, completion marks, comments, assessments, video and audio you upload for review.
• Play and training data — games imported or played, puzzle attempts, ratings, opening repertoire and engine analyses you run.
• Messages — the contents of direct threads between you and the people you are connected to.
• Technical data — IP address, device and browser type, and timestamps, kept in security logs.
• Billing data — plan, invoices and the last four digits of the card. Full card details go to our payment processor and never reach our servers.

Every category has a purpose and a lawful basis. We do not process personal data for advertising, profiling for third parties, or model training.

A coach sees the tasks they set, whether those tasks were completed, and any work submitted against them. That is the default and it is the minimum needed to coach. Specifically, an accepted coaching link lets a coach:

A student can widen or narrow this for each coach independently. A student with three coaches can give one of them the full picture and keep the others to their own tasks. Changing the setting takes effect immediately and is recorded in the student's own activity log.

A coach loses all access the moment the relationship ends, including to work previously submitted.

You must be at least 16 years old to hold an account. NabuChess is not intended for children under 16 and we do not knowingly create accounts for them. There is no guardian-managed account type: every account belongs to the person using it.

We do not show advertising to anyone, we do not profile users, and we do not use engagement mechanics designed to extend session length. If you believe an account belongs to someone under 16, write to privacy@nabuchess.com and we will close it and delete the record.

We do not sell personal data and we do not share it for anyone else's marketing. We use a small number of processors, each under contract and each restricted to the purpose listed.

• Application hosting and PostgreSQL database — Hetzner Online GmbH, Germany.
• Authentication, file storage and realtime presence — Google Firebase (Google Ireland Ltd), EU, with Standard Contractual Clauses.
• Payments — Stripe Payments Europe Ltd, Ireland.
• Transactional email — Our SMTP provider, under contract, EU.
• Error monitoring — Sentry, EU region.

We disclose data to authorities only where legally compelled, and we tell you unless the law forbids it.

Primary application and database storage is in Germany. Authentication, uploaded media and realtime presence are held by Google Firebase in the EU. Where a processor operates outside the UK or EEA we rely on UK International Data Transfer Addenda and EU Standard Contractual Clauses.

Retention periods are in the table above. In practice:

Closing your account starts a 30 day window in which you can still export or change your mind, after which personal data is deleted from live systems. Backups roll off within a further 35 days. Your export stays available for 30 days.

Anonymous, aggregated statistics — for example how many puzzles were solved in a theme — survive deletion because they can no longer identify anyone.

Under UK and EU GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to processing, or move it elsewhere in a portable format. Where we rely on consent you can withdraw it at any time without affecting what came before.

Most of this is self-service in Settings — export runs in minutes and needs no ticket. For anything else, write to privacy@nabuchess.com and we respond within one month.

We set strictly necessary cookies and browser storage for sign-in and security. We do not use third party advertising or cross-site tracking cookies at all, and no analytics product is wired into this service — the analytics row in the table above describes what would happen if one were, and it would be off until you turned it on.

Data is encrypted in transit with TLS. Access to production is limited to named engineers with two-factor authentication, and administrative actions against another user's account are written to an append-only audit log that the acting engineer cannot edit or delete.

If a breach is likely to result in a risk to your rights we tell the ICO within 72 hours and tell you without undue delay.

We announce material changes in the product and by email at least 30 days before they take effect.

Our data protection contact is privacy@nabuchess.com, or write to the Data Protection Lead, NabuChess Ltd, 27 Bridgewater Street, Manchester M1 5AR, United Kingdom.

If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk, or to the supervisory authority in your EU member state. We would rather you told us first, but that choice is yours.