Privacy Policy

Bichess ('we', 'our', or 'us') is committed to protecting your personal data. This Privacy Policy explains what information we collect, why we collect it, how we use it, and the rights you have regarding your data when you use the Bichess platform.

We collect the following categories of personal data when you use Bichess:

• Account information: username, email address, profile picture, and password (hashed).
• Game activity: moves played, game results, ratings, and analysis history.
• Payment data: processed exclusively by our payment provider (Stripe); we do not store card details.
• Technical data: IP address, browser type, device type, and usage logs.
• Communication data: messages sent to our support team.

We use your personal data for the following purposes:

• Providing and operating the Bichess platform and its features.
• Processing payments and managing subscriptions.
• Personalizing your experience (recommended opponents, game settings).
• Ensuring platform security and preventing fraud or cheating.
• Improving our product through aggregated analytics.
• Sending transactional communications (receipts, account alerts).

If you are located in the European Economic Area (EEA), we process your data under the following legal bases:

• Contract performance: processing necessary to provide the services you signed up for.
• Legitimate interests: analytics, security, and product improvement.
• Consent: for non-essential cookies and marketing communications.
• Legal obligation: compliance with applicable laws and regulations.

We do not sell your personal data. We may share it with trusted third-party service providers who act as data processors on our behalf, including:

• Vercel — hosting and infrastructure.
• Stripe — payment processing.
• Analytics providers — aggregate usage metrics.
• Email providers — transactional emails.

Some of our service providers may process your data outside the EEA. In such cases, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

We retain your personal data for as long as your account is active or as needed to provide services. Inactive accounts may be deleted after 24 months of inactivity. You may request deletion at any time.

Under applicable data protection laws, you have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data ('right to be forgotten').
• Restriction — limit how we process your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Lodge a complaint — with your local data protection authority.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encrypted connections (TLS), hashed passwords, and regular security audits.

For any questions or requests related to your personal data, please contact us at privacy@bichess.com. If a Data Protection Officer (DPO) has been designated, their contact information will be provided here.