Privacy Policy

What data we collect

• Email address — used for account management and account-related emails.
• Username — public and displayed inside the app.
• Puzzle attempts and performance data — moves, results, and solve times, used to track your progress.
• Rating information — your puzzle rating and its history.
• Avatar image — optional, only if you upload one.
• Cookies and local storage — for your session, preferences, and guest progress.

Why we collect it

• To provide and maintain the service.
• To track your progress and puzzle history.
• To enable features like collections and bot games.
• To send important account emails, such as password resets and email confirmations.

How we store it

• All account data is stored on our EU-hosted infrastructure in Stockholm, Sweden (eu-north-1).
• Data is encrypted in transit and at rest.
• Our hosting and database provider operates under GDPR-compliant terms.

Your rights

• Access — view your account details on the Settings page.
• Export — download your puzzle history as CSV or JSON from the History page.
• Deletion — delete your account from the Settings page. This is immediate and permanent.
• Rectification — change your username or email from the Settings page.

Your Rights Under GDPR

You have the right to delete your account and all associated data at any time. This is known as the “right to be forgotten” (GDPR Article 17).

How to delete your account:

• Go to Settings on the website
• Click “Delete my account”
• Confirm by typing “DELETE”
• Your account will be deleted immediately and permanently

What gets deleted:

When you delete your account, the following data is permanently removed:

• Your profile and username
• Your rating and puzzle history
• Your collections and saved puzzles
• Your bot games
• Your avatar (profile picture)
• Your subscription data (if you have Premium)

Audit trail exception

To prove that account deletion has occurred (as required by GDPR’s accountability principle), we store a limited audit record in the account_deletions table. This contains:

• A one-way hash of your user ID (cannot be traced back to you)
• Timestamp of deletion

This cannot be used to identify you as a person – it exists only so we can verify deletion occurred if a regulatory authority asks.

Consent log

If you have consented to cookies or other features, these records are kept but detached from your account (user_id is set to null) so we can prove consent was given.

Cookies and local storage

• Essential — session management and authentication. Required for signing in.
• Preferences — things like your play mode, sound setting, and cookie consent choice.
• Analytics — none are currently used.

Third-party services

We use the following third-party services:

• Supabase – for database, authentication, and storage (hosted in EU, Stockholm)
• Stripe – for payment processing of Premium subscriptions (hosted in EU)

No other third-party services are used to store or process your personal data.

Data retention

• Account data — kept until you delete your account.
• Guest data — stored only in your browser and removed when you clear browser data.
• Deleted accounts — we keep an anonymized audit record that cannot be traced back to you.

Children's privacy

TikiChess is not intended for children under 13, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will remove it.

Changes to this policy

We may update this policy as the service evolves. If a change is significant, we will notify registered users by email. The date at the top of this page always reflects the current version.

Contact

Questions about your data? Email support@tikichess.com.

TikiChess, based in Sweden (EU).