What this build does
Games, lessons, puzzles, settings and coach notes stay on the phone. They are stored in the application’s local archive. Settings can export that archive as chessverse-archive.json, import an archive, or delete it. Deletion runs on the device. The developer does not keep a copy, because this build does not send the archive to a server.
Bot moves and the review are a local search on the phone. The settings screen says Stockfish is not loaded and that the review is a local search of depth 3. Coach text and ATOM’s record of mistakes stay on the device. Free opens the first Academy level, five puzzles a day, and two hints in a bot game. The application does not ask for the camera, microphone, contacts or precise location. No analytics or crash-reporting SDK is referenced under src.
The account screen is written and is not mounted. The Supabase client is created only when a build contains both a project URL and a publishable key. Those values are not in the repository, so the current source does not open an account connection. Settings in the running shell pass cloud readiness as false.
What this build does not collect
- No account, email or password is sent, because the client is not configured.
- No card number and no completed Google Play purchase. Product ids are named in the source. Billing is not verified, so no plan is sold.
- No advertising identifier. The AdMob function returns that the SDK is not linked, so no ad is shown.
- No chat and no player-to-player messages. The draft game server has no message channel.
- No sale of personal data. Nothing in the repository sells data.
Code that is written and not connected
The following would process data only in a later build that is configured, migrated and published. It does not describe the current phone build. The privacy text must be updated again before that build is released.
Supabase
The phone client can sign up and sign in with email and a password, or start Google or Facebook sign-in, and can reset a password. A session would be stored on the device. The minimum password length checked by the client is 6 characters. Email confirmation is left enabled in the SQL comments. The client refuses a secret key; only a publishable key may be shipped.
SQL in the repository defines tables: profile (id, nickname, email), ratings for blitz, rapid and classical, games (the two player ids, time control, result, reason, PGN of up to 20,000 characters), academy progress, achievements, and a plan row. Signed-in players could read nicknames. The email column is not granted to them. A player could read their own ratings, games, progress and plan. Official game rows and plan changes are written by the service role, not by the phone.
A project note of 13 November 2026 refers to a Supabase project in Frankfurt and says the SQL had not been executed there by that change. This policy does not claim that the database is live, and it does not name a project reference that is not in the source.
Cloudflare
The worker chessverse-game-server is a draft Durable Object. It is not deployed. If it were configured, it would check a Supabase access token, read whether the plan is an unexpired Plus, Pro or Premium, keep the user id, the moves and the clocks for that game, and post the finished game to the games table with the service key. The service key is an environment value for the worker, not a value in the phone app. Matchmaking state would sit in the worker’s storage. None of this runs while the worker has no deployment and the phone has no server URL.
Google Play Billing
The SQL can store a receipt: product id, order id, purchase token, and an event such as purchased, renewed, canceled, expired, refunded or restarted. The purchase token is not granted to the signed-in phone role. A plan would change only after a server checked the token with Google Play. Product ids are named in the source for Play Console. The billing check stays not ready, so no receipt is created and no plan is sold. The phone does not store a card. Google would be the seller if a later build used Play Billing. Prices recorded by the owner on 13 November 2026 are listed on the subscriptions page. They are not for sale.
Advertising
The source names Google AdMob publisher pub-6087464447132650, a rewarded unit and an interstitial unit. Those units are used only if a build flag VITE_ADS_LIVE is true. Even then, the function that would request a rewarded ad returns that the SDK is not linked and shows nothing. There is no consent form in the source. Interstitial ads are described as Free-only and forbidden during a game, a lesson or a puzzle. A rewarded ad is described as something a player would start, and only in a bot game. None of that is live.
If ads are later enabled in the EEA or the UK, Google’s consent message has to be in place before any personalized ad. The advertising identifier, IP address and ad interactions would then be processed by Google as described in Google’s privacy policy and how Google uses data from apps that use its advertising services. That is not the current build.
Legal bases
The current app does not automatically send personal data to the developer. Data that never leaves the phone is not a transfer to the developer. If you voluntarily contact support or request deletion by email, the developer receives the details you choose to send and uses them to answer your request, provide support or comply with applicable legal obligations. The email service is operated by Google. The deletion form prepares a message on your device; you decide whether to send it. The draft may be stored in your browser. If a later build sends an account or a game to Supabase, the intended basis is the contract for the account and the game. If ads are shown to a Free plan, the basis for anything optional such as a personalized ad is consent, and the basis for a non-personalized ad needed to fund the free app would have to be stated again before release. This paragraph is a limit, not a claim that those activities happen now.
Retention
On the phone, the archive remains until the user exports it elsewhere or deletes it in Settings. Deletion is immediate on that device. The developer has no retention period for the local archive, because the developer does not hold it. Support and deletion correspondence is handled separately and retained only for as long as necessary to deal with the request and applicable legal obligations.
There is no self-serve deletion of a Supabase user. The SQL cascades profile rows when the auth user is deleted, and that delete is not offered to the player. No retention schedule is published for server rows, because those rows are not recorded as created. See Delete account.
Rights
Where the GDPR applies, the rights of access, rectification, erasure, restriction, objection and portability, and the right to complain to a supervisory authority, apply to personal data a controller actually processes. For data that is only on the phone, the practical tools are the export and the delete control in Settings. A complaint in Austria can be made to the Österreichische Datenschutzbehörde. To exercise your rights or ask a privacy question, contact the controller, Ersel Mehmedov, at enzoanselmo22@gmail.com. Do not send passwords or identity documents through the website.
Children
The notice already in the app says the application is not directed at children under 16, and that it does not knowingly collect their data. That statement still matches this build, which does not collect account data at all. It is not a determination that the app meets a children’s or Families programme. The repository does not show a Families declaration.
Security and transfers
Local data is protected by the device. This build makes no international transfer, because it does not transmit the archive. A later Supabase project in Frankfurt would be in the EU if that region is actually used. The source does not prove the region. The draft worker would talk to Supabase over HTTPS. No transfer is claimed for the current build.
Changes
If an account, online play, payment or advertising is switched on, this page has to be replaced before that version is published. The previous in-app notice said the same thing. Date of this page: 15 November 2026.