Privacy Policy

What we collect

• Chess usernames and public games. When you look up a chess.com username, we fetch that player's public profile and games from chess.com and store copies so we don't have to download them again. These games are already public.
• Reviews and analyses. The reviews you request on our servers, your Review All batches, saved Studio studies and games you import or upload.
• A device id. Each app creates a random id on first use. We use it for the free daily review limit, to keep your reviews together without an account, and to count how many devices use RewindChess. It doesn't contain your name or email.
• Basic usage counts. Platform (web, desktop, iOS, Android), app version, when a device was last active, and counters such as how many reviews were requested. We don't use third-party analytics or advertising trackers, and the Android app doesn't use the advertising ID.
• Account details, only if you sign in. Your email address and name, and your profile picture if you sign in with Google. Accounts that signed in with Lichess before that option was removed also keep that Lichess username.
• Network data. We never store your full IP address. Sessions keep only a shortened network: the first three parts of an IPv4 address, or the first three groups of an IPv6 address. Rate limits use a one-way hash that expires within two days.
• Subscriptions, only if you subscribe to Pro. On the website: your PayPal subscription and payment ids, the plan, the amount, the price group, the country the price was chosen for (from your connection, as Cloudflare reports it) and your PayPal account's country (from the address PayPal has on file), which we check before the first payment. In the Android app: the Google Play purchase token, order id, purchase time, plan and state, and Google Play's notices about your subscription (renewals, cancellations, refunds). We never receive your card details or your PayPal or Google login.
• Error reports. When something breaks, the website, the desktop app, the Android app and our servers send a report of the error: what failed, the page, screen or request it happened on, the browser or app and system versions, and on Android the device model. Reports don't include your name, email or IP address.
• Push token (phone app). If you allow notifications, a token that lets us tell you when a review is ready.
• Emails you send us and their replies.

Sign in with Google

If you choose "Continue with Google", Google shares your name, email address and profile picture with us. We use them only to create and sign in to your RewindChess account and to show who is signed in. We don't ask for access to your Gmail, contacts, files or anything else, and we never sell this information or use it for advertising.

RewindChess's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

How we use it

• To run reviews, keep your history, and sync it between your devices when signed in.
• To apply the free daily limit and protect the service from abuse.
• To send sign-in links and, on the phone, "review ready" notifications.
• To charge for Pro at the price for your country, and to keep payment records.
• To understand, with aggregate numbers, how the service is used and fix problems.

We don't sell your data, and we don't show ads.

Stored on your device

The apps keep your settings, recent searches, the device id and reviews made on your own device in your browser's storage (local storage and IndexedDB) or the app's storage. Signing in on the website uses a session cookie that sign-in needs. The desktop and phone apps use a token instead. We don't use advertising or tracking cookies. Clearing your browser data removes what's stored locally.

Who helps us run RewindChess

• Hetzner hosts our servers and database in Helsinki, Finland.
• Cloudflare delivers the website and protects it from attacks.
• Zoho Mail sends our emails, such as sign-in links.
• PayPal handles Pro subscriptions on the website, and Google Play handles them in the Android app. We never receive or store your card details or your PayPal or Google login.
• Sentry receives our error reports and stores them in the United States.
• Google signs you in when you choose it.
• Expo and Google (for Android phones) deliver phone notifications.
• chess.com provides the public games we review. We send it the usernames you look up, never your account details. Positions you explore in the Studio may also be sent to Lichess's public opening explorer.

We may also disclose information if the law requires it, or to protect the service and its users.

Public content

Sharing a review creates a public link that anyone with the link can open. Scouting reports are built only from games that are already public on chess.com.

How long we keep it

• Account data, reviews and studies: until you delete them or ask us to delete your account.
• Daily counts of unique devices: 40 days. Daily review-limit counters: about two days. Afterwards only totals with no ids.
• Recent activity used for the "online now" count: up to an hour.
• Plan and payment history: kept as long as tax or accounting law requires. Each record carries only the random id of your account, which belongs to no one once the account is deleted.
• Error reports: deleted by Sentry after at most 90 days.

Your choices and rights

You can use RewindChess without an account. You can ask for a copy of your data, a correction, or deletion of your account by emailing support@rewindchess.com from the address on your account. Deleting an account removes the account, its sign-in methods, linked chess accounts, devices, reviews, batches, studies and shares. Depending on where you live, you may also have the right to object to or restrict some uses, and to complain to your data protection authority.

Delete some of your data

You can delete some data and keep your account. Studies can be deleted in the Studio. For anything else, email support@rewindchess.com from the address on your account and tell us what to delete, for example your reviews, Review All batches, share links, devices or linked chess accounts. We confirm by email and delete it within 30 days. Plan and payment records that tax or accounting law requires are kept (see "How long we keep it").

Delete your account

To delete your RewindChess account and its data, email support@rewindchess.com from the address on your account and ask us to delete it. This works for accounts made on the website, the desktop app or the Android app, and you don't need the app installed. We confirm by email and delete the account within 30 days.

• Deleted: the account, its sign-in methods, linked chess accounts, devices, reviews, Review All batches, studies and share links.
• Kept: plan and payment records that tax or accounting law requires, linked only to the random id of the deleted account (see "How long we keep it").
• Deleting the account cancels a PayPal subscription. A Google Play subscription has to be cancelled in Google Play. Deleting the account doesn't refund past payments.

Children

RewindChess isn't directed at children under 13, and we don't knowingly collect their personal information. If you believe a child has given us personal information, contact us and we'll delete it.

Security

Connections are encrypted, staff access needs a password and an authenticator app, and staff actions are logged. No system is perfectly secure, but we work to protect your data.

Changes

We'll update this page when our practices change and change the date at the top. For significant changes we'll give notice in the apps. See also our Terms of Service.