Privacy Policy
Last updated: July 30, 2026
1. Overview
CheesCoach is a chess coaching application for Android and iOS developed by JuanfranDevs. This privacy policy explains how our application handles your data. We are committed to protecting your privacy and being transparent about our data practices.
Key principle: CheesCoach is local-first. Playing, puzzles, courses, game review and Stockfish analysis run on your device and are stored on your device. Some optional features — AI coaching through our backend, online multiplayer, and credit or premium purchases — require an account, and for those we store a small amount of personal data (your email address, your chosen nickname, and usage counters) on our servers. Sections 2 to 4 describe exactly what and why.
2. Data Collection
CheesCoach is offline-first: the core features (playing, puzzles, move review, Stockfish analysis, importing/exporting PGN) work without an internet connection and store everything locally on your device. No personal data is collected for these features.
Some optional online features (AI coaching via our backend, online play via Lichess) transmit limited data to third parties. These features are described in sections 3 and 4 below and can be disabled at any time.
Data stored locally on your device:
| Data Type |
Purpose |
Storage |
| Chess games (PGN) |
Saving and reviewing your games |
Local database (Room) |
| Move analysis |
Caching AI analysis to avoid repeated API calls |
Local database (Room) |
| API keys |
Authenticating with AI providers you choose |
Encrypted (AES-256-GCM) |
| App preferences |
Theme, ELO level, board colors |
DataStore Preferences |
| Puzzle progress |
Tracking your puzzle rating and streaks |
DataStore Preferences |
Data collected when you sign in or use online features:
Signing in is optional — you can skip it and keep using the app offline. If you do sign in (Google Sign-In on Android, Sign in with Apple on iOS), the following is stored in our backend:
- Your email address — used as your account identifier, to restore your credits and premium status across devices and reinstalls, and to answer you if you send in-app feedback. With Sign in with Apple you may use Apple's private relay address instead.
- User identifiers — the account id created by our backend and the Google/Apple account id linked to it
- The nickname and country flag you choose for online multiplayer, together with your ratings and win/loss record. These are shown to other players in games and in the public ranking.
- A device identifier (Android ID on Android, vendor identifier on iOS) — used only to stop the same device from farming free AI analyses by reinstalling the app
- Purchase history — which credit or premium purchase you made and the Google Play / App Store transaction token, so we can grant, verify and restore what you bought and detect refunds or fraud
- Chess activity linked to your account — the usage log described in section 3, your online games, and a cache of positions with their AI hints so the same position is not re-analysed twice
Analytics and crash reporting:
The app includes Firebase Analytics, Firebase Crashlytics and Firebase Remote Config (Google). They collect usage events (which screens you open, puzzles solved, games played), crash logs and technical diagnostics, tied to a randomly generated Firebase installation identifier — never to your email address or nickname. We use this only to fix crashes and to understand which features are actually used. This data is not sold and not shared with anyone else.
Data we do NOT collect:
- Your real name, phone number, postal address, date of birth or gender
- Location data — the country flag in your online profile is chosen by you, it is never read from your device or your IP address
- Advertising identifiers, ad networks or cross-app trackers — the app has no ads
- Payment details (card or bank data) — purchases are handled entirely by Google Play and the App Store, we never see them
- Contacts, photos, microphone, or any other personal files
3. AI Services, Backend & Purchases
CheesCoach offers optional AI-generated chess commentary. There are two independent ways to use it and you choose which one.
Mode A — Backend proxy (credits & free calls)
By default, every user gets 5 free AI analyses. Additional analyses require credits, which can be purchased inside the app via Google Play Billing. In this mode, your requests go through our backend hosted on Supabase (EU region), which forwards the chess data to the AI provider on your behalf.
To use Mode A you must sign in with Google, because we need a stable identifier to track your free-call and credit balance across reinstalls. We store the following on the backend:
- Your Google account email (identifier only, never shared with third parties)
- Credit balance, free calls consumed, and purchase history (for fraud prevention and refund support)
- A usage log (timestamp, analysis type, token counts, cost) for billing and abuse detection — does NOT contain the chess position itself
- A device identifier hash used exclusively to prevent free-call farming via reinstalls
The AI providers used by the backend are DeepSeek (primary) and Google Gemini 2.5 Flash (fallback if DeepSeek is unavailable).
ⓘ
Data residency notice: DeepSeek is a Chinese company and processes requests on servers located in the People's Republic of China. The backend only sends non-personal chess data (FEN position, move history in PGN, Stockfish evaluation, coach ELO). Your Google email is NEVER included in the AI provider request — the backend uses it only internally to look up your credit balance. If you prefer to avoid DeepSeek entirely, you can use Mode B (your own API key) or contact us to request DeepSeek be disabled for your account. An administrative kill switch also lets us disable DeepSeek instantly and route all traffic to Gemini (EU) if needed.
Mode B — Bring Your Own Key (BYOK)
If you have your own API key from a supported AI provider, you can configure it in Settings and the app will call the provider directly from your device, completely bypassing our backend. This mode does not require a Google account, does not consume credits, and does not involve any of our servers.
Supported BYOK providers:
What data is sent to AI providers:
When you use the AI coaching feature, the following chess-specific data is sent to your chosen AI provider:
- The current chess position (FEN notation)
- The game move history (PGN notation)
- The Stockfish engine evaluation (numeric score)
- Your configured ELO level (for adjusting explanation complexity)
No personal information is ever sent to AI providers. Only chess positions and game data are transmitted. Your API key is sent as an authentication header but is never shared with us.
ⓘ
Important: Each AI provider has their own privacy policy governing how they handle data sent to their APIs. We encourage you to review the privacy policy of your chosen provider. CheesCoach has no control over how third-party AI providers process the chess data sent to them.
API key handling (Mode B only):
- Your API keys are stored exclusively on your device
- Keys are encrypted using AES-256-GCM via Android's EncryptedSharedPreferences
- Keys are only used to authenticate API requests — they are never logged, transmitted to us, or shared with any other party
- You can delete your API keys at any time from the app's Settings screen
Credit purchases (Mode A):
- Purchases are processed by Google Play Billing — we never see your payment details
- After purchase, Google Play sends us a purchase token which we verify server-side with the Google Play Developer API and then credit your account
- See Google's Privacy Policy for how Google Play handles payment data
4. Online Play
CheesCoach online multiplayer
Playing against other CheesCoach users is optional and requires signing in and choosing a nickname. Matchmaking and the moves of each game travel in real time to our own game server (a Hetzner VPS operated by us), which relays them to your opponent and stores the finished game, your ratings and your win/loss record in our Supabase backend.
Your nickname, country flag, ratings and results are visible to other players in the lobby, during games and in the public ranking. Your email address is never shown to other players.
Lichess integration
CheesCoach offers optional online play through Lichess.org, a free and open-source chess platform.
Authentication:
- Lichess login uses OAuth 2.0 with PKCE (industry-standard secure authentication)
- CheesCoach never sees or stores your Lichess password
- The OAuth token is stored encrypted on your device and can be revoked at any time
Data exchanged with Lichess:
- Your Lichess username and rating (for display in the app)
- Game moves and clock data during online matches
- Game seek parameters (time control, color preference)
For details on how Lichess handles your data, see the Lichess Privacy Policy.
5. Data Storage & Security
- Your chess data is stored locally on your device (Android or iOS)
- Chess games and analysis are stored in a local SQLite database (Room)
- Sensitive data (API keys, OAuth tokens) is encrypted using AES-256-GCM
- Preferences are stored in Android's DataStore
- The Stockfish chess engine runs entirely on your device — no server processing
- Core features (Stockfish, puzzles, games) work fully offline with no server involvement
- The optional AI backend (Mode A) runs on Supabase in the EU region and stores only the data listed in section 3 (email, credit balance, usage log, device hash)
- All data in transit is encrypted with HTTPS/TLS — our backend, our game server, Firebase and every AI provider
6. Data Sharing
CheesCoach does not sell or rent your personal data. Data is only transmitted in the following cases:
- Chess position data sent to AI providers only when you actively request AI analysis (either via our backend in Mode A or directly from your device in Mode B)
- Your account email and credit/usage data stored in our Supabase backend (Mode A only, requires your explicit Google Sign-In on Android or Sign in with Apple on iOS)
- Your nickname, country flag, ratings and game moves sent to our game server and shown to other players during online multiplayer (optional feature)
- Usage events, crash logs and diagnostics sent to Firebase Analytics and Firebase Crashlytics (Google), never linked to your email or nickname
- Purchase tokens sent to Google Play Developer API for server-side verification (only when you buy credits)
- Game data exchanged with Lichess only during online play (optional feature, requires your Lichess OAuth login)
The app contains no ads, no advertising identifiers and no cross-app trackers. The only third-party SDK that collects data is Google's Firebase (Analytics, Crashlytics and Remote Config), described in section 2. We never sell your data, and we only transfer it to the providers listed above so they can operate the feature you asked for on our behalf.
7. Children's Privacy
CheesCoach is not directed at children under 13 and we do not knowingly collect personal information from them. The offline part of the app collects no personal data at all. The optional features that do — signing in, AI coaching, online multiplayer and purchases — require an account and are described above; if you are a parent and believe your child created an account, contact us using section 10 and we will delete it.
Parents or guardians should be aware that the AI coaching feature involves third-party AI providers and, in Mode A, in-app purchases via Google Play Billing. We recommend parental supervision and enabling Google Play parental controls for this feature.
8. Your Rights
You retain full control over your data. Under GDPR (if you are in the EU) you have the rights of access, rectification, erasure, restriction, portability, and objection with respect to any data we store about you. To exercise any of these rights, contact us using the details in section 10.
- Delete local data: Clear app data from Android Settings, or uninstall the app (on iOS, deleting the app removes its local data)
- Delete BYOK API keys: Remove them from the Settings screen within the app
- Sign out: Settings → Account → Sign out. Your local app data remains untouched; the backend account and credit balance remain available if you sign in again.
- Delete your account and the data linked to it: see the section below
- Revoke Lichess access: Disconnect from Settings or revoke the token from your Lichess account
- Export your games: Games can be exported as PGN files at any time
- Disable AI features: Skip the sign-in step (Mode A stays disabled) and don't configure a BYOK API key — the app works fully offline
Account and data deletion
This section explains how to delete your CheesCoach account (app published by JuanfranDevs) and the data linked to it. There are two ways, and both erase exactly the same data.
From inside the app (immediate): open Settings → Account → Delete my account, read the confirmation screen and confirm. The deletion happens right away and you are signed out. This is the fastest route and needs no email.
By email (up to 30 days): use this if you no longer have the app installed, or if the in-app deletion fails.
- Send an email to juanfrandevs@gmail.com from the address you signed in with, with the subject "Delete my account". No other proof is needed — sending the request from your own address is what identifies you.
- We delete your account within 30 days and reply to that same address to confirm it is done.
- What is deleted: your user record (email, account ids, nickname, country, ratings and results), your usage log, your cached AI hints, your online games and your device-grant records
- One detail about online games: a finished multiplayer game is a single record that belongs to both players, so we cannot destroy your opponent's copy of it. Your side of that record is detached instead — your account id is removed and your nickname is replaced with a placeholder — so the game survives for your opponent but is no longer linked to you.
- What is kept, and for how long: the accounting record of your purchases (amount, date and transaction id), which Spanish commercial and tax law obliges us to keep for up to 6 years from the transaction. It is anonymised at deletion time — the email address and account id are stripped, so the record can no longer be traced back to you.
- Analytics and crash data are not affected: they were never linked to your email or nickname, and Firebase deletes them automatically according to its own retention window
- Note: deleting your account also deletes any unused credits and does not entitle you to a refund; refunds are handled by Google Play or the App Store
9. Changes to This Policy
We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically. Continued use of the app after any changes constitutes acceptance of the updated policy.
If you have any questions or concerns about this privacy policy, please contact us: