Privacy Policy

1. Overview

TrueElo ("the Service") is committed to protecting your privacy. This Privacy Policy explains how we handle information when you use our chess analysis tool at trueelo.app.

Key Point: Sign in with Lichess, Google or email to use the analyzer, reports and practice. Your saved work stays privately under your TrueElo account. Connecting Lichess adds opening data and True Score at your level; Google and email also work without that connection. You can export or delete saved work, or delete the account itself. Limited identity, allowance and spending records remain as section 3.2 explains.

2. Information Collection

2.1 Sign-In and Optional Lichess Connection

Sign-in proves a Lichess identity, a Google identity or access to an email inbox. Google requests identity and email only, without your name, photo or contacts. Email uses a sign-in link delivered through Google Firebase, not a password. We keep the provider identifier and the email needed for the chosen login. Through Lichess sign-in or connection (OAuth 2 with PKCE), TrueElo reads:

• Lichess username: Shown in the account menu
• Lichess ratings and game counts: Used to tune analysis to your level

The OAuth token is stored in your browser's local storage, not on our servers. When you ask for a Leaks report of a Lichess account, the token goes to TrueElo's servers with that request so they can fetch its games; they use it for that request alone and never store it (section 3.3). TrueElo never posts to your Lichess account, and signing out removes the token. The public statistics pages work without signing in.

2.2 What We Do Not Collect

• Lichess passwords
• Precise device location (we do not request browser location access)
• Device fingerprints
• Cross-site browsing history

What you type into the contact form is excluded from session recordings. Submitting it sends your name, email, and message to Formspree. See section 4 for details.

2.3 Payment

If you buy TrueElo Plus, checkout and Manage subscription run on Lemon Squeezy's own pages, in a new tab. Lemon Squeezy is the merchant of record: it receives your name, email address, country, and payment details, and holds them under its own privacy policy. Section 4 says what comes back to TrueElo.

3. Data Storage

TrueElo keeps reusable chess statistics and the analyzer's engine results on your device. Your own saved data, including your Leaks reports, is kept privately under your account.

3.1 Local Cache

To avoid repeating work, TrueElo caches statistics and the analyzer's engine results in your browser:

• Game statistics: Aggregate win/draw/loss data fetched directly from Lichess, kept on your device against the position it describes
• Engine evaluations: Computed and cached in your browser. Evaluations visible on screen can also appear in a session recording.
• No personal data: The statistics cache holds chess positions and aggregate results, separately from your saved account data.
• Retention: Lichess statistics expire after six months. Engine results are reused until cleared or the engine version changes.

3.2 Your Own Data

Your own data is stored privately under your account, so it is there on every device you sign in to:

• your saved opening lines
• your drill progress
• the board positions captured from your own games
• your settings
• your practice-day history

It is stored with Google Firebase under your opaque TrueElo account ID. A private binding connects each proved sign-in method to that account. A copy is cached on each device for offline use. Other players cannot read your saved account records. Visible app content may also appear in the recordings section 4 describes. We do not sell your saved work or use it to train models.

Before connecting a sign-in method, this tab can temporarily keep your Analyzer position or Drill Explore line so you return to the same board, including after an expired sign-in attempt. Signing out or deleting device data clears them.

Leaks reports sit beside it under the same account, as section 3.3 describes. Export in Settings downloads the listed export contents, and Import brings that file back. Reports, source links and retained operational records are separate; contact us for an access request covering them. You can delete saved work — from your account and from this device — with Delete everything in Settings.

Delete everything destroys your saved opening lines, the board positions captured from your own games, the reports made from reading those games, the chess accounts you have linked, drill progress, practice-day history, unfinished practice sessions, retired generated practice, settings, stored engine evaluations, the games your reports read, report progress records, practice positions not yet opened. What stays is ours rather than yours:

• which free reports you used before Leaks was rebuilt
• which one-time report rebuilds have already completed
• removal records that keep unfinished work from restoring deleted reports
• how many accounts you have ever linked as your own
• whether you have used your free report, how many reports you started today, and how much reading your reports used this month
• how many new practice positions you opened today

Keeping those is what stops one press of the button resetting that record; these bookkeeping records can include account and chess-source identifiers, timestamps and whether an allowance was used. Your billing records also stay (section 4).

“Delete my account” in Settings goes further: it removes the account itself, its sign-in, and everything Delete everything takes. Billing evidence and sign-in, allowance, source-funding and spend records stay to preserve ownership boundaries and prevent renewed free allowances. Some retain account or source identifiers; they do not restore your deleted reports or practice. Signing in again through a former sign-in method starts a new TrueElo account; nothing deleted comes back.

3.3 Leaks Reports

Your TrueElo account credential authorizes each report request. A Leaks report is read on TrueElo's servers (Google Cloud, United States). When you ask for one, the servers fetch that account's public games from Lichess or Chess.com (for a Lichess account read before, only the games played since) and read them. The Lichess games a report reads are kept under your account, without the opponents’ names, until you remove that account. Also kept: the report, the practice it supplies, and the engine’s evaluations of the positions, so the next report is faster. Chess.com games are read and dropped, never stored. When you ask for a report of a Lichess account, a connected Lichess token can go with the request, because Lichess sends games faster to a signed-in request (fastest for your own); the servers use it for that request alone and never store it.

• The report: what it found, with the few positions from your games it shows as examples
• Practice: the positions from your games the report gave you to practise, each stored as the moves that reach it with a link to its game, and your progress on them
• Position evaluations: the engine's evaluation of each position, stored against the position itself, so a later report of the same account is faster
• Lichess games: the newest games a report of a Lichess account read, yours or one you scout, up to 1,000 per account and speed, with their moves, clock times, ratings, opening and result but not the opponents' names, so a later report fetches only the games played since. Chess.com games are never kept
• A record of each time your games were read: when it ran, which account and speed, how many games it read, how it ended, and the first facts about your games it showed you while it worked

None of it holds the name of anyone the games were played against, and only the Lichess games above hold whole games. The report, practice and the record of each time your games were read are readable by your account alone; the evaluations and games are read only by TrueElo's servers, for your reports. Delete everything and Delete my account remove it with the rest of your data.

Current proof of the same mailbox or an attached login shares free-report rights, without combining saved accounts. A third-party Google address may need an inbox check before a free report. Private records preserve spent rights and bound repeat attempts, source funding and modeled computation across deletion and return. They can retain account and source identifiers, verification status and timestamps. We do not use device fingerprints or claim these checks identify one human.

4. Third-Party Services

TrueElo uses the following third-party services:

5. Chess Engine Processing

The analyzer and drill grading run the chess engine in your web browser, on your device:

• Positions you open in the analyzer or play in a drill are not sent to any server for engine analysis
• Boards and recommendations displayed in the app may appear in session recordings

A Leaks report is the exception: its games are read by the engine on TrueElo's servers, and the evaluations it keeps are the ones section 3.3 lists.

6. Data Retention

• Local cache: Lichess statistics expire after six months; engine results are reused until cleared or the engine version changes.
• Your own data: Kept under your account until you delete it in Settings. This includes Leaks reports, practice and position evaluations (section 3.3).
• Games a Leaks report reads: Lichess games are kept under your account, without the opponents' names, until you remove that account or delete your data or account (section 3.3); Chess.com games are held in server memory while the report is read, then dropped
• Lichess OAuth token: Stored in your browser; removed when you sign out
• Billing records: Kept for as long as tax and accounting rules require, including after you delete your account (section 4)
• Messages you send us: Kept with our support records; deleted on request
• Analytics: PostHog keeps events for up to seven years and recordings for 30 days; deleting your account deletes those linked to it (section 4)
• Answers to our short questions: Kept with analytics records, and deleted from PostHog with your account; the copy in our Slack workspace is deleted on request through the contact form

You can delete the saved account content listed in section 3.2 with “Delete everything” in Settings, and the account itself with “Delete my account”. Deleting saved content does not delete analytics; deleting the account deletes its PostHog person with the events, recordings, error reports and answers linked to it (section 4). Clearing your browser's site data on its own only clears this device — signing in again brings your account's copy back.

7. Hosting and Server Logs

TrueElo serves a static frontend with server endpoints for authenticated account operations. When you visit the site, our hosting provider may generate standard web server logs, which could include:

• IP address
• Browser type and version
• Pages visited and timestamps
• Referring URL

These logs are controlled by the hosting infrastructure, not by TrueElo. We do not access, analyze, or process these logs. Contact the hosting provider for their data practices.

8. Data Security

What is stored, and how it is protected:

• Local cache: Chess positions, aggregate game statistics and the analyzer's engine results stay on your device
• Your own data: Held under your opaque TrueElo account ID with Google Firebase, and readable by your account alone — enforced by access rules on the database itself, not only by the app
• Diagnostics: Error reports go to PostHog as described in section 4

We use HTTPS for all connections to encrypt data in transit.

9. Your Rights and Data Portability

Your data is yours, and you can take it or remove it at any time:

• Access: View your data in the app at any time
• Export: Download everything as a single file with Export under Backup in Settings.
• Portability: Export your repertoire as standard PGN
• Delete: “Delete everything” in Settings removes it from your account and this device
• Delete your account: “Delete my account” in Settings removes the account, its sign-in, and everything “Delete everything” takes. Billing evidence and sign-in, allowance, source-funding and spend records stay to preserve ownership boundaries and prevent renewed free allowances. Some retain account or source identifiers; they do not restore your deleted reports or practice.

Whatever the law of the place you live gives you beyond that — access to, correction of, or erasure of personal data we hold, including the billing records section 4 describes where the law allows — you can ask for by writing to support@trueelo.app.

Your Lichess account itself is governed by Lichess — revoking TrueElo's access is available in your Lichess account preferences.

10. Children's Privacy

TrueElo accounts are for people aged 16 and over, and we do not knowingly keep an account or personal data for anyone younger. If we learn that we have, we delete the account and its data. The public opening statistics need no account and are open to everyone. If you believe someone under 16 holds an account, write to support@trueelo.app.

11. International Users

TrueElo uses cloud services that may store data across multiple regions globally. See the Firebase Privacy Policy, Lichess Privacy Policy, Formspree Privacy Policy, and Lemon Squeezy Privacy Policy for their international data handling practices. PostHog's transfer of analytics to the United States is described in section 4.

TrueElo is run by one person in Israel, in English, priced in US dollars, and is not directed at any particular country. We therefore take the position that the EU and UK GDPR provisions that would require us to appoint a representative there (Article 3(2) and Article 27) do not apply to it (EDPB Guidelines 3/2018, Example 10; Recital 23). Were they to apply, we consider the processing this page describes limited and low in risk, which is the exemption Article 27(2)(a) provides. Write to support@trueelo.app with any question or request. You also have the right to complain to the data protection authority where you live.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be indicated by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

Material changes will be reflected in the date; continued use after changes constitutes acceptance.

13. Contact

TrueElo is operated by one person, who is the controller of the data this page describes. For questions about this Privacy Policy or to exercise a right under section 9, write to support@trueelo.app or use the contact form.