Privacy Policy

• Most of e2e8 works without an account. Then we store nothing that names you: only the anonymous counts described below.
• The chess engines run in your browser, on your device. Your games are not sent to us to be analysed.
• No ads, no tracking cookies, no selling or renting of data, and no marketing emails.
• If you create an account, we keep your email, the name you chose and your training history, so the app can remember your progress.
• You can download a copy of your data and delete your account in Settings, at any time.

e2e8 (e2e8.app) is run by Iaroslav Kit, Port Saplaya, 46120 Alboraya (Valencia), Spain, who is the controller of your personal data. Write to privacy@e2e8.app about anything on this page. A person answers.

• Engines in your browser. Stockfish and the bot's neural network are downloaded to your browser and run there. They are kept in your browser's cache so they do not download again.
• Shared evaluation cache. When you analyse a position, the position and the engine's evaluation may be added to a shared cache so the next person gets the answer faster. It holds no account id, name or IP address.
• Importing games and looking up players. A username you type - to import your games, or to scout a player or play their twin - is sent to Lichess or Chess.com to fetch that player's public games: from your browser, or for Lichess through our server. A Lichess game link you paste into the analysis is fetched by your browser straight from Lichess. We keep neither the games nor the name. If you are signed in, an analysis you run is saved to your account, with the players' names from the game.
• Work kept until you sign in. If you analyse a game, play the bot or solve puzzles without an account, this browser keeps that work for 24 hours (at most 30 puzzle answers), so it can be saved to an account you sign in to on this browser within that time. Puzzle answers saved this way change no rating. None of it reaches us before then.
• Request logs and limits. Like any website, our host (Vercel) receives your IP address and browser details with each request and keeps short-lived logs under its own retention. Our servers hold your IP address in memory for a few minutes, to stop one address from overloading a feature. For a few features - importing Lichess games through our server, and the master-game archive's search, name suggestions, move statistics and view count - that count is shared between our servers in our database. There it is kept under a one-way code made from your address with a secret key, never the address itself; an IPv6 address counts by its first half, the part one subscriber holds.
• The check on the sign-in forms. Our sign-in and sign-up forms can ask your browser to pass Cloudflare Turnstile, which reads signals from the browser to tell people from automated sign-ups. We receive only whether the check passed.

• Account: your email address, your password (stored only as a hash by our authentication provider) and the name or nickname you chose.
• If you sign in with Google: Google tells us your email address and your name, confirms the address, and gives a link to your Google profile picture. Your Google name becomes your display name, which you can change in Settings; the picture link stays with your sign-in details and is not shown anywhere. We get no password and nothing else from your Google account.
• Your consent: which versions of these documents you accepted, when, and your confirmation of your age.
• Optional profile: an avatar image, a short bio, and the Lichess and Chess.com usernames you link. We do not ask for a parent's or guardian's email.
• Training history: your puzzle answers (the move, the result, the time taken, hints used, rating changes) and the missed puzzles scheduled to come back for review, games against the bot, mistake drills, Woodpecker sets, opening repertoires with their review schedule and the lines you switched off or wrote notes on, endgame attempts, placement test results, your daily study sessions, saved game analyses (which include the players' names and ratings from the game), your rating history synced daily from Lichess or Chess.com if you linked them, XP and streaks, and in-app notifications. To count your training days in your own time, your browser sends its time zone with the request; we do not store it.
• Reminder emails: whether you have switched them off, and the last day one was sent.
• Where your account came from: the tool you were using when you signed up and, only if you answer the optional question, how you heard about e2e8. We use these to learn which parts of e2e8 bring people in.
• Sign-in records kept by our authentication provider to keep your session secure.
• Closed modules. Courses, classes and the habit, task and budget tracker are closed for now and take nothing new. Anything entered while they were open is part of your account: downloaded and deleted with it.

• You.
• Your coach, if you link one: they can see your training data and linked usernames, so they can coach you. Students of the same coach see each other's name, XP, streak and rating on that coach's leaderboard.
• Anyone you send an analysis link to can open that one analysis: the game, with the players' names as the game records them, and its review. The preview image a chat app shows for the link carries the final position and the accuracies, not the names.
• Anyone you send a result link to (Puzzle Storm, Puzzle Streak) sees that run's score, its squares and its date, not your name. The link names the run in a sealed form that cannot be read or altered.
• Two administrators can see account data to run and support the service. They see it only for that purpose.

If you connect your Lichess account, the access token and your Lichess username stay in your browser's storage and are never sent to our servers. Your browser talks to lichess.org directly, including when you play games through our board; we store nothing about those games, unless you open one in our analysis while signed in, when it is saved like any other analysis. Disconnecting in e2e8 also revokes the access at Lichess, and you can revoke it in your Lichess account's security settings at any time. Lichess is an independent service with its own privacy policy.

We measure use in two ways, neither of which uses cookies or a device identifier:

• Page views through Vercel Web Analytics: which pages are visited and where visitors came from, counted in aggregate. We strip everything after # from addresses and keep only campaign tags (utm_*) and the referring site from the query.
• Product events in our own database: short records such as "a puzzle set was finished" or "a save failed", with the page path, the country derived from your connection at that moment, and - for the visit you arrived on - the referring site and any campaign tags (utm_*) in the address. When a page breaks, the event holds the first 120 characters of the error message. We do not store your IP address or browser details with them. If you are signed in, the event is linked to your account. We keep them for 13 months.

We send only the emails an account needs: confirming your address, resetting your password, and - if you build opening repertoires - a reminder on a day when reviews are due, at most one a day. Every reminder has a link that stops them, and Settings switches them off and on. They are sent through Resend. We do not send marketing emails.

• Contract: running your account and the training features you use.
• Legitimate interests: keeping the service secure and working (logs, rate limits, the check on the sign-in forms), the shared evaluation cache, review reminders you can switch off, and measuring use in the privacy-friendly way described above.
• Consent: optional profile fields and connecting other services, which you can remove at any time.
• Legal obligation: records the law requires us to keep.

• Supabase - database, sign-in and file storage. Data is stored in Frankfurt, Germany.
• Vercel - hosting. Pages are served from Vercel's worldwide edge network; our server functions run in Washington, D.C., United States.
• Resend - sending emails, from its Ireland region.
• Cloudflare - our domain's DNS, the Turnstile check on the sign-in forms, and, once switched on, the network that serves the chess engines' files to your browser.
• Google - only if you choose to sign in with Google: it confirms who you are and sends the details named in section 3.

Services you choose to use, with their own privacy policies: Lichess and Chess.com. Lichess also answers the opening statistics, cloud evaluations and endgame tablebase lookups for the positions you look at. Those requests carry positions, not your account; the tablebase lookups go from your browser straight to Lichess, so Lichess sees them like any website sees a visit. We also fetch opening descriptions from Wikibooks through our server, without any personal data. Coach features that use payments, video and live classes (Stripe, Cloudflare Stream, LiveKit) are not part of the student product.

Where data leaves the European Economic Area - our server functions in the United States - it is protected by the EU-US Data Privacy Framework and/or the Standard Contractual Clauses in our providers' data processing agreements.

• Account and training data: until you delete them or your account. You can delete any saved analysis yourself in My analyses.
• When you delete your account in Settings and have never paid for a course, we delete the account and everything in it straight away, including any avatar image you uploaded. A checkout you started and did not finish is not a payment and does not change this.
• If you have paid for a course, or you also coach on e2e8, the payment records are kept for accounting. Then we remove your email address, name, avatar, bio, linked chess usernames, saved game analyses, any feedback you sent with its screenshots, and the record of where your account came from, remove your avatar images, and close the login for good; your other training records stay attached to an anonymous id. If you want those removed too, write to privacy@e2e8.app and we will delete them within 30 days.
• Work kept in your browser until you sign in: 24 hours.
• Product events: 13 months. Rate-limit counts in our servers' memory: minutes. The coded counts in our database: one day - they are deleted every night once their window has ended. Our providers' logs and backups: their own retention periods.

You can ask to see, correct, export or delete your data, to restrict or object to how we use it, and to withdraw consent. In Settings you can correct your profile, download a copy of everything in your account as one file, and delete your account; My analyses exports your analysed games as PGN, and your repertoires export as PGN too. For anything else, write to privacy@e2e8.app. We answer within one month. You can also complain to a data protection authority, in your own country or in ours: the Agencia Española de Protección de Datos (aepd.es).

To create an account you must be at least 16 years old if you live in the EU or EEA, and at least 13 elsewhere. Every way into an account asks you to confirm this, including signing in with Google, which asks before the account can be used. Where the law of your country requires a parent's permission at your age, you need it. If we learn that an account belongs to someone younger, we delete it. There are no ads and no profiling for marketing anywhere in e2e8.

• Cookies: the sign-in session (needed for the account to work), and cookies used only by our two administrators (their sign-in, and test switches that change only their own screen).
• Local storage: your settings (theme, sound, board look and size, puzzle preferences, the choices for your next Woodpecker set); progress that should survive a refresh (an unfinished puzzle set, a repertoire you are building, a review plan, the queue of games being analysed); a cache of engine evaluations; your chosen bot opponent; the puzzle and path level you picked; your placement result if you took the test without an account (copied to your account if you then sign up); your daily puzzle results; work kept for 24 hours until you sign in (section 2); the Lichess tokens described above; and, for an hour during a Google sign-up, the page you signed up from.
• Session storage: the Lichess sign-in handshake, a game being handed over to analysis, a placement test or a bot game in progress (so a refresh does not lose it), and the last analysis you saved.
• Cache storage: the engine and neural-network files (tens of megabytes).

None of this is used for advertising or to track you across sites, so there is no cookie banner. Clearing your browser's site data removes all of it.

Connections are encrypted. Each table holding personal data is protected by row-level security, so an account can read only what it is allowed to. Passwords are stored only as hashes, and service keys stay on the server. If a breach puts your data at risk, we will tell the authority within 72 hours where the law requires it, and tell you.

Our archive of master games contains player names from published tournament records, and our puzzles and the Lichess opening statistics come from Lichess's public data, which contains Lichess usernames. When someone scouts a player, we show that player's public games as Lichess or Chess.com serve them at that moment, and keep nothing. If you appear in any of this and want something removed, write to privacy@e2e8.app.

When this policy changes in substance, the version and date at the top change, and we say at the top of this page what changed.