Privacy Policy

1. Who we are

Out of Book ("we", "us") is run by Nicolas Carnevale, an individual in Argentina. He decides how your personal data is used, so he is the data controller ("responsable de la base de datos" under Argentina's Law 25.326).

Contact for anything about your data: support@outofbookchess.com.

2. In short

• We keep what the app needs to work: your account, your repertoires and practice, and the games you ask us to import.
• No ads, no analytics, no tracking cookies. We don't sell your data, and we don't use it to train AI.
• You can download everything (Account → Download my data) or delete everything (Account → Delete account) yourself, at any time.

3. What we collect

Data	Where it comes from
Account: your email address; a hash of your password (we never store the password itself); your settings, such as language, board look and game filters	You
Google sign-in (if you use it): your Google account ID and email address, nothing else	Google
Signed-in devices: for each browser you're signed in on, its IP address, browser and operating system, and when it was last used. You see them under Account → Signed-in devices.	Your browser
Your content: repertoires, chapters, moves, notes on positions, and the PGN files you import	You
Practice history: for each answer, the move you played, whether it was right, how long you took and when	Created as you practice
Linked accounts: your Chess.com and Lichess usernames, your FIDE ID, how far back you chose to load games and when you last synced; for Lichess, an access token, stored encrypted	You, Lichess
Your games (see §5): moves, date, result, how the game ended, time control, rated or casual, your rating, your opponent's name or username and rating, a link to the game, and how the game compares to your repertoire	Chess.com and Lichess at your request; PGN files you upload
Security data: your IP address with a count of recent requests to sign-in and account pages (to stop password guessing); server logs with IP addresses, pages requested and errors	Your browser, our host
Emails we send you: address, content and delivery status	Our email provider

We don't ask for your real name, and we don't collect sensitive data (health, beliefs and so on). Your time zone and your language choice when signed out stay in cookies in your browser (§9).

Engine analysis runs entirely in your browser: we don't receive the positions you analyse unless you save them to a repertoire.

4. Why we use it, and on what legal basis

Purpose	Legal basis
Provide the service: your account, repertoires, practice, and importing and analysing your games	Performance of our contract with you (GDPR art. 6(1)(b); Law 25.326 art. 5(2)(d))
Sign you in with Google, if you choose to	Contract
Show your opponents' names and ratings in your games	Our legitimate interest in showing you your own games as they were played (GDPR art. 6(1)(f)). This data is already public on Chess.com and Lichess or in tournament records (Law 25.326 art. 5(2)(a)).
Keep accounts secure: signed-in devices, limits on repeated attempts, server logs	Legitimate interest
Account emails: confirming your email, password reset, email change, confirming account deletion	Contract
Answer authorities when the law requires it	Legal obligation

We don't send newsletters or marketing emails. Comparing your games with your repertoire only serves your own training; it has no legal or similar effect on you.

5. Your games: Chess.com, Lichess and over-the-board

• Chess.com. You link a username and prove it's yours by putting a code in your Chess.com profile's Location field (you can remove it once the account is verified). Our server then downloads your games from Chess.com's public API, one request at a time.
• Lichess. "Sign in with Lichess" gives us an access token without extra permissions. We store it encrypted and use it only to download your own games faster. We revoke it when you remove the account or delete yours.
• Over-the-board games. You give your FIDE ID and upload PGN files you got elsewhere, for example from chess-results. We keep only the games tagged with your FIDE ID; the rest of the file is discarded at once. For each game we keep the main line of moves and these details: event, site, date, round, both players' names, ratings and FIDE IDs, result, time control and opening code. We don't contact FIDE or chess-results.
• From online games we keep only the moves and the result, plus the details listed in §3. No chat, clock times or comments.
• Chess.com and Lichess see our server's requests for your games. Their own privacy policies apply to your use of their sites.
• We are not affiliated with or endorsed by Chess.com, Lichess or FIDE.

If you are an opponent in a user's game: we hold your username or name, rating (and, for over-the-board games, your FIDE ID) only as part of that game, and only that user sees it. Write to support@outofbookchess.com and we will remove your name from our copies.

6. Who we share it with

Service providers that process data for us, under data processing agreements:

Provider	What for	Where
Railway (Railway Corporation, USA)	Runs the app and its database, so it holds everything in §3	Servers in the Netherlands
Resend (Plus Five Five, Inc., USA)	Sends account emails: your email address and the email's content	United States

Independent services you choose to use, each under its own terms and privacy policy:

• Google, if you sign in with Google. Google learns that you signed in to Out of Book.
• Chess.com and Lichess, where your games come from (§5).
• Patreon, if you support Out of Book there. Patreon shows creators their members' Patreon names, email addresses and membership details. We use them only to manage memberships, and we don't link them to your Out of Book account.
• Instagram and Patreon links in the app are plain links: nothing loads from those sites, and they learn nothing about your visit until you click.

Fonts are served from our own server, so your browser makes no requests to Google Fonts.

We may disclose data when the law requires it, or to protect users' safety or our rights. If Out of Book is transferred to another operator, your data moves with it under this policy, and we will tell you first.

7. International transfers

Our servers are in the Netherlands. Argentina and the European Union recognise each other's data protection as adequate, so storing data there needs no further safeguard for users in either.

Some providers are US companies or store data in the United States: Resend keeps account data and email logs there, Google is a US company, and so is Railway. Where the law requires it, we rely on the providers' data processing agreements with standard contractual clauses (for the EU and UK) and the model clauses approved by Argentina's AAIP.

8. How long we keep it

Data	Kept until
Account, content and practice history	You delete them or your account
Games from a linked account, and their analysis	You remove that account (Insights → Your games → the account's menu → Remove…) or delete your account
Lichess access token	You remove the Lichess account or delete yours; we also revoke it on Lichess
Signed-in devices (IP address, browser)	You sign the device out, or 30 days after it was last used
Request counts per IP address	24 hours
One-time links (confirm email, reset password, delete account)	Used, or expired after at most 24 hours
Server logs	7 days
Email delivery records at Resend	30 days
Backups	30 days after the data is deleted

9. Cookies

We only use cookies the app needs to work, or that remember a choice you made. No analytics or advertising cookies, so we don't ask for consent.

Cookie	Purpose	Duration
better-auth.session_token	Keeps you signed in	30 days, renewed while you use the app
better-auth.state	Protects sign-in with Google	5 minutes, only during sign-in
lichess_oauth	Protects "Sign in with Lichess"	10 minutes, only during linking
theme	Your light or dark choice	1 year
tz	Your time zone, so days and streaks follow your calendar	1 year
locale	The language you picked	1 year

On HTTPS the first two names start with __Secure-.

10. Your rights

Wherever you live, you can:

• access your data and get a copy in a portable format: Account → Your data → Download my data (one JSON file). Repertoires also export as PGN ("Export PGN" in a repertoire's menu, "Export all" in the library);
• correct it: edit it in the app, change your email under Account, or write to us;
• delete it: Account → Delete account deletes everything at once; removing a linked account deletes its games;
• sign out any device: Account → Signed-in devices;
• object to processing based on legitimate interest, or ask us to restrict it.

For anything the app doesn't do for you, write to support@outofbookchess.com from your account's email address. We answer within the time the law sets:

• Argentina (Law 25.326): 10 calendar days for access requests; 5 working days for correction, update or deletion.
• GDPR and UK GDPR: one month, extendable by two months for complex requests.

EU, EEA and UK: you can also complain to your local data protection authority.

Argentina: you can exercise your right of access free of charge at intervals of no less than six months, unless you show a legitimate interest (Law 25.326, art. 14(3)). As Argentine rules require, this notice is reproduced in Spanish:

"LA AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, en su carácter de Órgano de Control de la Ley N° 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales."

11. Children

Out of Book is not meant for children under 13. In the EU/EEA you must also be old enough to consent to online services in your country (up to 16), unless a parent or guardian agrees. We don't knowingly collect children's data; if you believe a child has an account, write to us and we will delete it.

12. Security

• Passwords are hashed with scrypt, and Lichess tokens are encrypted (AES-256-GCM).
• Sessions are kept on our server, so signing a device out ends it at once.
• Sign-in and account pages limit repeated attempts.
• All traffic uses HTTPS, and only Nicolas Carnevale has access to the production data.
• If a breach puts your data at risk, we will tell you and the authorities as the law requires.

13. Changes

We will post changes here and update the date at the top. For important changes we will also email you before they apply.