Privacy notice

Who is responsible

Chess Garage is run by Bojan Vučković, a private individual in Serbia, who is responsible for the personal data described here (the controller).

For anything about your data or this notice, write to contact@chessgarage.com. You get an answer within one month.

Without an account

You can enter and annotate Games and run the engine without signing in. Nothing about you is then stored on Chess Garage’s servers:

• The Games on the board stay in your browser tab, and are gone when you close it or reload the page.
• Your settings (the board’s look, the notation, the theme, the engine’s and the Opening Explorer’s choices, the sizes of the panes) are kept in your browser’s local storage, on your device only. Clearing the site’s data in your browser removes them.
• The engine, Stockfish, runs in your browser: the positions it analyses aren’t sent anywhere.

Chess Garage sets no cookies and uses no analytics, tracking or advertising. Its pages, fonts and pictures all come from its own site, not from other companies’ servers. The site is delivered by Microsoft’s Azure Static Web Apps, which, like any web server, sees your device’s network (IP) address in order to send the pages; Chess Garage keeps no record of these visits.

With an account

Your sign-in account

Signing in, with an e-mail one-time code, a Google account or a Microsoft account, uses a sign-in account in Chess Garage’s directory in Microsoft Entra External ID, a sign-in service Microsoft runs for Chess Garage. Signing in for the first time creates it. It holds your e-mail address, the display name you give when you sign up, that you agreed to the terms of use when you signed up, and, when you sign in with Google or a Microsoft account, the link to that account. The directory is set up with Sweden as its country, so Microsoft keeps it in its data centres in Europe. Microsoft’s sign-in page sets its own cookies, to keep you signed in there.

When you sign in with Google or a Microsoft account, Google or Microsoft also learn that you signed in to Chess Garage, under their own privacy policies.

Each sign-in method is a separate account, even for the same e-mail address: the Games you save after signing in with Google aren’t there when you sign in with a one-time code sent to that address, and the other way round. Sign in the same way each time.

Chess Garage’s own servers keep your data under an identifier of your sign-in account. They store neither your e-mail address nor your name. While you are signed in, your browser keeps the sign-in (Microsoft’s tokens, which can hold your name and e-mail address) in the tab’s session storage, and a note in its local storage that you are signed in, so that the start page takes you straight to the board. Signing out removes both.

What you store

• Your Games, with everything in them as you enter or import them: the moves and Variations, the comments and other Annotations, and the header (the players, event, site, date, round, result, ratings, opening code and any other header). The header’s main fields are also kept apart, so that the Library can search and sort by them.
• Your Collections, with their names and order, and your Tags.
• The list of Games you have open in the workbench, and the five Collections you viewed most recently.
• When each Game and each Collection was created and last changed.

Nobody else can see them in Chess Garage. They are kept in a PostgreSQL database in Microsoft Azure’s Sweden Central region (Sweden). The service that reads and writes them, Chess Garage’s API, runs in Azure’s West Europe region (the Netherlands). Both are in the European Union.

Logs and limits

The API logs every request it answers: when it came, what it asked for (the address of the request, which can hold a search you typed in the Library or a position in the Opening Explorer), how it was answered, and the network address the connection came from. The log doesn’t name you or your sign-in account. It is kept for 30 days in Azure’s Sweden Central region, then deleted.

So that one account can’t overload the service, the API counts each account’s changes (each save, delete or move of a Game, and each change to Collections, Tags or open Games) and imports. The counts are kept only in the API’s memory, never in the database or the log, and are dropped within about an hour after you stop.

Why it is processed

• Your sign-in account and what you store: to provide Chess Garage as the terms of use describe it (a contract with you; GDPR Article 6(1)(b), and the same ground in Serbia’s Law on Personal Data Protection).
• The log and the counts: to keep the service running and secure (a legitimate interest; GDPR Article 6(1)(f), and the same ground in Serbia’s law).

Chess Garage doesn’t sell your data, share it for advertising, or make automated decisions about you.

Who else handles it

• Microsoft hosts the site, the API, the database and the log in Azure, and runs the sign-in (Microsoft Entra External ID), on Chess Garage’s behalf.
• Google, if you sign in with a Google account, and Microsoft, if you sign in with a Microsoft account, under their own privacy policies.
• Cloudflare runs the domain’s DNS, redirects www.chessgarage.com and the earlier address chess-labyrinth.com to chessgarage.com, and forwards e-mail sent to contact@chessgarage.com.
• Google keeps the e-mail you send to contact@chessgarage.com, and the answers, in Bojan Vučković’s Gmail mailbox.

How long, and how to delete it

What you store is kept until you delete it. A Game you delete is deleted from the database at once.

To delete everything at once, choose Delete account… in the account menu at the top right of the board. It deletes all your Games, Collections and Tags and your lists of open Games and recent Collections, removes what the browser kept of your work, and signs you out. It can’t be undone: export the Games you want to keep first (the Library exports them as PGN). Your settings stay in your browser until you clear the site’s data there.

The database’s backups still hold a copy of deleted data for up to 7 days, and the log keeps its entries for its 30 days; then they are gone too.

Deleting your data doesn’t delete your sign-in account. To have it removed too, write to contact@chessgarage.com from its e-mail address, saying which sign-in methods you used. It is removed within one month.

Your rights

Under Serbia’s Law on Personal Data Protection, and under the GDPR when you are in the European Union, you can ask to see the personal data Chess Garage holds about you, to correct it, to delete it, to restrict or object to its processing, and to receive it in a portable form. Much of this you can do yourself: the Library shows, changes, exports and deletes your Games. For anything else, write to contact@chessgarage.com.

You can complain to Serbia’s Commissioner for Information of Public Importance and Personal Data Protection (Poverenik) or, in the European Union, to the data protection authority of your country.

Chess Garage doesn’t ask for your age or your date of birth.

Changes

When this notice changes, the new version is published on this page with its date.