Privacy policy

Last updated: 30 September 2026

This policy explains what information Chess Next Move (www.chessnextmove.com, “the site”) collects, why, and the choices you have.

Who we are

The site is run by Lestial Ltd (“we”, “us”). We are the controller of the personal data described here. For any question or request about your data, email support@chessnextmove.com.

What stays on your device

• Positions and moves. The board, the moves you play and the engine’s analysis live in the page’s memory and are gone when you close the tab. The engines (Stockfish and GarboChess) run inside your browser, not on our server.
• Settings. Your choices in Settings (search depth, number of lines, time limit, coordinates, piece set and theme) are saved in your browser’s local storage under cnm.settings, so they are still there next time. They are never sent to us. Clearing your browser’s site data removes them.
• Engine files. The engine files are kept in your browser’s cache (cnm-engines) so they don’t download again on every visit. They contain no information about you.
• Copying a position. When you press Copy, the position’s FEN is written to your clipboard. Nothing is sent anywhere.

What our server receives

Like any website, our server receives the technical details of each request your browser makes: your IP address, the address you asked for (which may include a position, for a link with ?fen=), the time, and your browser’s user agent. We use them only to deliver the site, keep it secure and fix errors. Server logs are kept for a short time and are not combined with other data or used to identify you. The server is run for us by a hosting provider, which processes this data only on our instructions.

Accounts and Google sign-in

An account is optional: everything the site does today works without one. You can create an account with an email address, a username and a password, or sign in with your Google account.

What we receive from Google

When you choose “Sign in with Google”, Google asks whether Chess Next Move may see your basic profile. If you agree, Google sends us:

• your name and profile picture;
• your email address, and whether Google has verified it;
• your Google account ID, a number that tells us it is the same Google account next time.

We ask only for these basic scopes (openid, email, profile). We don’t ask for, and can’t see, your Gmail, Google Drive, contacts, calendar or any other Google data, and we never see your Google password.

How we use Google user data

• to create your account, sign you in, and recognise you when you come back;
• to show your name and picture in the site’s account menu;
• to email you about your account (for example about security or changes to it). We don’t send marketing email.

We don’t:

• sell Google user data, or use it for advertising, including personalised ads;
• share it with anyone, except the service providers named below that run the site for us, or when the law requires it;
• use it to develop, improve or train artificial intelligence or machine learning models;
• let people read it, unless you ask us to, it is needed for security or to investigate abuse, or the law requires it.

Chess Next Move’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we store

• Your account: email address, username, name, profile picture link, whether your email is verified, and when the account was created.
• Password: if you set one, only a salted hash (scrypt). We can’t read your password.
• Google sign-in: your Google account ID and the tokens Google issues when you sign in. We use the tokens only to complete sign-in, never to access other Google services.
• Passkeys: if you add one, its public key and name. The private key stays on your device.
• Sessions: a sign-in cookie in your browser and, for each session, its IP address and browser user agent, so sessions can be listed and ended and abuse can be detected.

Account data is kept in our database on our hosting provider’s servers. Verification and password-reset emails are sent through Amazon Web Services (Amazon SES), which processes your email address only to deliver them.

Keeping and deleting account data

We keep your account data while your account exists. You can delete your account at any time from your account settings or by emailing support@chessnextmove.com. We then delete your account and everything linked to it, including the data received from Google, within 30 days, except what the law requires us to keep. Sessions you sign out of are deleted. You can also remove Chess Next Move’s access to your Google account at any time in your Google account’s third-party connections.

Google Analytics

We use Google Analytics 4 to learn how many people use the site and whether it works well. On each visit it records a page view, and three events: pressing Play, pressing Move, and how long an engine took to load. The page address sent to Google has the position removed. Google Analytics uses cookies (_ga and _ga_*) and receives your IP address, device and browser details, and an approximate location derived from them. Google Analytics 4 does not log or store IP addresses. We keep analytics data for no longer than 14 months, and we never use it to identify you.

You can block Google Analytics with the Google Analytics opt-out browser add-on. How Google uses this information is explained in How Google uses information from sites or apps that use its services.

Advertising

The site is free because it shows ads from Google AdSense. Google chooses the ads and where they appear on the page.

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this site or other websites.
• Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet.
• You may opt out of personalised advertising in Google’s My Ad Center, or opt out of some third-party vendors’ use of cookies for personalised advertising at aboutads.info (US) or youronlinechoices.eu (Europe).

If you opt out, or don’t give consent, you will still see ads, but they won’t be based on your interests. See Google’s advertising policy for how Google uses ad cookies.

Consent and your privacy choices

In the European Economic Area, the United Kingdom and Switzerland, Google Analytics and ad cookies stay off until you make a choice in Google’s consent message, which lists Google’s advertising partners. Until then, and if you decline, Google receives only limited, cookieless signals and shows non-personalised or limited ads. Elsewhere, analytics and ad cookies are on by default, and you can turn them off with the opt-outs above or your browser’s settings.

You can change or withdraw your consent at any time:

Privacy choices

If nothing opens, Google’s consent message is not shown in your region or your browser is blocking it. You can always delete cookies and site data in your browser’s settings.

Links to other services

• Feedback. The Feedback link opens a Google Form. What you type there is collected by Google Forms and shared with us so we can read it. Please don’t include personal information you don’t want us to have.
• Share buttons. The Facebook and X buttons are plain links. The site loads no scripts from Facebook or X; they receive information only if you click, under their own privacy policies.

Legal bases (EEA, UK and Switzerland)

• Analytics and advertising cookies: your consent, which you can withdraw at any time.
• Server logs: our legitimate interest in delivering the site and keeping it secure.
• Settings and engine files in your browser: they are strictly necessary for features you use, and they never leave your device.
• Your account, including data received from Google: performing our agreement with you to provide the account you asked for.
• Feedback you send: our legitimate interest in reading and answering it.

International transfers

Google may process data in the United States and other countries. Google LLC is certified under the EU–US Data Privacy Framework and its UK and Swiss extensions, and it also relies on the European Commission’s standard contractual clauses.

Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, to object to or restrict its use, to data portability, and to withdraw consent. Without an account we hold very little that can be linked to you, and most requests concern Google’s cookies, which you can manage with the choices above and in your Google account. For a copy of your account data, to correct it or delete it, or for anything else, email support@chessnextmove.com. You can also complain to your data protection authority.

US state privacy laws. Under some US state laws, including California’s, letting Google use advertising cookies can count as “selling” or “sharing” personal information. You can opt out with Google’s ad settings and the industry opt-outs above, or by emailing us. We don’t sell personal information in any other way.

Children

The site is for a general audience and is not directed at children under 13 (or the minimum age in your country). We don’t knowingly collect personal information from children. If you believe a child has sent us personal information, contact us and we will delete it.

Security

The site is served only over HTTPS. Positions and settings never leave your browser. Account data is kept in a database that only the site’s server can reach, passwords are stored only as hashes, and the sign-in cookie cannot be read by scripts on the page.

Changes to this policy

We will update this policy when the site changes what it collects, and change the date above. If a change matters, we will say so on the site.

Contact

Lestial Ltd. Email: support@chessnextmove.com.