Privacy Policy

1. Who we are

Middlegame is a chess-improvement tool that builds an engine-grounded, AI-written “Player Profile” from a player’s publicly available games, and offers game reviews, insights, and training puzzles. We operate the website and the service described here.

Middlegame is run by Jay Kumar and Steve Kriz (United States), who are the data controllers responsible for your personal information. You can reach us by email or at the postal address in Section 12.

2. The information we collect

Information you give us when you create an account:

• Your Lichess username and an access token issued by Lichess. Signing in with Lichess is the only way to use Middlegame. The token stays in your browser: our server uses it to confirm who you are and does not save it. With your consent (the puzzle:read permission you grant on Lichess), we read your Lichess puzzle activity to track which recommended training puzzles you’ve completed.
• Your email address, if you start a season, used only to send you check-in emails for your season (Section 7). Signing in never requires an email address or a password.

Chess information from your Lichess account:

• The public game data for your Lichess username, which we retrieve from the Lichess public API. This game data is already public on Lichess.
• The analysis we derive from those games and store on your behalf: your Player Profile, single-game reviews, insights, puzzle plans, chess-engine evaluations, longitudinal “player memory” (the running notes we keep about your play), your season (goals and progress), your content views (which recommended study material you’ve opened), the positions from your own games that you practice on, and how each attempt went (when you tried it, the game and move, the page you practiced on, which of your openings it came from, the phase of the game, how many tries you took, the last move you tried, whether you found the move Lichess preferred or were shown it, and Lichess’s own label for the move you played), and the check-ins we write for you.

When you start a season:

• We ask for an email address so your weekly check-in emails can reach you between sessions, and you confirm you’re 13 or older. We store this email as the contact alongside your season. We treat the address as consented but unverified: we don’t send a confirmation email first; if a message bounces or you mark it as spam, we stop emailing that address.

Information we generate automatically:

• Usage counters (timestamps and counts of analyses you run), used to enforce fair-use rate limits and kept for about 30 days.
• Your IP address, which we use briefly, in memory, to enforce rate limits. We do not save it.
• Server logs of technical events (which feature ran, how long it took, and the Lichess username it ran for), which we use to keep the service working. They are rotated away after a short time.
• Signup counts: to see how many visitors go on to build a profile, we count a few steps each day: a visit to the home page, a click on “Build your free profile”, a first sign-in with Lichess, and the start of a first profile build. These are daily totals only. They hold no account, IP address, cookie or device identifier, and nothing is stored on your device, so a count cannot be linked to you.
• Local browser storage: we store a cached copy of your profile and analysis, your sign-in session, and your theme preferences in your browser (IndexedDB and localStorage) so the app works smoothly. This stays on your device.

What we do not collect: we do not use advertising analytics or cross-site trackers. We count page visits with Cloudflare Web Analytics, which sets no cookies and does not identify you (it sees the page, the referring site, the browser type and the country). When the app hits an error, Sentry receives an error report (what failed, the page address and the browser type) so we can fix it; it does not include your email address or name, and Sentry does not store your IP address. Our check-in emails are transactional, not behavioral tracking (we send them as part of your season, not to profile your behavior). We do not collect payment information (the service is currently free), and we do not collect precise geolocation.

First-party, consented usage metrics we record. To understand whether your season is actually helping you, we record a small set of first-party, consented usage metrics about your own season, server-side and tied to your account, with no third-party tracker and no email open-pixel. Because our check-in emails are plain text, there is no open-pixel, so we cannot and do not track whether you opened an email; instead, a click on a link in the email is our honest proxy for engagement. The metrics we record are:

• a check-in email was delivered to you;
• whether you clicked a link in that email (our stand-in for an open, since plain-text email has no email open-pixel);
• whether you returned to the app from that link;
• whether you completed a season;
• your renewal choice when offered a next season; and
• the negative channel signals: unsubscribe, an email bounce, or a spam complaint.

These are operational measurements of a service you chose to start; we never use them for advertising or to build a behavioral profile of you. We record only that an event happened (and, for a bounce or complaint, the provider’s reason code), never the contents of a game, message, or email.

3. How we use your information

We use the information above only to:

• build and show your Player Profile, reviews, insights, and puzzle plans;
• send you check-in emails for your season;
• understand whether your season is working for you (whether emails reach you, whether you return, and whether you finish and want another), so we can improve the check-ins, never for advertising or profiling;
• authenticate you and keep you signed in;
• enforce fair-use rate limits; and
• operate, maintain, and improve the service.

We do not use your information for advertising, and we do not sell it (see Section 6).

4. Public profiles (please read)

A core feature of Middlegame is a publicly viewable Player Profile. You should understand how this works:

• When you build your Player Profile, a public card for it is created automatically at middlegamechess.com/p/lichess/<username>, so you can share it. Anyone with the address can see it.
• Only you can build a profile for your Lichess account. Nobody can generate one for a username that is not their own.
• The public card shows your Lichess username, your playing-style archetype and attribute scores, and how many games were analyzed with their average rating. It does not include the written narrative, your email, or your real name.
• Takedown: you can ask us to remove or hide your public card at any time by emailing privacy@middlegamechess.com. Deleting your account removes it too.

5. Who we share information with (sub-processors)

We do not sell your information. We share it only with the service providers (“sub-processors”) that we use to run Middlegame, and only as needed to provide the service:

We also retrieve public game data, and (with your puzzle:read consent) your puzzle activity, from Lichess via its public API. Lichess is the source of that data, not a processor of your account information.

International transfer. Today, Anthropic’s Claude writes the text, in the United States. If we switch models, the game-derived inputs used to write your profile text may be processed outside the United States, including in China (DeepSeek), and we will update this policy before we do. We disclose this so you can make an informed choice about using the service.

6. We do not sell or “share” your personal information

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are used under the California Consumer Privacy Act (CCPA/CPRA). We have not done so in the past 12 months.

7. How long we keep your information

We keep your account information and the analysis we generate until you delete it or delete your account. You can delete your data at any time (see Section 8). Your public card is kept until you request takedown or delete your account. Copies of the database that we keep as backups can still contain deleted data until those copies are removed. Signing out ends your session on that device; the cached analysis in your browser stays until you clear your browser’s site data.

The first-party usage metrics described in Section 2 are kept alongside the rest of your account data and are deleted when you delete your account. They are removed together with your account, with the one exception of the bounce/complaint suppression record (the do-not-email safety net, described below). We do not run a separate retention clock on these events; they simply live and die with your account.

Check-in emails (Postmark). Our email provider, Postmark, retains the content and delivery events of the check-in emails we send for 45 days by default, after which the message content is deleted. Postmark and we independently keep an email suppression list indefinitely (a record that an address bounced, marked us as spam, or unsubscribed), so we never email that address again. This suppression record is kept on purpose as the CAN-SPAM “do-not-email” safety net, and is the one record that survives a deletion request (see Section 8).

8. Your choices and rights

You can, at any time:

• Access / know what personal information we hold about you;
• Delete your account and the data associated with it; and
• Correct inaccurate information.

Unsubscribe from check-in emails. Every check-in email has a one-click unsubscribe link, and you can stop the emails any time without ending your season. Unsubscribing only turns off the email channel; your season continues in the app.

How to delete your data. Email privacy@middlegamechess.com and we will delete your account and the data associated with it: your stored profile, reviews, insights, puzzle plans, engine evaluations, player memory, season, check-ins, content views, practice attempts, your season contact record (your saved email and preferences), and account record. As part of this we cancel any check-in emails still queued to send so none go out after you ask to be deleted. (Self-serve, in-app deletion is coming.)

One exception, on purpose. If an address has bounced or you’ve marked our email as spam, we keep a one-way hash of that email address on our suppression list even after deletion, so we never email you again. We keep the hash, not the readable address. This is the CAN-SPAM “do-not-email” safety net described in Section 7.

Deleting your account also covers your public profile card. Profiles are built only by the signed-in owner of that Lichess account, so nobody else can generate one for your username.

If you are a California resident, you have the rights described above under the CCPA/CPRA, including the right not to be discriminated against for exercising them. We do not sell or share your information, so there is no opt-out of sale to perform. To exercise any right, email privacy@middlegamechess.com.

9. Security

We protect your information with industry-standard measures: data is encrypted in transit (HTTPS), stored in a database that only our application server can reach, and every request is limited to the signed-in account’s own data. Your Lichess access token stays in your browser. No method of transmission or storage is perfectly secure, but we work to protect your data.

10. Children

Middlegame is not directed to children under 13, and we do not knowingly collect personal information from children under 13. When you start a season, you confirm you are 13 or older before we collect your email. If you believe a child has provided us personal information, email privacy@middlegamechess.com and we will delete it.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the effective date above and, where appropriate, notify you in the app. Your continued use of the service after a change means you accept the updated policy.

12. Contact us

Questions, requests, or takedowns: privacy@middlegamechess.com

Postal mail:
Middlegame, c/o Steve Kriz
700 El Camino Real Suite 120 #1557
Menlo Park, CA 94025