Privacy Policy

1. Who we are

middlegame.ai is a chess-improvement tool that builds an engine-grounded, AI-written “Player Profile” from a player’s publicly available games, and offers game reviews, insights, and training puzzles. We operate the website and the service described here.

The data controller responsible for your personal information is [CONTROLLER NAME] (United States). You can reach us at the postal address in Section 12.

2. The information we collect

Information you give us when you create an account:

• Your Lichess account identity and an access token issued by Lichess. Signing in with Lichess is the only way to use middlegame.ai. With your consent (the puzzle:read permission you grant on Lichess), we read your Lichess puzzle activity to track which recommended training puzzles you’ve completed.
• Your first name (used to greet you in the app).
• Your email address, if you start a season, used only to send you check-in emails for your season (Section 7). Signing in never requires an email address or a password.

Chess information you provide or that we retrieve about a username:

• The Lichess username you enter, and public game data for that username that we retrieve from the Lichess public API. This game data is already public on Lichess.
• The analysis we derive from those games and store on your behalf: your Player Profile, single-game reviews, insights, puzzle plans, chess-engine evaluations, longitudinal “player memory” (the running notes we keep about your play), your season (goals and progress), your content views (which recommended study material you’ve opened), the positions from your own games that you practice on, and how each attempt went (when you tried it, the game and move, the page you practiced on, which of your openings it came from, the phase of the game, how many tries you took, the last move you tried, whether you found the move Lichess preferred or were shown it, and Lichess’s own label for the move you played), and the check-ins we write for you.

When you start a season:

• We ask for an email address so your weekly check-in emails can reach you between sessions, and you confirm you’re 13 or older. We store this email as the contact alongside your season. We treat the address as consented but unverified: we don’t send a confirmation email first; if a message bounces or you mark it as spam, we stop emailing that address.

Information we generate automatically:

• Usage counters (timestamps and counts of analyses you run), used to enforce fair-use rate limits.
• Local browser storage: we store a cached copy of your profile and your theme/session preferences in your browser (IndexedDB and localStorage) so the app works smoothly. This stays on your device.

What we do not collect: we do not use third-party or advertising analytics; our check-in emails are transactional, not behavioral tracking (we send them as part of your season, not to profile your behavior). We do not collect payment information (the service is currently free), and we do not collect precise geolocation.

First-party, consented usage metrics we record. To understand whether your season is actually helping you, we record a small set of first-party, consented usage metrics about your own season, server-side and tied to your account, with no third-party tracker and no email open-pixel. Because our check-in emails are plain text, there is no open-pixel, so we cannot and do not track whether you opened an email; instead, a click on a link in the email is our honest proxy for engagement. The metrics we record are:

• a check-in email was delivered to you;
• whether you clicked a link in that email (our stand-in for an open, since plain-text email has no email open-pixel);
• whether you returned to the app from that link;
• whether you completed a season;
• your renewal choice when offered a next season; and
• the negative channel signals: unsubscribe, an email bounce, or a spam complaint.

These are operational measurements of a service you chose to start; we never use them for advertising or to build a behavioral profile of you. We record only that an event happened (and, for a bounce or complaint, the provider’s reason code), never the contents of a game, message, or email.

3. How we use your information

We use the information above only to:

• build and show your Player Profile, reviews, insights, and puzzle plans;
• send you check-in emails for your season;
• understand whether your season is working for you (whether emails reach you, whether you return, and whether you finish and want another), so we can improve the check-ins, never for advertising or profiling;
• authenticate you and keep you signed in;
• enforce fair-use rate limits; and
• operate, maintain, and improve the service.

We do not use your information for advertising, and we do not sell it (see Section 6).

4. Public profiles (please read)

A core feature of middlegame.ai is a publicly viewable Player Profile. You should understand how this works:

• A profile is reachable at a public URL of the form middlegame.ai/p/lichess/<username> and is intended to be shared.
• Because profiles are built from public chess games, a profile for a username can be generated by anyone, including a profile for a username that is not their own.
• A public profile contains the chess username, derived attribute scores and narrative, and aggregate stats about the analyzed games. It does not include your email or real name.
• If a verified account owner builds their own profile, their version takes precedence over any other.
• Takedown: you can ask us to remove or hide a public profile for your username at any time by emailing privacy@middlegame.ai.

5. Who we share information with (sub-processors)

We do not sell your information. We share it only with the service providers (“sub-processors”) that we use to run middlegame.ai, and only as needed to provide the service:

We also retrieve public game data, and (with your puzzle:read consent) your puzzle activity, from Lichess via its public API. Lichess is the source of that data, not a processor of your account information.

International transfer. Depending on which AI model is configured, the game-derived inputs used to write your profile text may be processed outside the United States, including in China (DeepSeek). We disclose this so you can make an informed choice about using the service.

6. We do not sell or “share” your personal information

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are used under the California Consumer Privacy Act (CCPA/CPRA). We have not done so in the past 12 months.

7. How long we keep your information

We keep your account information and the analysis we generate until you delete it or delete your account. You can delete your data at any time (see Section 8). Public profiles are kept until you request takedown. Local data in your browser is cleared when you clear your browser storage or sign out.

The first-party usage metrics described in Section 2 are kept alongside the rest of your account data and are deleted when you delete your account. They are removed together with your account, with the one exception of the bounce/complaint suppression record (the do-not-email safety net, described below). We do not run a separate retention clock on these events; they simply live and die with your account.

Check-in emails (Postmark). Our email provider, Postmark, retains the content and delivery events of the check-in emails we send for 45 days by default, after which the message content is deleted. Postmark and we independently keep an email suppression list indefinitely (a record that an address bounced, marked us as spam, or unsubscribed), so we never email that address again. This suppression record is kept on purpose as the CAN-SPAM “do-not-email” safety net, and is the one record that survives a deletion request (see Section 8).

8. Your choices and rights

You can, at any time:

• Access / know what personal information we hold about you;
• Delete your account and the data associated with it; and
• Correct inaccurate information.

Unsubscribe from check-in emails. Every check-in email has a one-click unsubscribe link, and you can stop the emails any time without ending your season. Unsubscribing only turns off the email channel; your season continues in the app.

How to delete your data. Email privacy@middlegame.ai and we will delete your account and the data associated with it: your stored profile, reviews, insights, puzzle plans, engine evaluations, player memory, season, check-ins, content views, practice attempts, your season contact record (your saved email and preferences), and account record. As part of this we cancel any check-in emails still queued to send so none go out after you ask to be deleted. (Self-serve, in-app deletion is coming.)

One exception, on purpose. If an address has bounced or you’ve marked our email as spam, we keep a one-way hash of that email address on our suppression list even after deletion, so we never email you again. We keep the hash, not the readable address. This is the CAN-SPAM “do-not-email” safety net described in Section 7.

Deleting your account also covers your public profile card. Profiles are built only by the signed-in owner of that Lichess account, so nobody else can generate one for your username.

If you are a California resident, you have the rights described above under the CCPA/CPRA, including the right not to be discriminated against for exercising them. We do not sell or share your information, so there is no opt-out of sale to perform. To exercise any right, email privacy@middlegame.ai.

9. Security

We protect your information with industry-standard measures: data is encrypted in transit (HTTPS), stored in a database with row-level access controls, and accessed only by the application server using scoped credentials. No method of transmission or storage is perfectly secure, but we work to protect your data.

10. Children

middlegame.ai is not directed to children under 13, and we do not knowingly collect personal information from children under 13. When you start a season, you confirm you are 13 or older before we collect your email. If you believe a child has provided us personal information, email privacy@middlegame.ai and we will delete it.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the effective date above and, where appropriate, notify you in the app. Your continued use of the service after a change means you accept the updated policy.

12. Contact us

Questions, requests, or takedowns: privacy@middlegame.ai

Postal mail:
[CONTROLLER NAME]
[POSTAL ADDRESS]