Introduction

Disco Chess ("we", "us") takes your privacy seriously.

This policy sets out how we collect, use, and protect your personal data when you use our website and mobile applications (the "Service").

As the data controller, we are responsible for your personal data. We handle it in accordance with the EU General Data Protection Regulation (GDPR) and the Republic of Lithuania Law on Legal Protection of Personal Data.

Definitions

"Account" means an account required to access and use certain areas and features of the Service.
"Cookie" means a small text file, or a similar technology such as browser localStorage, placed on your device when you use the Service. Details are set out in our Cookies Policy.
"Personal data" has the meaning given below under "What is personal data?".

Information About Us

The Service is operated by, and the data controller is, MB Ordinary Ventures, a company registered in the Republic of Lithuania under company code 307541958, with its registered office at Eduardo André g. 14-5, Vilnius, LT-02232, Lithuania. Our VAT (PVM) number is LT100020339915.

We have not appointed a Data Protection Officer, as we are not required to. For any question about this policy or your personal data, you can contact us at [email protected].

What does this policy cover?

This policy applies only to your use of the Service and explains how the personal data we collect through it is used, as well as your rights and how to raise concerns or complaints. It does not cover third-party websites or services that we may link to.

What is personal data?

Personal data is any information relating to an identified or identifiable individual, as defined by the EU GDPR. In simpler terms, it is any information about you that enables you to be identified, whether directly or indirectly.

Your legal rights

Under data protection law, you have the following rights:

The right to be informed about how we collect and use your personal data.
The right to be provided with a copy of the personal data that we hold.
The right to ask us to correct any personal data we hold about you.
The right to ask us to delete your personal data in certain circumstances.
The right to request that we restrict the processing of your personal data in certain circumstances.
The right to request that we transfer your personal data to yourself or a third party in certain circumstances.
The right to withdraw your consent to processing where this is the legal basis relied upon by us.
The right to object to the processing of your personal data for direct marketing purposes.
The right to object to the processing of your personal data in certain circumstances where we are relying on a legitimate interest.

You also have the right to lodge a complaint with a supervisory authority (see "Complaints" below). We explain how to exercise your rights later in this policy.

What type of personal data do we collect?

We collect:

Identity information e.g. your name or display name.
Contact information e.g. email address.
Financial data e.g. subscription and payment status. Your payment card details are collected by our payment processors (Stripe, Apple, or Google), not by us.
Preference information e.g. marketing and advertising preferences.
Usage and performance data e.g. puzzle solving accuracy, timing, progress through cycles, and statistics related to your use of the Service.
Linked account data e.g. username and user ID from connected third-party chess platforms (such as Lichess).

We do not collect sensitive (special category) data or data relating to children. We do not collect or store date of birth information.

How do we collect your personal data?

We collect this data when you interact with us through or using the Service and when you send us correspondence.

How and why do we use your personal data?

In accordance with data protection law, we can only use your personal data if we have a legal basis for doing so.

We use personal data for the following reasons:

So that we can interact with you and provide services and marketing to you. Our legal basis for doing so is our legitimate interests or those of a third party, and for the performance of any contract we have with you, or to take steps before entering into a contract with you.
To help us ensure that the website is operating effectively. Our legal basis for doing so is our legitimate interests or those of a third party.
To enable us to make and receive payments. Our legal basis for doing so is for the performance of any contract we have with you or to take steps before entering into a contract with you.
To track your progress, provide personalised features, generate statistics, and improve the Service. This includes collecting and analysing puzzle solving performance data such as accuracy, solving time, cycle completion, and other usage metrics. Our legal basis for doing so is our legitimate interests in operating and improving the Service, and for the performance of any contract we have with you.

Automated decision-making and profiling

We do not make decisions that produce legal effects concerning you, or that similarly significantly affect you, based solely on automated processing. We do use automated systems to personalise your training, such as adjusting puzzle difficulty and recommendations based on your performance. If you have any questions about this, you can contact us using the details in this policy.

Public Profile and Leaderboards

The Service provides public profile pages that display certain information about you to other users and visitors. Your public profile is accessible via a unique URL based on your username (e.g., discochess.com/u/your-username).

What is publicly visible: The following information is displayed on your public profile:

Your username
Your display name (if provided)
Your profile photo (if provided)
When you joined the Service
Total number of puzzles solved
Total time spent training
Your current training streak
Activity history showing which days you were active (not detailed activity logs)

Leaderboards: If your profile is set to public, you may appear on our training leaderboards. Leaderboards display your username, display name, profile photo, and relevant scores (such as completed cycles, streak days, or mastered review items) alongside other users with public profiles. Leaderboard data is refreshed periodically and is visible to all visitors of the Service.

Your control: You can change your username at any time through your account preferences. Your username must follow our naming guidelines (3-20 characters, letters, numbers, hyphens, and underscores only). Your email address is never displayed on your public profile or leaderboards. You can make your profile private at any time through your account preferences, which will remove you from leaderboards.

Our legal basis for displaying public profile information and leaderboard rankings is our legitimate interests in providing a community feature that allows users to share their progress and the performance of our contract with you.

Email Communications

We may send you various types of email communications related to your use of the Service. These include:

Newsletter: Optional product updates, new features, exclusive offers, and chess improvement tips
Daily habit reminders: Optional daily emails to help you build a consistent training habit
Hot streak rescue: Optional reminders when your hot streak is at risk of expiring
Inactivity reminders: Optional notifications if you haven't solved puzzles for a prolonged period
Performance insights: Optional insights into your performance and areas for improvement
Essential communications: Important service updates, security notifications, and transaction confirmations

You can manage your email preferences at any time through your account settings. You can opt out of promotional and reminder emails, but you will continue to receive essential communications relating to goods or services we are providing you.

Our legal basis for sending promotional and reminder emails is our legitimate interests in providing you with a helpful service and your consent where required. For essential communications, our legal basis is the performance of our contract with you.

Push Notifications

In our mobile apps you can enable push notifications such as daily training reminders, streak rescues, and offers. If you enable them, we collect a device push token and associate it with your account so we can deliver notifications to your device. Notifications are delivered via Firebase Cloud Messaging (Google).

You can disable push notifications at any time in your device settings or by turning them off in the app; signing out unregisters the device. Our legal basis is your consent, given when you allow notifications, and our legitimate interests in helping you maintain your training habit.

Third-Party Account Linking

You may choose to link your account with third-party chess platforms. For Lichess, we use OAuth (a secure authorization protocol) to establish the connection without accessing your password. For Chess.com, you provide your public username and we access only publicly available data; we never ask for your Chess.com password.

What we collect: When you link an account, we receive and store:

Your username on the linked platform
Your unique user ID on the linked platform
The date and time of account linking

Lichess Study Sync: When you use our Opening Drilling feature with a linked Lichess account, we also collect and store:

Study names and chapter names from your Lichess studies
PGN (Portable Game Notation) data containing the chess moves in your repertoire
Chapter orientation information (whether moves are for White or Black)

This data is synced only when you explicitly initiate a sync and is used to create and manage your opening drill sets.

How we use this data: Linked account information is used to:

Display your connected account status in your preferences
Provide personalized puzzle recommendations based on your playing history
Enable opening drilling by importing your Lichess study repertoires
Enable future features that integrate with the linked platform

Your control: You can disconnect any linked account at any time through your account preferences. When you disconnect an account, we delete the associated linked account data from our systems. You can also delete any opening drill sets you've created, which removes the synced study data associated with those drill sets. Linking accounts is entirely optional and not required to use the Service.

Our legal basis for processing linked account data is the performance of our contract with you and your explicit consent when initiating the account linking process.

Analytics and Usage Tracking

We use analytics tools to understand how users interact with our Service. This helps us improve the Service and provide a better user experience.

Google Analytics: We use Google Analytics 4 in cookieless mode to understand how visitors use our website: no advertising cookies are stored on your device. We send event-level usage data (page views, sign-ups, puzzle solves, purchases); purchase events include a transaction reference derived from your account ID. Data is processed in accordance with Google's privacy practices and GDPR requirements.

Mixpanel: We use Mixpanel for detailed product analytics. Mixpanel helps us understand usage patterns, track feature adoption, and measure user engagement. We use Mixpanel's EU data residency, meaning all data is processed and stored within the EU. Data collected includes:

Page views and navigation patterns
Puzzle solving activity (correct/incorrect attempts, solving time, puzzle sets used)
Feature usage (hearts system, referral program, premium features)
User identification (your account user ID, email address, display name)
Device and browser information

Session Replay (Mixpanel): For signed-in users, we use Mixpanel Session Replay to record your interactions with the Service. This helps us understand how users navigate the platform, identify usability issues, and improve the user experience. Session recordings may capture:

Mouse movements, clicks, scrolls, and taps
Page navigation and interactions with UI elements
Text you enter into forms (excluding password fields, which are automatically blocked)
Visual representation of the page as you see it

Session Replay is only active when you are signed in. Recordings are stored for 30 days and are used solely for improving the Service. We do not share session recordings with third parties for marketing purposes. Our legal basis for session replay is our legitimate interests in understanding and improving the Service.

Reddit Pixel: We use Reddit Pixel to measure the effectiveness of our advertising campaigns on Reddit. This helps us understand how users discover and engage with our Service after seeing our ads. The Reddit Pixel tracks page visits and conversions. When you are signed in, we share your email address and user ID with Reddit for customer matching, which allows Reddit to attribute conversions to specific ad campaigns. Data is processed in accordance with Reddit's privacy practices.

Rewarded Video Ads (Applixir, website only): On the discochess.com website we offer users the option to watch video advertisements to earn in-game rewards (such as hearts). The Disco Chess iOS and Android apps do not show advertisements and do not include an advertising SDK. When you choose to watch an ad on the website, our advertising partner Applixir may collect:

Device and browser information
Ad interaction data (impressions, completions, clicks)
IP address for fraud prevention and ad delivery

Watching ads is completely optional and is available on the website only. You can choose not to watch ads and continue using the Service with standard heart regeneration. Data collected through ads is processed in accordance with Applixir's privacy practices and applicable advertising industry standards.

Analytics data is used for improving the Service and, in the case of the Reddit Pixel, for measuring our own advertising. Other than the advertising-measurement sharing with Reddit described above, we do not sell or share analytics data with third parties for their own marketing purposes. You can find full details of the cookies and similar technologies we use, and how to control them, in our Cookies Policy.

Do we share personal data?

We only share personal data with third party service providers where necessary. Our current third-party service providers include:

Google Analytics: For website usage statistics (cookieless mode, event-level data)
Mixpanel: For product analytics and usage tracking (EU data residency)
Reddit: For conversion tracking and advertising measurement (Reddit Pixel)
Google (Firebase): For authentication services and push notification delivery (Firebase Cloud Messaging)
Vercel: For website hosting and serving; processes request metadata such as your IP address and browser information
Cloudflare: For content delivery and security
YouTube (Google): Instructional videos are embedded using YouTube's privacy-enhanced mode (youtube-nocookie.com); video thumbnails and the player are served by Google, and playing a video is subject to Google's privacy policy
Applixir (website only): For rewarded video advertisements on discochess.com. When you choose to watch an ad to earn in-game rewards, Applixir may collect device information and ad interaction data. The mobile apps do not show advertisements.
Lichess: When you choose to link your Lichess account, we use OAuth to securely connect your account. We receive your Lichess username and user ID. No data is shared with Lichess from Disco Chess.
Chess.com: When you choose to link your Chess.com account by entering your public username, we retrieve your publicly available games and profile data from Chess.com's public API. No data is shared with Chess.com from Disco Chess.
Stripe: For payment processing when you purchase a Premium subscription. Stripe processes your payment card details securely in accordance with PCI DSS requirements. We receive confirmation of successful payments and basic subscription status information, but we do not receive or store your full payment card details. Stripe may collect device information and IP address for fraud prevention. See Stripe's Privacy Policy for more information.
Apple App Store (or Google Play on Android): When you purchase a Premium subscription inside our mobile app, Apple or Google processes your payment. We receive confirmation of successful purchases and your subscription status, but we do not receive or store your payment card details. Their use of your data is governed by Apple's and Google's respective privacy policies.
RevenueCat: We use RevenueCat to manage and validate in-app subscriptions. RevenueCat receives your purchase and transaction data along with an app-specific user identifier linked to your account, which it uses to deliver, restore, and keep your subscription status in sync across devices. See RevenueCat's Privacy Policy for more information.

We will get your express consent before we share your data with any third party for their own marketing purposes.

Where we share your personal data, we only do this where we are satisfied that the third party will take appropriate steps to protect your data and its use is limited to acting on our instructions.

We may need to share your personal data with legal and regulatory bodies if this is necessary for us to comply with the law or any applicable regulations.

How and where do we store or transfer your personal data?

We use service providers that process data within the European Economic Area (EEA). Specifically:

Mixpanel analytics data is stored in the EU through their EU data residency program
Cloudflare operates data centers within the EU and processes data locally

In cases where data processing occurs outside the EEA (such as with Firebase Authentication, Google Analytics, Reddit, and Vercel), we ensure appropriate safeguards are in place, including European Commission adequacy decisions or EU Standard Contractual Clauses, and compliance with relevant data protection frameworks.

Is the personal data secure?

We take the security of your data seriously and have put in place appropriate measures to protect it.

We limit access to your personal data to only those employees, agents, contractors and other third parties who need to know for business purposes, and they are subject to robust confidentiality obligations.

How long is the personal data kept for?

We only keep your personal data for as long as reasonably necessary to fulfil the purposes for which it was collected.

We will keep the majority of your personal data for so long as you use any of our goods, services or the website, or until you withdraw your consent (where this is our legal basis for processing).

We will only keep information about orders and payments for longer than this. We will keep this data for a period of 6 years after our relationship with you has ended, in order to meet legal and accounting obligations.

Do we use third party links on our website?

Yes, the website may include links to third party websites or content. We have no control over these, so you should read the privacy policy of any third party site you visit.

How can you exercise your rights?

If you wish to exercise any of the rights set out above, including asking for a copy of the personal data we hold about you, please contact us at [email protected]. You will not have to pay a fee to exercise your rights, but we may need to request additional information from you to confirm your identity before we can act.

Usually, we will respond to legitimate requests to exercise these rights within one month; however, this can take longer if the request is complex or you have made a number of requests. If we think it will take longer, we will let you know.

Keeping us up to date

You must let us know if any personal data we hold about you is incorrect or out of date.

Changes to this policy

This policy gets reviewed and updated regularly, and the date at the top shows when it was last updated. Please make sure you check this page from time to time.

Contact us

Should you have any questions about this policy or wish to exercise any of your data rights, please contact us at [email protected].

Complaints

We would appreciate you contacting us first to allow us to attempt to resolve any complaint. However, you have the right to make a complaint at any time to the supervisory authority for data protection. In Lithuania this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI), vdai.lrv.lt. You may also complain to the supervisory authority in your country of residence.

Privacy Policy