Privacy policy

Last updated September 11, 2026

Zugzwang (zugzwang.ca) is a site for personal chess training and over-the-board chess clubs. It's run by Enter Design, based in Fredericton, New Brunswick, Canada. This page explains what we collect, why, who can see it, and how to get it changed or deleted. If anything here is unclear, email privacy@zugzwang.ca.

The short version:

• We collect what's needed to run your account and keep your training and games.
• Your games are private unless you share them with a club.
• We don't sell your data or show ads.
• There's no third-party tracking or analytics.
• You can delete your account at any time.

What we collect

Your account

• Email and username. We also keep your password, stored only as a secure hash, never in readable form.
• Your name, if you give it or sign in with Google.
• Sign-in records: which email addresses you've confirmed, and whether you use Google sign-in.

If you sign in with Google

We ask Google only for your basic profile: your name, email address, profile picture link, and a Google account ID. We use them to create your account and sign you in. That's all we use them for.

We don't get access to your Gmail, contacts, calendar, Drive or anything else in your Google account, and we don't ask Google for any other permissions.

Zugzwang's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't sell Google user data, use it for advertising, or share it with anyone except as described on this page.

What you do on the site

• Tactics: your attempts, results and review schedule, and your preferences.
• Openings: your repertoires and your practice history.
• Games you record or import:
  • the moves
  • clock times, if you enter them
  • the players' names and ratings as you enter them
  • event, round and date
  • result, and your notes
  We also keep the engine review we run on each game.
• Clubs:
  • which clubs you're in, and your role there
  • your display name in each club
  • join requests, and any note you send with one
  • invitations: the email address or username someone was invited with, and who invited them
  • which games are shared to a club, and who's tagged as playing in them

Games can contain other people's names, for example your opponent's. Please only enter what you'd be comfortable showing them.

If you connect Lichess

We store your Lichess username, your ratings, and a token that lets us look up opening statistics for your repertoire on your behalf. The token has no permissions to post, play or change anything on your Lichess account. Disconnecting deletes the token here and revokes it with Lichess.

On your phone

The scoresheet saves games in your browser's local storage until they upload, so a lost connection doesn't lose a game. It also keeps a copy of the scoresheet page, so it opens without signal. This stays on your device. You can remove it by clearing the site's data in your browser.

Cookies and logs

We use two cookies:

• a session cookie that keeps you signed in, for up to 60 days
• a security cookie that protects forms from forgery

There are no advertising, analytics or tracking cookies. Like any website, our servers keep short-lived technical logs (IP address, pages requested, errors) to keep the service running and secure.

Who can see your information

• Only you: your training history, repertoires, notes, and any game you haven't shared.
• Club members, when you share a game to a club:
  • they see its moves, clock times, player names, ratings, result and engine review
  • they never see your notes or how the game compared with your opening repertoire
  • you can unshare a game at any time
• Other members of a club you're in: they see your display name, your role, when you joined, the games you're tagged in, and your results in the club standings. They never see your email address.
• Club admins: they also see your username and any note you send with a join request.
• If someone tags you in a game: you can remove the tag yourself.

Services we rely on

We share information only with the services needed to run Zugzwang, and only what they need:

• Hosting (Render). Our servers and database are hosted in the United States, so your information is stored and processed there, and may be accessible to authorities there under US law.
• Email delivery. We use an email provider to send confirmation, password-reset and club emails. It receives your email address and the message.
• Google, if you use Google sign-in (see above).
• Lichess, if you connect it. Opening lookups are sent with your token. If you use Share to Lichess on a game, that game's moves, player names and ratings are sent to Lichess, and it becomes a Lichess game that anyone with the link can view. Lichess's own privacy policy then applies to it.
• Cloudflare provides our domain name service.

We don't sell or rent personal information, and we don't share it for advertising. We'll disclose information only if the law requires it.

How long we keep it

We keep your information for as long as you have an account.

When you delete your account, we remove your profile, training history, repertoires, games, club memberships and Lichess connection straight away. Your tags on other people's games are cleared, and your name stays only where someone else typed it into their own game. Backups roll over within about a week.

Your choices and rights

• See and correct: most of your information is visible and editable in the app. Account & sign-in covers your email and password, Game details covers each game, and the Members page covers your club name.
• Take it with you: you can download your games as PGN (My games → Export all) and your repertoires (Openings → Import / export). For a copy of anything else, email us.
• Delete: use Delete my account, under Account & sign-in, or email us.
• Ask or complain: write to privacy@zugzwang.ca. We'll answer within 30 days. If you're in Canada and aren't satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

Children

Chess clubs often have junior players, so we keep things simple:

• there's no messaging between members
• email addresses are never shown to other members
• members only see each other's display names

Children under 13 shouldn't create an account. Younger players under the age of majority where they live should have a parent's or guardian's permission. If you think a child's information has been added without that permission, email us and we'll remove it.

Security

The site is served over HTTPS. Passwords are stored as salted hashes, and each person can only reach their own data and the clubs they belong to. No system is perfectly secure. If we ever learn of a breach affecting your information, we'll tell you and the appropriate authorities as the law requires.

Changes

If we change this policy, we'll update the date at the top. If a change is significant, we'll let you know by email or on the site before it takes effect.

Contact