Privacy policy

Last updated October 15, 2026

Zugzwang (zugzwang.ca) is a site for personal chess training and over-the-board chess clubs. It's run by Enter Design, based in Fredericton, New Brunswick, Canada. This page explains what we collect, why, who can see it, and how to get it changed or deleted. If anything here is unclear, email privacy@zugzwang.ca.

The short version:

• We collect what's needed to run your account and keep your training and games.
• Your games are private unless you share them with a club.
• We don't sell your data or show ads.
• Chipping in is optional, and it's handled by Stripe.
• There's no third-party tracking or analytics.
• You can delete your account at any time.

What we collect

Your account

• Your first and last name, and your email address. We also make a username from your name, which is only used behind the scenes, and keep your password, stored only as a secure hash, never in readable form.
• Sign-in records: which email addresses you've confirmed, and whether you use Google sign-in.

If you sign in with Google

We ask Google only for your basic profile: your name, email address, profile picture link, and a Google account ID. We use them to create your account and sign you in. That's all we use them for.

We don't get access to your Gmail, contacts, calendar, Drive or anything else in your Google account, and we don't ask Google for any other permissions.

Zugzwang's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't sell Google user data, use it for advertising, or share it with anyone except as described on this page.

What you do on the site

• Tactics: your attempts, results and review schedule, and your preferences.
• Anything you report to us: what you write in the bug report form, plus the page you were on, the problem it was about if there was one, and the browser you sent it from. It goes to the person who runs the site and is kept until it's dealt with.
• Openings: your repertoires and your practice history.
• Games you record or import:
  • the moves
  • for games recorded live, the time each move was entered, and clock times worked out from them or entered by you
  • where you played, if you say
  • the players' names and ratings as you enter them
  • event, round and date
  • result, and your notes
  We also keep the engine review we run on each game.
• Photos you add to a game or a club night. We shrink each one and save a fresh copy, which drops the location, camera and other details a phone stores inside a photo. Only you, the game's owner, and members of the club it's shared with can open them; they are never public. A club night's write-up keeps the name of whoever last edited it.
• Clubs:
  • which clubs you're in, and your role there
  • join requests, and any note you send with one
  • invitations: the email address (or account) someone was invited with, and who invited them
  • which games are shared to a club, and who's tagged as playing in them

Games can contain other people's names, for example your opponent's. Please only enter what you'd be comfortable showing them.

If you link Lichess or Chess.com

You can link either one when you sign up, or later under Account & sign-in → Profile. Both are optional.

• Lichess: you log in at Lichess, and we store your Lichess username, your ratings, and a token that lets us look up opening statistics for your repertoire on your behalf. The token has no permissions to post, play or change anything on your Lichess account. Disconnecting deletes the token here and revokes it with Lichess.
• Chess.com: we store the username you give us. To check the account exists, we send that username to Chess.com's public data service, and nothing else.

We use these usernames to show members of your clubs who you are online, and to recognise you in games you import from those sites.

On your phone

The scoresheet saves games in your browser's local storage until they upload, so a lost connection doesn't lose a game. It also keeps a copy of the scoresheet page, so it opens without signal. This stays on your device. You can remove it by clearing the site's data in your browser.

Cookies and logs

We use two cookies:

• a session cookie that keeps you signed in, for up to 60 days
• a security cookie that protects forms from forgery

There are no advertising, analytics or tracking cookies. Like any website, our servers keep short-lived technical logs (IP address, pages requested, errors) to keep the service running and secure.

Who can see your information

• Only you: your training history, repertoires, notes, and any game you haven't shared.
• Club members, when you share a game to a club:
  • they see its moves, clock times, player names, ratings, result and engine review
  • they never see your notes or how the game compared with your opening repertoire
  • you can unshare a game at any time
• Other members of a club you're in: they see your name, any Lichess and Chess.com usernames you've linked, your role, when you joined, the games you're tagged in, and your results in the club standings. They never see your email address.
• Club admins: when you ask to join, they see your name, your linked usernames and any note you send with the request.
• If someone tags you in a game: you can remove the tag yourself.
• Photos: a game's photos are seen by the members of every club the game is shared with, and a club night's photos by that club's members. You can remove any photo you added, and a game's owner can remove photos on their game.
• Opponent prep: a club member preparing to play you sees what you've played in games shared to that club. If you've linked a Lichess or Chess.com account, they also see an outline of your recent public games there - the same games anyone can already look up on those sites. A member can also note a public Lichess or Chess.com username against you for their own prep; that note is visible only to the member who wrote it, never to you or anyone else, and goes if either of you deletes your account.

Services we rely on

We share information only with the services needed to run Zugzwang, and only what they need:

• Hosting (Render). Our servers and database are hosted in the United States, so your information is stored and processed there, and may be accessible to authorities there under US law.
• Email delivery. We use an email provider to send confirmation, password-reset and club emails. It receives your email address and the message.
• Google, if you use Google sign-in (see above).
• Chess.com, if you add your Chess.com username: we send it to Chess.com's public data service once to check it exists. When a clubmate preps against you, we read your recent public games from that same service.
• Lichess, if you connect it. Opening lookups are sent with your token. If you use Share to Lichess on a game, that game's moves, player names and ratings are sent to Lichess, and it becomes a Lichess game that anyone with the link can view. Lichess's own privacy policy then applies to it. When a clubmate preps against you, we read your recent public Lichess games.
• Stripe, if you chip in for the server. The payment happens on Stripe's own page: we never see your card details. Stripe tells us the amount, and the name and email address you gave it, so we can answer questions and issue refunds. Stripe's privacy policy covers what it does with your information.
• Cloudflare provides our domain name service.

We don't sell or rent personal information, and we don't share it for advertising. We'll disclose information only if the law requires it.

How long we keep it

We keep your information for as long as you have an account.

When you delete your account, we remove your profile, training history, repertoires, games, club memberships and Lichess connection straight away. Your tags on other people's games are cleared, and your name stays only where someone else typed it into their own game. Backups roll over within about a week.

Your choices and rights

• See and correct: most of your information is visible and editable in the app. Account & sign-in covers your name, email, password and linked chess accounts, and Game details covers each game.
• Take it with you: you can download your games as PGN (My games → Export all) and your repertoires (Openings → Import / export). For a copy of anything else, email us.
• Delete: use Delete my account, under Account & sign-in, or email us.
• Ask or complain: write to privacy@zugzwang.ca. We'll answer within 30 days. If you're in Canada and aren't satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

Children

Chess clubs often have junior players, so we keep things simple:

• there's no messaging between members
• email addresses are never shown to other members
• members see each other's names and linked chess usernames, and nothing more personal than that

Children under 13 shouldn't create an account. Younger players under the age of majority where they live should have a parent's or guardian's permission. If you think a child's information has been added without that permission, email us and we'll remove it.

Security

The site is served over HTTPS. Passwords are stored as salted hashes, and each person can only reach their own data and the clubs they belong to. No system is perfectly secure. If we ever learn of a breach affecting your information, we'll tell you and the appropriate authorities as the law requires.

Changes

If we change this policy, we'll update the date at the top. If a change is significant, we'll let you know by email or on the site before it takes effect.

Contact