Privacy Policy
Last updated: 20 October 2026
The German version of this policy is legally binding. This English translation is provided for convenience only; in case of discrepancies, the German version prevails.
1. Controller and contact
The controller responsible for processing your personal data is:
For any data protection question and to exercise your rights, contact us at info@rookion.de.
2. Overview
Rookion is an AI-powered chess coach. We process personal data to provide, bill and securely operate the service and, where you consent, to analyse and advertise it. We do not sell personal data.
Section 3 describes the individual processing operations by purpose, section 4 cookies and similar technologies, section 5 all recipients and service providers, section 6 retention and section 7 your rights.
3. Processing in detail
3.1 Visiting the website
- Data:
- IP address, time, requested address, browser and device information in our host’s server logs.
- Purpose:
- Delivering the pages, stability, security and error analysis.
- Legal basis:
- Art. 6(1)(f) GDPR (legitimate interest in secure and functional operation).
- Retention:
- As long as needed for security and error analysis, generally no more than 90 days; longer in the case of security incidents until they are resolved.
3.2 Account and sign-in
- Data:
- Email address, password (stored only as a hash) or sign-in with Google, display name, voluntary onboarding information (such as your self-assessed playing strength), time of registration and last use.
- Purpose:
- Providing and managing your account.
- Legal basis:
- Art. 6(1)(b) GDPR (user agreement).
- Note:
- When you sign in with Google, Google provides us with the basic data of your Google account (email address, name, identifier). Google is itself responsible for the sign-in process.
3.3 Games, analysis and AI coaching
- Data:
- Your played and imported games (moves, result, date, player names, origin), the analysis results, your messages in the coaching and the coach’s replies.
- Purpose:
- Analysing your games and AI coaching. The coach’s replies are generated by an AI language model (Gemini) via Google Vertex AI in an EU region; your inputs are not used to train the models. Google may cache requests in encrypted form for up to 24 hours to process them faster and may log them briefly and to a limited extent to detect abuse.
- Legal basis:
- Art. 6(1)(b) GDPR (user agreement).
- Retention:
- Until you delete the game or your account.
3.4 Importing games
- Ways:
- You can paste or upload games as PGN, fetch them from Chess.com and Lichess, or upload a photo of your scoresheet.
- Chess.com and Lichess:
- To fetch games, the username you provide is sent to the platform’s public interface, with an account via our server, in the free analysis without an account directly from your browser (see 3.7); your public games come back. If you save your name in your account, we fetch new games regularly on our own until you remove the connection. The username is all that is needed to fetch public games.
- Transfer to the USA (Chess.com):
- Chess.com, LLC is based in the USA. We are not aware of a certification under the EU-US Data Privacy Framework, and no standard contractual clauses exist with Chess.com; a level of protection equivalent to EU law is not ensured for this transfer, in particular US authorities may be able to access data. Via our server we only transmit the username. We only carry out a fetch without an account directly from your browser at Chess.com after your explicit consent, which you give after this notice before the fetch (Art. 49(1)(a) GDPR); in that case Chess.com additionally receives your IP address and technically required connection information. For a fetch with an account that you trigger with a click, we rely on the transfer being necessary for the fetch you requested (Art. 49(1)(b) GDPR). We only fetch a saved name regularly with your explicit consent, which you give after this notice when connecting (Art. 49(1)(a) GDPR); you withdraw it by removing the connection. Lichess is based in the EU (France).
- Scoresheet photo:
- We send the photo to Google Vertex AI (EU region) solely to recognise the moves; before uploading, the app removes image metadata such as the location. We do not store the photo; only the game you confirm after checking it is saved. For debugging and quality measurement we store technical processing data per recognition run, without the photo and without the moves (such as duration, image size, recognition quality, error type) and delete it automatically after 90 days (Art. 6(1)(f) GDPR).
- Quick summary:
- For automatically fetched games we use a chess engine on our servers, without an AI language model, to determine the moment with the biggest learning potential, so we can present the game to you in the dashboard and in the optional notification.
- Legal basis:
- Art. 6(1)(b) GDPR (user agreement) unless stated otherwise above. We keep platform connections until you remove them or delete your account.
3.5 Data of other players in your games
- Data:
- Games usually contain your opponent’s public username and the related game data (moves, result, date, possibly rating). The source is the game you provided or the platform’s public interface.
- Purpose:
- Solely as part of your game: to display and analyse it, to provide your coaching and to identify the game in the optional notification about new games (for this, the opponent’s name may be included in the email content sent to our email service provider). We do not use these data for separate profiles, for contacting anyone or for advertising.
- Legal basis:
- Art. 6(1)(f) GDPR (our and your legitimate interest in fully analysing your own game).
3.6 Voice input (optional)
- How it works:
- In the coaching you can dictate text. Voice input only starts when you click the microphone icon and uses your browser’s speech recognition. Depending on the browser, the audio is sent to the browser’s provider (such as Google for Chrome, Apple for Safari) and processed there under its privacy terms.
- What Rookion receives:
- Only the recognized text, which you can check and edit before sending. We do not record the audio.
- Legal basis:
- Art. 6(1)(b) GDPR. Voice input is an optional way of entering text; you can always type instead.
3.7 Free analysis without an account
- How it works:
- The free analysis runs entirely in your browser; your game is not sent to our servers for it. Only if you request the coaching sample or the conversation with the coach for the moment shown are the details of that moment (position, your move, the engine move, the evaluations and the engine lines), the moves of your game up to that moment, the thought you entered for it and your further messages in that conversation sent via our server to Google Vertex AI (EU region) to create the coach’s answers. Without an account the conversation is limited to this one moment and a few answers.
- Fetch by username:
- Without an account you can also fetch public games via a username on Chess.com or Lichess. Your browser then connects directly to the platform’s public interface; the platform receives the username as well as your IP address and technically required connection information. Our servers do not receive the username or the fetched games. The game you choose is analysed in your browser and stored there like a pasted game; if you request the coach, the information above applies, and the moves are sent without player names. For Chess.com, based in the USA, 3.4 applies.
- Storage:
- Without an account we do not store your messages or the coach’s answers on our servers. They remain stored in your browser so that you can transfer the conversation to your account after registering; after 7 days the free analysis discards the entry the next time it is opened, and after the transfer the information on coaching with an account applies. For quality assurance we log, per coach answer, technical metrics and a short excerpt of the coach’s answer, never your messages and without any link to you; we delete these logs after 30 days at the latest.
- Abuse protection:
- To protect the free offer we derive from your IP address, using a secret key, a check value valid only for that day. For each conversation we store only this check value, check values over the moment discussed and the course of the conversation, and counters; we do not store the IP address itself or your messages. These entries are deleted after 7 days at the latest.
- Legal basis:
- Art. 6(1)(b) GDPR (providing the analysis, fetch, sample or conversation you requested) and Art. 6(1)(f) GDPR (legitimate interest in protecting the free offer from abuse and in assuring its quality).
3.8 Thinking profile (optional)
- How it works:
- If you turn on the thinking profile, Rookion detects recurring patterns in your own games and shows them with evidence and exercises. For solved exercises we store per position whether, when and in how many attempts you found the move. Without consent this processing does not take place.
- Legal basis:
- Your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the settings; we then delete the profile and the exercise results. Your games and analyses remain.
- Retention and recipients:
- Until you withdraw consent or delete your account. There are no additional recipients; only you can see your profile.
3.9 Subscription and payment
- Data:
- Chosen plan, amounts, payment and invoice status including refunds, identifiers at our payment provider, possibly name and billing address. Full payment data such as card numbers are processed only by Stripe; we do not store them.
- Purpose:
- Concluding, billing and managing your subscription; complying with tax and commercial law obligations.
- Legal basis:
- Art. 6(1)(b) GDPR (contract) and (c) GDPR (statutory retention obligations).
- Reach measurement:
- Whether and when you started a trial, paid for the first time or cancelled is stored with your account (the time and the identifier of the related Stripe object, that is the checkout session or the subscription, no amounts) to evaluate which advertising and partner channels lead to purchases; evaluation is aggregated per channel only. The legal basis is Art. 6(1)(f) GDPR (measuring the effectiveness of our advertising); we delete these data with your account.
3.10 Emails
- Service emails:
- About your account and contract (such as confirmations, password, order confirmation, notices about your access), based on Art. 6(1)(b) GDPR.
- Emails with consent:
- Notifications about new games, reminders of your training days (see 3.16) and marketing emails are sent on the basis of the consent given for each of them (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, for example via the unsubscribe option in the respective message. We document consent and withdrawal as evidence (see 3.12).
- One-off messages to customers:
- Paying customers may be asked once for feedback; the basis is Art. 6(1)(f) GDPR (improving our offer). Each such message points out that you can object at any time, for example by a short reply or to info@rookion.de.
- Objection:
- You can object at any time to the use of your data for direct marketing (Art. 21(2) GDPR); we then no longer use them for that purpose.
3.11 Registration origin and reach measurement
- How it works:
- Only with your consent to the category “Partner and campaign attribution” in the cookie banner do we read during your visit which way you came to us (campaign parameters of the link or the domain of the referring page, otherwise “direct”) and remember a partner or campaign link in your browser for up to 30 days. Without this consent we read neither link nor referrer for this purpose and only record “unknown” at registration.
- Storage with the account:
- At registration we store the acquisition channel with your account to evaluate, in aggregated form, which advertising and partner channels lead to registrations and purchases. The value is self-reported by your browser and we cannot verify it; it only concerns your own account and is not changed afterwards. We do not pass the value stored with your account on to partners or advertising networks.
- Sign-in with Google:
- When you register with Google, we store the value together with your consent on our server shortly before the redirect and transfer it to your account after sign-in. If you withdraw consent in the meantime, we still transfer a value that was already stored; you can object to this storage.
- Legal basis:
- For reading and storing in the browser, your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time via “Cookie settings” in the footer. For storage with the account, Art. 6(1)(f) GDPR (measuring the effectiveness of our advertising); you can object to it at any time under Art. 21 GDPR.
- Retention:
- With the account for 24 months from registration; after that we delete the value automatically.
3.12 Security, abuse prevention and evidence
- Data:
- Security-relevant events such as sign-in attempts, unusual access and request limits; also your acceptance of the terms, your confirmation that you have taken note of the privacy policy, and the granting and withdrawal of consents, each with time, source, IP address, browser information and text version.
- Purpose and legal basis:
- Protection against abuse and attacks and defence against claims (Art. 6(1)(f) GDPR), and evidence of consents (Art. 6(1)(c) GDPR in conjunction with Art. 5(2) and Art. 7(1) GDPR).
- Retention:
- Security logs generally no more than 90 days, longer in the case of incidents. In evidence of consent we automatically remove or shorten IP address and browser information after 24 months; a reduced record (time, type, action, source, version) may remain until the statutory limitation periods expire.
3.13 Support, feedback and contact
- Data:
- Your message, your email address and any information you provide.
- Purpose and legal basis:
- Handling your request (Art. 6(1)(b) GDPR, otherwise (f) GDPR).
- AI assistance:
- We may use AI services to help draft replies (see section 5).
- Retention:
- Until your request is resolved, afterwards only as far as statutory retention obligations apply.
3.14 Development and operation
- How it works:
- For development, maintenance and error analysis we use AI services (see section 5). We avoid, shorten or pseudonymise personal data from live operation in doing so; access only takes place in individual cases where necessary for error analysis, security or administration.
- Legal basis:
- Art. 6(1)(f) GDPR (secure and error-free operation).
3.15 Advertising and conversion measurement with Google Ads (optional)
- How it works:
- Only with your consent to the “Marketing” category in the cookie banner do we load the Google tag for Google Ads. Google then measures whether visitors who arrive via one of our ads sign up or take out a subscription; Google recognises the purchase from the visit to the order confirmation page, without an amount. At registration we send your email address to Google solely as a hash value so that Google can attribute the registration to an ad even when cookies are not sufficient (enhanced conversions). Visitors who have also consented to the “Analytics” category may see Rookion ads in the Google advertising network (remarketing via audiences from Google Analytics).
- Data:
- Pages visited (address only, without parameters), interactions the Google tag detects automatically (such as scrolling, clicks on links to other websites, downloads, video views), time, browser and device information, IP address, the click identifier from the ad, cookie identifiers and, at registration, the hash value of your email address; the purchase is transmitted only as the visit to the order confirmation page.
- Legal basis:
- Your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); withdrawal at any time via “Cookie settings” in the footer. Without this consent or after a withdrawal we do not load Google Ads. A consent given at a time when the “Marketing” category did not yet include Google is not sufficient; the banner then asks again.
- Retention:
- Google attributes a registration or purchase to an ad only if it takes place up to 90 days after a click, up to 3 days after an active video view or up to 1 day after viewing an ad. Remarketing audiences keep a visitor for up to 540 days. Google Ads retains aggregated reporting data according to its retention rules. Cookies set by Google Ads on our website expire after no more than 90 days, cookies of Google’s advertising domains after no more than 13 months; after a withdrawal we immediately delete those set on our website.
- Further information:
- How Google uses data from websites that use Google services: https://policies.google.com/technologies/partner-sites
3.16 Training goal, training plan and reminders
- Data:
- Your information on your training goals, such as current and target playing strength, available training time and hurdles in training; your weekly plan with suggested and completed training steps; training days, training points, jokers and streaks; if you set training appointments, weekdays, time and time zone. We may also recognise completed steps from your use of Rookion.
- Purpose:
- Creating, providing and adapting your personal training plan and showing your training activity, your progress and your player profile. For this we take into account your information and information from your use of Rookion, such as games, analyses, coachings and exercises. Patterns from the thinking profile are only included as far as your consent under 3.8 covers this.
- Legal basis:
- Art. 6(1)(b) GDPR, as far as the processing is necessary for the training plan you use. Using the training plan is voluntary; without the information it needs, it is not available or only to a limited extent.
- Reminders:
- We send reminders of your training days by email if you have consented (Art. 6(1)(a) GDPR). For this we use your email address, your name, your training appointments and information about upcoming training steps; the emails are delivered via our email service provider (section 5). You can withdraw consent at any time with effect for the future, for example via the unsubscribe link in every reminder or in Rookion under your reminders. We document consent and withdrawal under 3.12.
- Send records:
- To send the reminders we process time, channel, type and result in order to send reliably, analyse errors and avoid multiple notifications. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is reliable and traceable operation of the reminders. We delete this information after 90 days at the latest.
- Origin information:
- If you voluntarily tell us how you heard about Rookion, we use this to analyse our acquisition channels and to evaluate and improve our marketing measures. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is understanding how people find Rookion and aligning our measures accordingly. You can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).
- Share card:
- If you request a share card, we use information about your streak and your progress and, if you wish, your name to create the image for you (Art. 6(1)(b) GDPR). We do not store the card permanently; you decide whether and where you share it.
- Retention:
- Information on goals, plan, training steps, training days, appointments and progress as well as the origin information for as long as your account exists, the origin information only as long as you have not objected. Different periods are stated above.
5. Recipients and service providers
We only share personal data with the following recipients, each for the purposes stated. Processors only process data on our instructions on the basis of a contract under Art. 28 GDPR. Beyond that, we only share data where we are legally obliged to. With voice input, your browser sends the audio to its provider, see 3.6.
Supabase
- Purpose:
- Database, sign-in and storage of your content
- Seat and location:
- Supabase, Inc. (USA); the database is located in the EU (Frankfurt)
- Role:
- Processor
Vercel
- Purpose:
- Hosting and delivery of the application
- Seat and location:
- Vercel, Inc. (USA); processing also in the USA
- Role:
- Processor
Google Cloud (Vertex AI)
- Purpose:
- AI coaching and recognition of moves in the photo import
- Seat and location:
- Google Ireland Ltd. (Ireland), Google LLC (USA); processing in an EU region
- Role:
- Processor
Google (sign-in)
- Purpose:
- Sign-in with your Google account if you choose this option
- Seat:
- Google Ireland Ltd. (Ireland), Google LLC (USA)
- Role:
- Independent controller
Google Ads
- Purpose:
- Conversion measurement and remarketing for our ads, only with your consent, see 3.15
- Seat and location:
- Google Ireland Ltd. (Ireland), Google LLC (USA); processing also in the USA
- Role:
- Independent controller for conversion measurement, remarketing and the delivery of ads (Google Ads Controller-Controller Data Protection Terms); processor for the hash value of the email address in enhanced conversions (Google Ads Data Processing Terms)
Google Analytics
- Purpose:
- Usage and reach analytics, only with your consent, see section 4
- Seat and location:
- Google Ireland Ltd. (Ireland), Google LLC (USA); processing also in the USA
- Role:
- Processor (Google Ads Data Processing Terms); where analytics data pass to Google Ads for advertising purposes with your marketing consent, independent controller under the controller-to-controller terms
Stripe
- Purpose:
- Payment processing and subscriptions
- Seat:
- Stripe Payments Europe, Ltd. (Ireland), Stripe, Inc. (USA)
- Role:
- Independent controller for payment processing, compliance and fraud prevention, otherwise processor
Resend
- Purpose:
- Sending emails, including internal notices to us about new reports from the coaching ("report answer") and the feedback form: only the row id, move, move number, category, language, account status and lengths, no message text and no contact details
- Seat:
- Plus Five Five, Inc. (USA)
- Role:
- Processor
STRATO
- Purpose:
- Email mailbox and receipt of your messages to us
- Seat:
- STRATO GmbH (Germany)
- Role:
- Processor
PostHog
- Purpose:
- Usage analytics, only with your consent
- Seat and location:
- PostHog, EU cloud (processing in the EU)
- Role:
- Processor
Rewardful
- Purpose:
- Partner program, only with your consent
- Seat:
- Sunfounders LLC (USA)
- Role:
- Processor
Chess.com and Lichess
- Purpose:
- Fetching your games, see 3.4 and 3.7
- Seat:
- Chess.com, LLC (USA); Lichess.org (France)
- Role:
- Each an independent controller
AI services
- Purpose:
- Support for development, maintenance and error analysis and for drafting replies, see 3.13 and 3.14
- Providers and location:
- Providers of AI services such as Anthropic (Anthropic Ireland, Limited, Ireland) and OpenAI (OpenAI Ireland Ltd., Ireland); processing also in the USA
- Role:
- Processor; personal data is only received by providers with whom a data processing agreement is in place
Transfers to the USA: Where recipients process data in the USA, we base the transfer on the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR) where the recipient is certified, and otherwise on EU standard contractual clauses (Art. 46 GDPR). The special rule in 3.4 applies to Chess.com. You can request a copy of the safeguards at info@rookion.de. Where recipients are independent controllers, their privacy terms also apply.
6. Retention
We only store data as long as needed for the respective purpose or required by law. The periods of the individual processing operations are stated in section 3. In addition:
- Account, games, analyses and coaching: until your account is deleted; we then generally delete the data within 30 days, and backups are overwritten after no more than 30 further days.
- Payment and accounting records: according to statutory tax and commercial retention obligations, six, eight or ten years depending on the record.
- Data at analytics and marketing services: according to the settings and rules of the respective service, at PostHog generally no more than 12 months, at Google Analytics according to our setting no more than 14 months for user and event data, at Google Ads according to the periods in 3.15.
- Entries in your browser: until they expire, until you delete them or until you withdraw your consent.
7. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).
Right to object (Art. 21 GDPR): You can object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. You can object at any time, without giving reasons, to the use of your data for direct marketing; we then no longer use them for that purpose.
Withdrawal: You can withdraw a consent at any time with effect for the future. The lawfulness of the processing carried out until then remains unaffected.
Complaint: You can lodge a complaint with a data protection supervisory authority, for example the authority where you live or the one responsible for us: Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.
To exercise your rights, a message to info@rookion.de is sufficient.
8. Further information
Mandatory or voluntary: For an account we need your email address and a password or sign-in with Google, and for a subscription the payment details; without them this is not possible. All other information and consents are voluntary; without them only the respective feature is unavailable.
Automated decisions: We do not make decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).
Artificial intelligence: The coaching is generated by an AI language model and labelled as AI content in the app. It may contain errors and does not replace personal lessons.
Minimum age: Rookion is intended for people aged 16 and over. If a child under 16 has provided us with data, please contact info@rookion.de; we will then delete the data.
Changes: We update this policy when our processing changes. We inform registered users about material changes in a suitable way, for example by email. The date of the current version is shown at the top of this page.