Privacy Policy
Last updated: 13 August 2026
1. Controller
The controller responsible for the processing of your personal data is:
2. What data we collect
We collect and process the following categories of personal data:
- •Account data: email address, hashed password, account creation date, registration referral channel (e.g. partner or campaign link), time of last use
- •Profile and onboarding details: display name/username and optional onboarding information (self-assessed playing strength, chess experience)
- •Game data: chess moves, game results, AI difficulty settings
- •Imported games (PGN): if you import games (file or platform fetch), we process the information they contain: moves, player names (yours and your opponent's), date, event and source platform. You decide which games you import. With photo import (where available), the photo of your scoresheet is transmitted to Google Vertex AI (EU region, see section 5) solely for move recognition; we do not store the photo. Only the game you confirm on the board is stored.
- •Technical data on photo import: for each recognition run we store processing data to find errors and measure recognition quality: time and duration, image size and file format, the recognition model used and the size of the model request and response (tokens), the number of recognised rows and half-moves, a quality rating per recognised half-move and the point at which recognition stopped, if any, an error class for failed attempts, the stage at which you confirmed or abandoned the process, the number of your corrections and the duration of the review, and, for saved games, a reference to the game. The entries are linked to your account via your usage quota. The photo and the recognised moves are not part of this data.
- •Coaching conversations: messages exchanged with the AI coaching system
- •Subscription data: subscription plan, payment status (payment details are processed by Stripe)
- •Usage data: pages visited, features used, browser type, IP address, timestamps
Use without an account (free analysis): The free game analysis runs entirely in your browser; your game is not transferred to our servers for this. Only if you request the coaching taster, the position data of the selected moment is transmitted to Google Vertex AI (EU region, see section 5). Your IP address is not stored; it is only used as a day-bound hash for abuse prevention.
3. Purpose of processing
We use your data for the following purposes:
- •Account management: creation and maintenance of your user account
- •AI coaching: providing personalized chess coaching services based on your games and conversations
- •Service improvement: analysis of usage patterns to improve our Service
- •Billing: processing subscriptions and payments
- •Communication: sending service-related notifications and, with your consent, marketing emails
AI transparency: Rookion is an AI-powered system. The coaching is generated by an AI language model (Google Vertex AI, Gemini) and may contain errors; it does not replace personal chess instruction. AI-generated content is marked accordingly in the product. We will observe the transparency obligations under Article 50 of the AI Regulation (EU) 2024/1689, which apply from 2 August 2026.
4. Legal basis of processing
We process your personal data on the following legal bases of the GDPR:
- •Consent (Art. 6(1)(a) GDPR): for web analytics and heatmaps (via cookie banner), marketing communication and other optional data processing for which we ask for your express consent
- •Performance of a contract (Art. 6(1)(b) GDPR): for providing the AI chess coaching service, managing your account and processing payments
- •Legitimate interest (Art. 6(1)(f) GDPR): for service improvement, security, fraud prevention, maintenance, error analysis, administration as well as legal and security defense; this includes troubleshooting and quality measurement of the photo import based on the technical processing data (section 2)
- •Legal obligation (Art. 6(1)(c) GDPR): We log consent actions (grants and withdrawals) together with timestamps, IP addresses and browser information in order to comply with our accountability obligations under Art. 5(2) and Art. 7(1) GDPR. We generally store consent logs for up to 24 months; afterwards we delete or shorten the IP address and browser information insofar as they are no longer required for the proof. A reduced record (time, category, action, source as well as the banner/privacy version in force at the time of the decision) may remain stored for legal defense until the expiry of statutory limitation periods.
5. Third-party providers and data sharing
We use the following third-party providers to operate our platform:
Supabase (database & authentication)
Provider & registered office: Supabase, Inc. (USA); database hosting in the EU (Frankfurt)
Purpose: database, authentication, storage of your content
Data categories: account data, game data, coaching conversations as well as feedback/support messages (incl. optionally provided contact email). Feedback is stored in the database and processed by the operator in an internal admin view.
Role: processor (Art. 28 GDPR)
Region: EU (Frankfurt)
Transfer: processing in the EU; data processing agreement concluded, incl. EU Standard Contractual Clauses for any US connection of the provider
Google (sign-in via OAuth)
Provider & registered office: Google Ireland Ltd. (Ireland), possibly Google LLC (USA)
Purpose: optional sign-in/registration with your Google account (OAuth), only if you actively choose this login method
Data categories: the basic profile data provided by Google during login (email address, name/profile identifier); no access to other Google services
Legal basis: Art. 6(1)(b) GDPR (performance of the usage relationship at your request)
Role: Google is an independent controller for the login process; authentication is handled technically via Supabase Auth
Transfer: insofar as a US connection arises, based on the EU-US Data Privacy Framework (Google certified) and EU Standard Contractual Clauses
Chess.com / Lichess (game fetch)
Provider & registered office: Chess.com, LLC (USA); Lichess (lichess.org, operated by Lichess.org, France)
Purpose: fetching your recent games from the respective platform, only when you actively request the import
Data categories: the platform username you enter is transmitted to the respective platform's public API for the query; in return we receive the public game data (see "Imported games" in section 2)
Legal basis: Art. 6(1)(b) GDPR (performance of the usage relationship at your request)
Role: both platforms are independent controllers for their services, not processors for Rookion
Transfer: for Chess.com the query is made to a provider in the USA; only the username you entered is transmitted
Stripe (payment processing)
Provider & registered office: Stripe Payments Europe, Ltd. (Ireland), where applicable Stripe, Inc. (USA)
Purpose: processing of payments and subscriptions
Data categories: name, email, plan, amount, currency, payment/invoice status, Stripe customer number, subscription ID, where applicable billing address as well as refund/chargeback events. Full credit card data is processed exclusively by Stripe; we do not store it.
Role: For certain payment, compliance, fraud prevention and financial network processing, Stripe is an independent controller; insofar as Stripe processes technical platform and subscription functions on our behalf, Stripe acts as a processor (Art. 28 GDPR). Stripe is PCI-DSS compliant.
Region: EU/USA
Transfer: USA based on the EU-US Data Privacy Framework (Stripe certified), EU Standard Contractual Clauses as a fallback; data processing agreement concluded
Google Cloud / Vertex AI (Gemini, AI coaching)
Provider & registered office: Google Cloud (Google Ireland Ltd., Ireland; Google LLC, USA)
Purpose: generation of the AI coaching responses via the Gemini language model on Google Vertex AI; with photo import (where available), additionally the recognition of moves from the photo of your scoresheet
Data categories: position and game data, your coaching inputs as well as the generated model responses; with photo import, the photo of your scoresheet (transmitted only for the duration of recognition, exclusively to the EU region, not stored by us; the app removes image metadata such as the capture location before upload)
Role: processor (Art. 28 GDPR; Google Cloud Data Processing Addendum)
Region: processing in an EU region of Vertex AI
Transfer: insofar as a US connection arises, based on the EU-US Data Privacy Framework (Google certified) and EU Standard Contractual Clauses
Special features: Your inputs are not used to train the models. Google may briefly log data to a limited extent for abuse and security monitoring. We deliberately do not give a blanket assurance that all data remains in the EU.
Vercel (hosting)
Provider & registered office: Vercel, Inc. (USA)
Purpose: hosting and delivery of the application
Data categories: IP address and request metadata in server logs
Role: processor (Art. 28 GDPR)
Region: USA (global content delivery network)
Transfer: USA based on the EU-US Data Privacy Framework (Vercel certified), EU Standard Contractual Clauses as a fallback; data processing agreement concluded
PostHog (web analytics)
Provider & registered office: PostHog, operated on the EU cloud (eu.posthog.com)
Purpose: web analytics: page views, event tracking and heatmaps, exclusively with your consent
Data categories: page views, click and usage events, device and browser information, shortened IP address
Role: processor (Art. 28 GDPR)
Region: EU
Transfer: processing in the EU; data processing agreement concluded
Special features: Session replay (session recording) is used exclusively with your consent (analytics opt-in) and with full masking: all text inputs and visible text content (including the coaching dialog) are masked, so that no plaintext content is recorded. Only interaction behavior, navigation and clicks are captured, for analyzing user guidance and usability. The game and coaching area, as well as pages with personal content (game history, dashboard, settings, repertoire, import), are fully excluded from recording; no recording takes place there at any time. Only public pages (e.g. home, pricing, help) are recorded, and there too in masked form.
Rewardful (partner program / affiliate attribution)
Provider & registered office: Rewardful (Sunfounders LLC, USA)
Purpose: partner program: if you reach us via a partner referral link AND have consented to marketing cookies in the cookie banner, an attribution cookie is set so that a later purchase can be attributed to the referring partner and the commission can be settled
Data categories: a random referral ID in the attribution cookie; on purchase we pass this ID as a reference to our payment provider Stripe, through which Rewardful matches the purchase. No usage profiles are built
Legal basis: Art. 6(1)(a) GDPR (consent via the marketing toggle in the cookie banner), revocable at any time via the cookie settings. Without marketing consent no cookie is set and no attribution happens; purchasing works unchanged
Role: processor (Art. 28 GDPR)
Transfer: processing by a provider in the USA; the safeguards described in the closing paragraph of this section apply (Art. 45/46 GDPR)
Resend (email delivery)
Provider & registered office: Plus Five Five, Inc. (trading as "Resend"), San Francisco, California, USA
Purpose: transactional email delivery (order confirmation under §312f German Civil Code, withdrawal and cancellation confirmations, account and administrative notifications)
Data categories: name, email address, contract/order/subscription information, reference numbers, withdrawal/cancellation status, refund information, delivery/error logs
Role: processor for delivery; for its own account, security and abuse processing, Resend may act as an independent controller
Region/sub-processor: delivery infrastructure inter alia via Amazon Web Services, Inc. as sub-processor; where technically configured, via an EU region. Due to Resend's US registered office and the sub-processors used, a third-country connection (in particular the USA) cannot be excluded.
Transfer: third-country transfer to the USA (Resend), based on EU Standard Contractual Clauses (as well as the EU-US Data Privacy Framework, insofar as the respective provider is certified); data processing agreement under Art. 28 GDPR with Resend.
STRATO (mailbox and inbound email)
Provider & registered office: STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany
Purpose: hosting the email mailbox and receiving inbound email (e.g. replies and contact messages to info@rookion.de)
Data categories: email address and content of the respective email
Role: processor (Art. 28 GDPR)
Region: Germany/EU
Transfer: No third-country transfer (EU provider). Legal basis: Art. 6(1)(b) and (f) GDPR; data processing agreement under Art. 28 GDPR with STRATO.
Development, maintenance and administration (AI tools)
Provider & registered office: Anthropic PBC (third country, USA)
Purpose: Anthropic is used exclusively for development, maintenance, error analysis and administrative support. Personal production data is generally avoided, pseudonymized or shortened. Access takes place only in individual cases, insofar as necessary for error analysis, security or administration
Data categories: account, feedback, support, technical log and contract reference data (only in individual cases)
Role: processor
Region: third country (US connection)
Legal basis/transfer: Art. 6(1)(f) GDPR. Third-country transfer to the USA on the basis of a data processing agreement incl. EU Standard Contractual Clauses (Art. 46 GDPR). Only Anthropic products/accounts with a data processing agreement are used (no consumer/private use for production data)
Insofar as data is transferred to the USA, in particular with Vercel, Resend, Anthropic as well as with the US connection of Google, Stripe and Supabase, we base the transfer, insofar as the respective provider is certified, on the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). Insofar as no adequacy decision applies or is additionally required, we use EU Standard Contractual Clauses (Art. 46 GDPR). A copy of the relevant safeguards can be requested via info@rookion.de. With service providers acting as processors for us, we have data processing agreements under Art. 28 GDPR in place. Insofar as providers are independently responsible for certain processing operations, the processing takes place under their own privacy terms. We deliberately do not make a blanket statement that all data remains exclusively in the EU.
We do not sell your personal data to third parties. Data is only shared with the services mentioned above insofar as this is necessary for providing our Service.
Optional voice input (Web Speech API)
In the coaching chat you can optionally use voice input, only after actively clicking the microphone icon (opt-in). Technically this uses the browser's built-in speech recognition (Web Speech API).
Depending on the browser, the recorded audio may be transmitted to and processed by the servers of the respective browser vendor for recognition (e.g. Google for Chrome and Chromium-based browsers, Apple for Safari). This is outside Rookion's control and is subject to the privacy policy of the respective browser vendor.
Rookion itself does NOT record or store the audio; only the recognized text is inserted into the input field and can be reviewed and edited by you before sending. Please do not dictate particularly sensitive content.
Legal basis: your consent through active use (Art. 6(1)(a) GDPR) as well as performance of the usage relationship (Art. 6(1)(b) GDPR).
6. Data retention
The retention periods below are guideline values; what is decisive is the respective purpose of processing as well as statutory retention obligations. In individual cases, deviating periods may apply.
- •Account data: for as long as your account is active. After account closure or upon request, deletion generally takes place within 30 days (backup copies may persist for up to 30 additional days). The acquisition channel captured at registration is removed 24 months after registration, independently of the above.
- •Game and coaching data: for as long as your account is active, in order to enable coaching insights; removed upon account deletion.
- •Technical data on photo import: 90 days, then automatic deletion. Upon account closure they are removed together with the associated usage data.
- •Imported games: like game data - for as long as your account is active; removed upon account deletion. Where the games overview offers this function, you can permanently delete individual games yourself (including the associated coaching history); in addition, you can request deletion at any time via your rights under section 7.
- •AI coaching inputs (Google Vertex AI): not stored by Google for training purposes. Any logs for abuse and security monitoring are kept by Google only briefly according to its specifications (generally a few days up to a maximum of a few weeks).
- •Web analytics (PostHog): only with consent. Raw event data generally up to 12 months, then deletion or aggregation.
- •Server and security logs (Vercel): see Section 11; generally 90 days, extended in the case of security-relevant incidents.
- •Email delivery logs (Resend): briefly for delivery control, generally up to 30 days, unless longer storage is required for security, abuse or evidentiary reasons.
- •Payment records (Stripe): in accordance with applicable tax and commercial law, in Germany generally 10 years.
- •Consent and approval logs: generally up to 24 months; afterwards the IP address and browser information are deleted or shortened. A reduced record (time, category, action, source, applicable text version) may be retained until the expiry of statutory limitation periods (obligation of proof under Art. 7(1) GDPR).
- •Support and contact requests: until final processing; afterwards in accordance with any commercial and tax-law retention obligations.
7. Your rights
Under the GDPR, you have the following rights regarding your personal data:
- •Right of access: request a copy of your personal data
- •Right to rectification: request correction of inaccurate data
- •Right to erasure: request deletion of your personal data ("right to be forgotten")
- •Right to data portability: request your data in a machine-readable format
- •Right to object: object to processing based on legitimate interests
- •Right to restriction of processing: request restriction of processing under certain circumstances
- •Right to withdraw consent: withdraw a previously given consent at any time
- •Right to lodge a complaint: lodge a complaint with a supervisory authority (e.g. with your competent data protection authority)
To exercise any of these rights, contact us at info@rookion.de.
The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI BW), Lautenschlagerstraße 20, 70173 Stuttgart, Germany. You may also lodge a complaint with the supervisory authority of your habitual residence.
8. Cookies & analytics
We use the following categories of cookies:
- •Essential cookies: strictly necessary for authentication and session management. No consent under Section 25(2) TDDDG is required for them; the processing is based on Art. 6(1)(b) and (f) GDPR.
- •Local storage (first-party, no third-party access): We store up to three small markers in your browser's local storage. (1) A referral code when you open an invitation link, and (2) a promo code when you open a campaign link carrying one: both serve solely to credit you with the respective benefit after registration, are removed automatically once redeemed, and rely on Section 25(2) no. 2 TDDDG (storage necessary for the benefit attribution you initiated). (3) Only if you consent to the "Partner and Campaign Attribution" category in the cookie banner (Section 25(1) TDDDG) do we remember the acquisition channel of your first visit via a partner or campaign link; without consent this marker is never written, and withdrawing consent (at any time via the cookie settings in the footer) removes it immediately. In the browser this marker expires after 30 days at the latest and is removed the next time it is read; if you register, we attribute the acquisition channel to your account and store it there, separately from the browser period, for 24 months from registration (legal basis: Art. 6(1)(f) GDPR, evaluation and settlement of our partner campaigns); you may object to this storage at any time under Art. 21 GDPR. None of the markers contains an identifier of your person; no third party has access to the local storage, and no personal data is transmitted to partners (evaluation in aggregated form only).
- •Analytics cookies (optional): set only if you expressly consent in the cookie banner. We use PostHog (EU instance, hosted at eu.posthog.com) for the following purposes:
- •Page views & usage analytics: which pages are visited, which features are used, device type, browser type
- •Event tracking: pseudonymized, data-minimizing capture of user interactions (e.g. coaching started, game completed) to improve the Service
- •Heatmaps: aggregated representation of click and scroll behavior to optimize user guidance
We use session replay (session recording) only with your consent and with full masking: all text inputs and visible text content (including the coaching dialog) are masked, so that no plaintext content is recorded. Only interaction behavior, navigation and clicks are captured. The game and coaching area, as well as pages with personal content (game history, dashboard, settings, repertoire, import), are fully excluded from recording; no recording takes place there at any time. Only public pages (e.g. home, pricing, help) are recorded, and there too in masked form.
The analytics functions are activated exclusively after your express consent via the cookie banner. You can withdraw your consent at any time with effect for the future: via the “Cookie settings” link in the page footer (reopens the cookie banner) or by deleting your browser storage.
We do not use advertising tracking (e.g. Google or Meta pixels). Marketing cookies (optional): Only set with your explicit consent in the cookie banner. We currently use them exclusively for partner attribution via Rewardful (see section 5): if you arrive via a partner link, a cookie stores a referral ID so that your purchase can be attributed to the partner. No usage profiles are built from this. Without this consent, no marketing cookies are set. We do not share analytics data with advertisers.
9. Marketing communication
We send marketing emails only with your express consent (opt-in). You can unsubscribe at any time by clicking the unsubscribe link in any marketing email or by contacting us at info@rookion.de. Service-related emails (e.g. password resets, subscription confirmations) are sent as part of the performance of the contract and do not require separate consent.
10. Minimum age
Our Service is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe that a child under 16 has provided us with personal data, please contact us at info@rookion.de.
11. Security and abuse logs
We process technical log data in order to ensure the security, stability and integrity of our Service, detect abuse, fend off attacks, and assert or defend against legal claims.
Recorded events include, among others: login attempts (successful/failed), rate-limit hits, unusually frequent API access, access to admin routes, security-relevant status codes (e.g. 401/403/429), consent actions for the terms and privacy policy as well as account suspensions.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security of our platform and the prevention of abuse). The storage period is governed by purpose limitation and limitation periods; generally 90 days, extended in the case of security-relevant incidents.
You have the right to object to the processing on grounds relating to your particular situation (Art. 21 GDPR). Please note that essential security logging generally constitutes a compelling legitimate interest.
12. Thinking profile (optional)
If you turn on the thinking profile, Rookion detects recurring patterns in your play. Every pattern is shown with the concrete evidence from your own games (move moments and metrics). Without activation this processing does not take place.
- •Data sources: exclusively your own games and analysis moments. No third-party data, no external sources.
- •Purpose: your thinking profile in the app; later, training that builds on it.
- •Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the settings; upon withdrawal your profile is deleted. Your games and analyses are not affected.
- •Retention: until withdrawal or account deletion.
- •Recipients: none. Processing runs on EU servers; only you can see your profile.
Your rights under section 7 apply unchanged; in addition you can reset the profile yourself at any time (turn it off in the settings).
13. Changes to this policy
We may update this privacy policy from time to time. We will inform registered users of material changes by email. The "Last updated" date at the top of this page indicates when this policy was last revised.
14. Contact
If you have questions about this privacy policy or about exercising your data protection rights, please contact us: