Privacy Policy
Last updated: 4 October 2026
The German version of this policy is legally binding. This English translation is provided for convenience only; in case of discrepancies, the German version prevails.
1. Controller and contact
The controller responsible for processing your personal data is:
For any data protection question and to exercise your rights, contact us at info@rookion.de.
2. Overview
Rookion is an AI-powered chess coach. We process personal data to provide, bill and securely operate the service and, where you consent, to analyse and advertise it. We do not sell personal data.
Section 3 describes the individual processing operations by purpose, section 4 cookies and similar technologies, section 5 all recipients and service providers, section 6 retention and section 7 your rights.
3. Processing in detail
3.1 Visiting the website
- Data:
- IP address, time, requested address, browser and device information in our host’s server logs.
- Purpose:
- Delivering the pages, stability, security and error analysis.
- Legal basis:
- Art. 6(1)(f) GDPR (legitimate interest in secure and functional operation).
- Retention:
- As long as needed for security and error analysis, generally no more than 90 days; longer in the case of security incidents until they are resolved.
3.2 Account and sign-in
- Data:
- Email address, password (stored only as a hash) or sign-in with Google, display name, voluntary onboarding information (such as your self-assessed playing strength), time of registration and last use.
- Purpose:
- Providing and managing your account.
- Legal basis:
- Art. 6(1)(b) GDPR (user agreement).
- Note:
- When you sign in with Google, Google provides us with the basic data of your Google account (email address, name, identifier). Google is itself responsible for the sign-in process.
3.3 Games, analysis and AI coaching
- Data:
- Your played and imported games (moves, result, date, player names, origin), the analysis results, your messages in the coaching and the coach’s replies.
- Purpose:
- Analysing your games and AI coaching. The coach’s replies are generated by an AI language model (Gemini) via Google Vertex AI in an EU region; your inputs are not used to train the models. Google may cache requests in encrypted form for up to 24 hours to process them faster and may log them briefly and to a limited extent to detect abuse.
- Legal basis:
- Art. 6(1)(b) GDPR (user agreement).
- Retention:
- Until you delete the game or your account.
3.4 Importing games
- Ways:
- You can paste or upload games as PGN, fetch them from Chess.com and Lichess, or upload a photo of your scoresheet.
- Chess.com and Lichess:
- To fetch games we send the username you provide to the platform’s public interface; your public games come back. If you save your name in your account, we fetch new games regularly on our own until you remove the connection. We never ask for platform login credentials.
- Transfer to the USA (Chess.com):
- Chess.com, LLC is based in the USA. We are not aware of a certification under the EU-US Data Privacy Framework, and no standard contractual clauses exist with Chess.com; a level of protection equivalent to EU law is not ensured for this transfer, in particular US authorities may be able to access data. Only the username is transmitted. For a fetch you trigger with a click, we rely on the transfer being necessary for the fetch you requested (Art. 49(1)(b) GDPR). We only fetch a saved name regularly with your explicit consent, which you give after this notice when connecting (Art. 49(1)(a) GDPR); you withdraw it by removing the connection. Lichess is based in the EU (France).
- Scoresheet photo:
- We send the photo to Google Vertex AI (EU region) solely to recognise the moves; before uploading, the app removes image metadata such as the location. We do not store the photo; only the game you confirm after checking it is saved. For debugging and quality measurement we store technical processing data per recognition run, without the photo and without the moves (such as duration, image size, recognition quality, error type) and delete it automatically after 90 days (Art. 6(1)(f) GDPR).
- Quick summary:
- For automatically fetched games we use a chess engine on our servers, without an AI language model, to determine the moment with the biggest learning potential, so we can present the game to you in the dashboard and in the optional notification.
- Legal basis:
- Art. 6(1)(b) GDPR (user agreement) unless stated otherwise above. We keep platform connections until you remove them or delete your account.
3.5 Data of other players in your games
- Data:
- Games usually contain your opponent’s public username and the related game data (moves, result, date, possibly rating). The source is the game you provided or the platform’s public interface.
- Purpose:
- Solely as part of your game: to display and analyse it, to provide your coaching and to identify the game in the optional notification about new games (for this, the opponent’s name may be included in the email content sent to our email service provider). We do not use these data for separate profiles, for contacting anyone or for advertising.
- Legal basis:
- Art. 6(1)(f) GDPR (our and your legitimate interest in fully analysing your own game).
3.6 Voice input (optional)
- How it works:
- In the coaching you can dictate text. Voice input only starts when you click the microphone icon and uses your browser’s speech recognition. Depending on the browser, the audio is sent to the browser’s provider (such as Google for Chrome, Apple for Safari) and processed there under its privacy terms.
- What Rookion receives:
- Only the recognized text, which you can check and edit before sending. We do not record the audio.
- Legal basis:
- Art. 6(1)(b) GDPR. Voice input is an optional way of entering text; you can always type instead.
3.7 Free analysis without an account
- How it works:
- The free analysis runs entirely in your browser; your game is not sent to our servers for it. Only if you request the coaching sample are the details of the chosen moment (position, your move, the engine move and the evaluation) and the thought you entered for it sent via our server to Google Vertex AI (EU region) to create the sample.
- Abuse protection:
- For the sample we derive from your IP address, using a secret key, a check value valid only for that day; we do not store the IP address itself. Check values older than 7 days are deleted automatically.
- Legal basis:
- Art. 6(1)(f) GDPR (legitimate interest in protecting the free offer from abuse).
3.8 Thinking profile (optional)
- How it works:
- If you turn on the thinking profile, Rookion detects recurring patterns in your own games and shows them with evidence and exercises. For solved exercises we store per position whether, when and in how many attempts you found the move. Without consent this processing does not take place.
- Legal basis:
- Your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the settings; we then delete the profile and the exercise results. Your games and analyses remain.
- Retention and recipients:
- Until you withdraw consent or delete your account. There are no additional recipients; only you can see your profile.
3.9 Subscription and payment
- Data:
- Chosen plan, amounts, payment and invoice status including refunds, identifiers at our payment provider, possibly name and billing address. Full payment data such as card numbers are processed only by Stripe; we do not store them.
- Purpose:
- Concluding, billing and managing your subscription; complying with tax and commercial law obligations.
- Legal basis:
- Art. 6(1)(b) GDPR (contract) and (c) GDPR (statutory retention obligations).
- Reach measurement:
- Whether and when you started a trial, paid for the first time or cancelled is stored with your account (the time and the identifier of the related Stripe object, that is the checkout session or the subscription, no amounts) to evaluate which advertising and partner channels lead to purchases; evaluation is aggregated per channel only. The legal basis is Art. 6(1)(f) GDPR (measuring the effectiveness of our advertising); we delete these data with your account.
3.10 Emails
- Service emails:
- About your account and contract (such as confirmations, password, order confirmation, notices about your access), based on Art. 6(1)(b) GDPR.
- Emails with consent:
- Notifications about new games and marketing emails are only sent with your consent (Art. 6(1)(a) GDPR). Each of these emails contains an unsubscribe link; unsubscribing takes effect immediately. We log consent and withdrawal as evidence (see 3.12).
- One-off messages to customers:
- Paying customers may be asked once for feedback; the basis is Art. 6(1)(f) GDPR (improving our offer). Each such message points out that you can object at any time, for example by a short reply or to info@rookion.de.
- Objection:
- You can object at any time to the use of your data for direct marketing (Art. 21(2) GDPR); we then no longer use them for that purpose.
3.11 Registration origin and reach measurement
- How it works:
- Only with your consent to the category “Partner and campaign attribution” in the cookie banner do we read during your visit which way you came to us (campaign parameters of the link or the domain of the referring page, otherwise “direct”) and remember a partner or campaign link in your browser for up to 30 days. Without this consent we read neither link nor referrer for this purpose and only record “unknown” at registration.
- Storage with the account:
- At registration we store the acquisition channel with your account to evaluate, in aggregated form, which advertising and partner channels lead to registrations and purchases. The value is self-reported by your browser and we cannot verify it; it only concerns your own account and is not changed afterwards. We do not pass the value stored with your account on to partners or advertising networks.
- Sign-in with Google:
- When you register with Google, we store the value together with your consent on our server shortly before the redirect and transfer it to your account after sign-in. If you withdraw consent in the meantime, we still transfer a value that was already stored; you can object to this storage.
- Legal basis:
- For reading and storing in the browser, your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time via “Cookie settings” in the footer. For storage with the account, Art. 6(1)(f) GDPR (measuring the effectiveness of our advertising); you can object to it at any time under Art. 21 GDPR.
- Retention:
- With the account for 24 months from registration; after that we delete the value automatically.
3.12 Security, abuse prevention and evidence
- Data:
- Security-relevant events such as sign-in attempts, unusual access and request limits; also your acceptance of the terms, your confirmation that you have taken note of the privacy policy, and the granting and withdrawal of consents, each with time, source, IP address, browser information and text version.
- Purpose and legal basis:
- Protection against abuse and attacks and defence against claims (Art. 6(1)(f) GDPR), and evidence of consents (Art. 6(1)(c) GDPR in conjunction with Art. 5(2) and Art. 7(1) GDPR).
- Retention:
- Security logs generally no more than 90 days, longer in the case of incidents. In evidence of consent we automatically remove or shorten IP address and browser information after 24 months; a reduced record (time, type, action, source, version) may remain until the statutory limitation periods expire.
3.13 Support, feedback and contact
- Data:
- Your message, your email address and any information you provide.
- Purpose and legal basis:
- Handling your request (Art. 6(1)(b) GDPR, otherwise (f) GDPR).
- AI assistance:
- We may use AI services to help draft replies (see section 5).
- Retention:
- Until your request is resolved, afterwards only as far as statutory retention obligations apply.
3.14 Development and operation
- How it works:
- For development, maintenance and error analysis we use AI services (see section 5). We avoid, shorten or pseudonymise personal data from live operation in doing so; access only takes place in individual cases where necessary for error analysis, security or administration.
- Legal basis:
- Art. 6(1)(f) GDPR (secure and error-free operation).
3.15 Advertising and conversion measurement with Google Ads (optional)
- How it works:
- Only with your consent to the “Marketing” category in the cookie banner do we load the Google tag for Google Ads. Google then measures whether visitors who arrive via one of our ads sign up or take out a subscription; Google recognises the purchase from the visit to the order confirmation page, without an amount. At registration we send your email address to Google solely as a hash value so that Google can attribute the registration to an ad even when cookies are not sufficient (enhanced conversions). Visitors who have also consented to the “Analytics” category may see Rookion ads in the Google advertising network (remarketing via audiences from Google Analytics).
- Data:
- Pages visited (address only, without parameters), interactions the Google tag detects automatically (such as scrolling, clicks on links to other websites, downloads, video views), time, browser and device information, IP address, the click identifier from the ad, cookie identifiers and, at registration, the hash value of your email address; the purchase is transmitted only as the visit to the order confirmation page.
- Legal basis:
- Your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); withdrawal at any time via “Cookie settings” in the footer. Without this consent or after a withdrawal we do not load Google Ads. A consent given at a time when the “Marketing” category did not yet include Google is not sufficient; the banner then asks again.
- Retention:
- Google attributes a registration or purchase to an ad only if it takes place up to 90 days after a click, up to 3 days after an active video view or up to 1 day after viewing an ad. Remarketing audiences keep a visitor for up to 540 days. Google Ads retains aggregated reporting data according to its retention rules. Cookies set by Google Ads on our website expire after no more than 90 days, cookies of Google’s advertising domains after no more than 13 months; after a withdrawal we immediately delete those set on our website.
- Further information:
- How Google uses data from websites that use Google services: https://policies.google.com/technologies/partner-sites
5. Recipients and service providers
We only share personal data with the following recipients, each for the purposes stated. Processors only process data on our instructions on the basis of a contract under Art. 28 GDPR. Beyond that, we only share data where we are legally obliged to. With voice input, your browser sends the audio to its provider, see 3.6.
Supabase
- Purpose:
- Database, sign-in and storage of your content
- Seat and location:
- Supabase, Inc. (USA); the database is located in the EU (Frankfurt)
- Role:
- Processor
Vercel
- Purpose:
- Hosting and delivery of the application
- Seat and location:
- Vercel, Inc. (USA); processing also in the USA
- Role:
- Processor
Google Cloud (Vertex AI)
- Purpose:
- AI coaching and recognition of moves in the photo import
- Seat and location:
- Google Ireland Ltd. (Ireland), Google LLC (USA); processing in an EU region
- Role:
- Processor
Google (sign-in)
- Purpose:
- Sign-in with your Google account if you choose this option
- Seat:
- Google Ireland Ltd. (Ireland), Google LLC (USA)
- Role:
- Independent controller
Google Ads
- Purpose:
- Conversion measurement and remarketing for our ads, only with your consent, see 3.15
- Seat and location:
- Google Ireland Ltd. (Ireland), Google LLC (USA); processing also in the USA
- Role:
- Independent controller for conversion measurement, remarketing and the delivery of ads (Google Ads Controller-Controller Data Protection Terms); processor for the hash value of the email address in enhanced conversions (Google Ads Data Processing Terms)
Google Analytics
- Purpose:
- Usage and reach analytics, only with your consent, see section 4
- Seat and location:
- Google Ireland Ltd. (Ireland), Google LLC (USA); processing also in the USA
- Role:
- Processor (Google Ads Data Processing Terms); where analytics data pass to Google Ads for advertising purposes with your marketing consent, independent controller under the controller-to-controller terms
Stripe
- Purpose:
- Payment processing and subscriptions
- Seat:
- Stripe Payments Europe, Ltd. (Ireland), Stripe, Inc. (USA)
- Role:
- Independent controller for payment processing, compliance and fraud prevention, otherwise processor
Resend
- Purpose:
- Sending emails
- Seat:
- Plus Five Five, Inc. (USA)
- Role:
- Processor
STRATO
- Purpose:
- Email mailbox and receipt of your messages to us
- Seat:
- STRATO GmbH (Germany)
- Role:
- Processor
PostHog
- Purpose:
- Usage analytics, only with your consent
- Seat and location:
- PostHog, EU cloud (processing in the EU)
- Role:
- Processor
Rewardful
- Purpose:
- Partner program, only with your consent
- Seat:
- Sunfounders LLC (USA)
- Role:
- Processor
Chess.com and Lichess
- Purpose:
- Fetching your games, see 3.4
- Seat:
- Chess.com, LLC (USA); Lichess.org (France)
- Role:
- Each an independent controller
AI services
- Purpose:
- Support for development, maintenance and error analysis and for drafting replies, see 3.13 and 3.14
- Providers and location:
- Providers of AI services such as Anthropic (Anthropic Ireland, Limited, Ireland) and OpenAI (OpenAI Ireland Ltd., Ireland); processing also in the USA
- Role:
- Processor; personal data is only received by providers with whom a data processing agreement is in place
Transfers to the USA: Where recipients process data in the USA, we base the transfer on the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR) where the recipient is certified, and otherwise on EU standard contractual clauses (Art. 46 GDPR). The special rule in 3.4 applies to Chess.com. You can request a copy of the safeguards at info@rookion.de. Where recipients are independent controllers, their privacy terms also apply.
6. Retention
We only store data as long as needed for the respective purpose or required by law. The periods of the individual processing operations are stated in section 3. In addition:
- Account, games, analyses and coaching: until your account is deleted; we then generally delete the data within 30 days, and backups are overwritten after no more than 30 further days.
- Payment and accounting records: according to statutory tax and commercial retention obligations, six, eight or ten years depending on the record.
- Data at analytics and marketing services: according to the settings and rules of the respective service, at PostHog generally no more than 12 months, at Google Analytics according to our setting no more than 14 months for user and event data, at Google Ads according to the periods in 3.15.
- Entries in your browser: until they expire, until you delete them or until you withdraw your consent.
7. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).
Right to object (Art. 21 GDPR): You can object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. You can object at any time, without giving reasons, to the use of your data for direct marketing; we then no longer use them for that purpose.
Withdrawal: You can withdraw a consent at any time with effect for the future. The lawfulness of the processing carried out until then remains unaffected.
Complaint: You can lodge a complaint with a data protection supervisory authority, for example the authority where you live or the one responsible for us: Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.
To exercise your rights, a message to info@rookion.de is sufficient.
8. Further information
Mandatory or voluntary: For an account we need your email address and a password or sign-in with Google, and for a subscription the payment details; without them this is not possible. All other information and consents are voluntary; without them only the respective feature is unavailable.
Automated decisions: We do not make decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).
Artificial intelligence: The coaching is generated by an AI language model and labelled as AI content in the app. It may contain errors and does not replace personal lessons.
Minimum age: Rookion is intended for people aged 16 and over. If a child under 16 has provided us with data, please contact info@rookion.de; we will then delete the data.
Changes: We update this policy when our processing changes. We inform registered users about material changes in a suitable way, for example by email. The date of the current version is shown at the top of this page.