Privacy policy

1. Controller

The controller for data processing on this website and in the Jadoube-Collective Discord bot is:
Jadoube-Collective, Fabian Kempert, Malteserstraße 13, 79423 Heitersheim, Germany
E-mail: fabian@jadoube-collective.com · Telephone: +49 175 9870418

2. Your rights

You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on consent, you may withdraw that consent at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority; the competent authority for us is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI Baden-Württemberg), Stuttgart.

Providing personal data is neither legally nor contractually required, except where it is necessary to conclude a contract or to use a specific function. Without it, we may not be able to provide that function.

3. Website hosting (Shopify)

This website runs on Shopify (Shopify International Limited, Ireland; Shopify Inc., Canada). Visiting the site processes technically necessary data such as IP address, browser and access time in order to deliver the site securely and reliably. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). A data processing agreement is in place with Shopify.

4. Cookies and consent

We use technically necessary cookies for basic functions such as the shopping basket; these do not require consent (§ 25(2) TDDDG, Art. 6(1)(f) GDPR). Any non-essential cookies — in particular third-party affiliate tracking — are set only with your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. You give or refuse that consent granularly in our cookie banner, with no pre-ticked boxes, and can change or withdraw it at any time.

5. Orders, payment and delivery

If you place an order we process the data required to perform the contract (name, address, contact details, order details) on the basis of Art. 6(1)(b) GDPR. Payments are handled by Shopify Payments and Stripe (Stripe Payments Europe Ltd., Ireland; Stripe, Inc., USA); your payment details are transmitted directly to the payment provider and are not stored by us. Where an item is shipped directly by a supplier, we pass your delivery address to that supplier solely for the purpose of dispatch. Statutory tax and commercial retention obligations remain unaffected.

6. The Jadoube-Collective Discord bot

Our coaching bot runs inside Discord. If you use it, the following applies in addition to Discord's own privacy policy (Discord Netherlands B.V. / Discord Inc.), over which we have no control.

What we process

  • Discord identifiers — your user ID, the server and channel a command is used in, and roles we assign (for example a rating role or the Supporter badge).
  • Chess data you submit — games in PGN form, Lichess or Chess.com usernames, positions, and the analysis results derived from them, including your weakness profile and mistake history.
  • Photographs of scoresheets and diagrams that you upload to /scan or /scoresheet. We do not store the image itself: it is held in memory only for as long as the recognition takes and transmitted to Anthropic for that purpose. The copy you uploaded to Discord remains on Discord's servers under their control. We do, however, store the result — for a scoresheet that is the reconstructed game together with the player names written on it, which normally includes your opponent's name. By uploading a scoresheet you therefore also submit another person's personal data.
  • Linked accounts — if you use /lichess we store an access token issued by Lichess so we can export analyses to your account; if you use /fide we store the FIDE ID you provide in order to assign the correct rating role. Unlinking deletes the stored token or ID immediately.
  • Club and community data — puzzle streaks, club results and rankings, league fixtures and reminders, tournament registrations, and predictions in the Tippspiel.
  • Donations — if you donate, Stripe processes the payment and we receive confirmation in order to grant the Supporter role. We do not receive your card details.

Legal basis — Art. 6(1)(b) GDPR for functions you actively request, and Art. 6(1)(f) GDPR for operating, securing and rate-limiting the service. Linking a Lichess or FIDE account rests on your consent under Art. 6(1)(a) GDPR.

Recipients — to provide these functions, data is passed to: Render (Render Services, Inc., USA), which hosts the bot and its database; Anthropic (Anthropic PBC, USA), whose Claude model reads uploaded images and turns the engine's findings into plain-language coaching; Lichess and Chess.com, to retrieve publicly available games; and Stripe for donations. Cloudflare (Cloudflare, Inc., USA) stores encrypted backup copies of the bot's database; we encrypt them before upload, so Cloudflare cannot read their contents, and they are held exclusively within the European Union. Move evaluation itself is performed by the Stockfish engine on our own infrastructure and involves no third party.

7. The weakness report on this website

If you enter a Lichess or Chess.com username on our Find Your Book page, we retrieve your recent publicly available games from that platform and analyse them in order to produce the report you asked for. No Discord account is involved, and no account is created for you in the sense of a login.

What we process

  • the username you enter, and the platform you selected;
  • the games retrieved for that username and the moves within them;
  • the weaknesses, mistake positions and rating estimate derived from that analysis;
  • a salted, non-reversible hash of your IP address, used solely to limit abuse of a free service. We do not store the IP address itself.

Legal basis — Art. 6(1)(b) GDPR, because you requested the report. The abuse-limiting hash rests on Art. 6(1)(f) GDPR (our legitimate interest in keeping the service available and affordable).

Recipients — Render (hosting and database), Anthropic (naming the pattern behind each mistake), and Lichess or Chess.com (retrieving your games). Move evaluation runs on the Stockfish engine on our own infrastructure and involves no third party. If you ask us to send the report to you by e-mail, Resend (Resend, Inc., USA) delivers that message; we pass it your address and the link to your report for that purpose only, and we send nothing else to that address.

Giving an e-mail address is optional — the report is fully readable without one, and asking for it to be sent is a request for that one message, not a subscription.

Retention — a report and everything derived from it is erased 90 days after it was created. If you claim it into a Discord account with the /claim command, it becomes part of your member record and the 24-month rule in § 12 applies instead. You can also delete a report and all data derived from it at any time, without giving a reason and without contacting us, using the deletion option on the report page.

8. E-mail updates

If you give us your e-mail address we use it to send occasional updates about the project on the basis of your consent (Art. 6(1)(a) GDPR). Every message contains an unsubscribe link, and withdrawing consent is free of charge.

9. Contacting us

If you contact us by e-mail we process your details in order to handle the enquiry (Art. 6(1)(b) or (f) GDPR). Our mail is hosted with Google Workspace (Google Ireland Limited).

10. Affiliate links

We take part in affiliate programmes — currently Forward Chess, medimops and Thalia, each administered through the affiliate network Awin (Awin AG, Berlin), and Chessnut, administered through the affiliate platform UpPromote. If you click a link marked as an affiliate link, the network or the merchant may set a cookie so that a resulting purchase can be attributed to us. This happens only with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG) and costs you nothing extra. Chessnut links lead directly to Chessnut's own shop; attribution there uses a link parameter processed under Chessnut's responsibility, and no cookie is set on this website for that purpose. The processing is carried out under the responsibility of the respective provider; please see their privacy notices for details.

11. Transfers outside the EU

Some recipients named above are based in the United States (Anthropic, Render, Stripe Inc., Discord Inc., Cloudflare, Inc., Resend, Inc.). Transfers take place on the basis of the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the basis of the European Commission's Standard Contractual Clauses together with additional safeguards. You may request a copy of the relevant safeguards from us. Backup copies held with Cloudflare are pinned to the European Union by a jurisdictional restriction and do not leave the EU; they are additionally encrypted by us before upload.

12. Retention

  • Order and invoice data — retained for the statutory periods under German tax and commercial law (generally 10 years).
  • Uploaded images — not stored by us at any point.
  • Games, analyses, weakness profiles and mistake history — erased automatically once you have not used the bot for 24 months, and at any time on request. You can delete your entire record yourself at once with the /forget command in Discord.
  • Weakness reports requested on this website — erased automatically 90 days after the report was created, unless you claim the report into a Discord account, after which the 24-month rule above applies. An e-mail address given in order to receive a report is erased together with that report.
  • Lichess access tokens and FIDE IDs — deleted as soon as you unlink the account.
  • E-mail address for updates — kept until you unsubscribe.
  • Encrypted database backups — kept for 30 days and then deleted automatically.
  • Server and platform log data — retained by our hosting providers for a limited period in accordance with their standard retention settings.

Where a club match involves two players, erasing your record removes your name from the match but keeps the result, so that your opponent's rating history remains intact.

Erasure takes effect in the live system without undue delay. For technical reasons an erased record may still be present in existing backup copies until those expire after 30 days; such data is never restored.

13. Automated processing

Our analysis produces automated recommendations — an engine evaluates your games and a model describes the result. This supports your own decisions and produces no legal effect concerning you, so it is not automated decision-making within the meaning of Art. 22 GDPR.

14. Changes

We update this notice when our features or the legal position change.

Version: August 2026