Privacy policy

Beau Coup is a chess opening trainer. This policy explains which personal data the Beau Coup service (the apps, the website beaucoupchess.com and the server api.beaucoupchess.com) processes, why, and what your rights are.

In short

• We only collect what the service needs to work. No advertising, no analytics, no trackers.
• Your data is hosted in the European Union (Germany and Finland) and is never sold.
• You can delete your account and all its data yourself, at any time.
• Card payments are handled by Stripe, Google Play or the App Store: we never see your card details.

Who is responsible

The data controller is the publisher of Beau Coup, Julien Bachelier (see the legal notice). For any question about your data, write to contact@beaucoupchess.com.

What we process and why

Your account

If you create an account: your e-mail address, your password (stored only as an Argon2id hash that nobody can read back), whether your address is verified, and the creation date. If you sign in with Lichess, Google or Chess.com instead: the identifier of your account with that provider and the details it shares (your Lichess or Chess.com username, the e-mail address Google or Chess.com confirms). Purpose: to provide your account. Legal basis: performance of the contract (our terms of service).

Your training data

Your repertoires (moves and comments), your spaced-repetition review state and your review history, so that they synchronise between your devices. Legal basis: performance of the contract.

Your sessions

One sign-in token per device, with the device type (for example "android" or "linux") and the date it was last used, so that you stay signed in. Tokens are stored hashed and removed when you sign out or change your password. Legal basis: performance of the contract.

Premium

If you subscribe: your subscription status, plan and renewal date, and the reference of your customer record at the payment provider (Stripe) or of your store purchase (Google Play, App Store). Payment details are entered and kept by these providers only. Legal bases: performance of the contract, and our legal obligations for accounting records.

E-mails

Your e-mail address is used to send service messages only: address confirmation and password reset links. No newsletters and no marketing.

Technical data

• Your IP address is used, only in the server's memory and for at most one hour, to limit abusive repeated attempts (sign-in, account creation, password recovery). It is not written to our database or logs.
• Our server logs record requests (address, status, duration) without your IP address, for troubleshooting.
• The chess positions you look up in the opening explorer or analyse with the cloud engine are processed to answer you; explorer results are cached anonymously, without any link to your account.

Legal basis: our legitimate interest in keeping the service secure and working.

What stays on your device

The app works without an account: your repertoires and reviews are then stored on your device only. Without an account, the app queries the Lichess opening explorer directly, which is subject to the Lichess privacy policy.

Cookies

The website only sets cookies that are strictly necessary, which do not require consent: bc_session keeps you signed in to your account page (30 days, deleted when you sign out), and bc_oauth protects a sign-in with Lichess, Google or Chess.com while it is in progress (10 minutes). bc_transfer keeps, for 10 minutes at most, a request to move a sign-in method linked to another account until you confirm it. There are no analytics, advertising or third-party cookies.

Who receives data

• Hetzner Online GmbH (Germany and Finland) hosts our servers and our encrypted backups.
• Stripe processes card payments for subscriptions bought outside the app stores.
• Google Play and Apple process subscriptions bought in their stores.
• Lichess, Google and Chess.com confirm your identity, only if you choose to sign in with them.

Stripe, Google, Apple and Chess.com may process data in the United States, under the European Commission's standard contractual clauses or the EU-US Data Privacy Framework. We do not sell or rent your data and do not share it for advertising.

How long we keep it

• Account and training data: as long as your account exists. Deleting your account erases your data from our database immediately. It may remain in our encrypted backups, hosted in the European Union (Germany and Finland), for 7 months at most, and is then permanently erased. If we ever have to restore a backup, account deletions made since then are applied again.
• Confirmation and password-reset links expire after 48 hours and 1 hour.
• Billing records: for the period required by law (10 years for accounting documents in France).

Your rights

Under the GDPR you can access, correct and erase your data, receive it in a portable format, restrict or object to its processing. You can delete your account yourself from your account page or in the app, and export your repertoires as PGN from the app. For anything else, write to contact@beaucoupchess.com; we answer within one month. You may also lodge a complaint with the French data protection authority, the CNIL, or with the authority of your own country.

Security

All connections are encrypted (TLS), passwords and tokens are stored hashed, and the code of Beau Coup is open source, so anyone can check how your data is handled.

Children

If you are under 15, ask a parent or guardian before creating an account.

Changes

We will update this page when the service changes; the date at the top shows the latest version. Significant changes will be announced by e-mail or in the app.