CHESS HISTORYPrivacy policy
Version in force on 20 October 2026
This policy explains which personal data Chess History (the “Service”) processes, why, for how long, and your rights. It covers the website, the web app and our emails.
1. Controller
FRAMYIA, SAS (French simplified joint-stock company, single shareholder), share capital of €500, Paris Trade and Companies Register 984 789 412, 229 rue Saint-Honoré, 75001 Paris, France. Data protection contact: [email protected]. We have not appointed a data protection officer, as this is not required for our activity.
2. What we don’t do
No advertising, no selling of data, no advertising trackers, no profiling. The Service works without an account: without one, your progress stays on your device and we receive no data about you beyond the anonymous audience measurement described in 3.7 and the technical logs described in 3.4.
3. Data, purposes and legal bases
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| 3.1 Create and manage your Account (including the one created when you buy the Pass without being signed in, with the email address entered at payment), sign you in by email code or with Google | Email address, technical ID, sign-in dates; if you use Google: the name and profile picture Google sends with your email (we only use the email) | Performance of the contract | Until the Account is deleted. Accounts inactive for 3 years are deleted after an email notice. |
| 3.2 Save and sync your progress | Progress in the stories (moves found, stars, endings discovered), settings | Performance of the contract | Until the Account is deleted |
| 3.3 Sell and unlock paid offers, prove your acceptance of the terms | Offer (and the story bought on its own), status, amount, country and regional price tier, Polar order IDs, date and version of the accepted terms | Performance of the contract; legal obligation (accounting, proof) | Contract term plus 5 years; accounting records: 10 years |
| 3.4 Run and secure the Service | IP address, browser type, requested pages, timestamps (server and host logs) | Legitimate interest (security, abuse prevention) | Short, per the host’s policy, for diagnosis and security only |
| 3.5 Send service messages (sign-in code, order confirmation, renewal notice, cancellation confirmation) | Email address, message content | Performance of the contract; legal obligation | Contract term |
| 3.6 Answer your requests and complaints | Messages, contact details | Legitimate interest; legal obligation | 3 years after the last exchange |
| 3.7 Measure the audience and use of the Service to improve it: where visitors come from, pages and stories viewed and how far they get, buttons seen and clicked, sales per visit, loading times and errors | A random identifier created in your browser, never linked to your Account or email; pages and actions in the Service; type of device, operating system, browser and in-app browser; screen size, language, time zone; country (derived from the IP address, which is not stored); referring site and campaign parameters of the link you followed; the rating you give a story at its end, if you choose to | Legitimate interest (improving the Service). Audience measurement exempt from consent (article 82 of the French Data Protection Act, CNIL guidelines): our own statistics only, never combined with other data, never shared | Identifier: 13 months from your first visit, never extended. Collected data: 25 months at most |
| 3.8 Email you the link to continue a story later, when you ask for it on the Pass screen (“Not now? Email me the link”), and only if you tick the box, remind you twice (2 and 6 days later) | Email address, the story and chapter where you stopped, language; whether you accepted the reminders, and when | Your request (steps taken at your request before a contract) for the link; your consent for the reminders, which you can withdraw at any time with the link in each reminder | Link only: your address is not stored, only a one-way fingerprint of it (which cannot be turned back into the address), for 60 days, to limit how often one address can be emailed. With reminders: the address is erased after the last one, as soon as you unsubscribe, or once the Pass is bought with it. Everything else: 60 days |
Card details are entered directly on Polar’s payment page; we never have access to them.
For audience measurement (3.7), when you start a payment a random reference created for that payment only lets our statistics count the sale for the visit it came from; it does not identify you. When you open the page in Safari or Chrome from the Pass screen of an app’s built-in browser (TikTok…), the same random identifier comes along in the link, so that your visit is not counted twice. You can switch audience measurement off at any time on the cookies page: it stops at once in that browser and its identifier is erased.
Ratings (3.7) are anonymous: they are counted with the visit statistics, never linked to an Account, and their average is shown on the site as explained in the terms of use.
4. Recipients and processors
- Cloudflare, Inc. (United States): website hosting and delivery network.
- Supabase: database, authentication and audience measurement, with data hosted in the European Union.
- Polar (Polar Software, Inc., United States): payments. Polar sells as reseller (merchant of record) and processes the transaction data (email, billing country, payment) as an independent controller under its own privacy policy; it relies on Stripe to process cards. It sends us the order’s email address, so that the Pass reaches the right Account.
- Our email provider (Resend, Inc., United States): sign-in codes, order-related emails, and the “continue later” links and reminders you ask for.
- Google (Google Ireland Limited), only if you choose “Continue with Google”: Google confirms your identity and sends us your email address, name and profile picture, under its own privacy policy.
Some providers are based in the United States or may access data from there. These transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses.
5. Local storage on your device
The Service stores your progress, settings, language and, if signed in, your session in your browser’s local storage. This is strictly necessary for the service you request and is never used for tracking. See the cookies page.
6. Children
A child under fifteen may only create an Account with the consent of a parent or guardian, who may exercise the rights below on the child’s behalf.
7. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to give instructions about your data after death. From the “My account” page you can download your data and delete your Account yourself. For anything else, email [email protected]; we may ask you to confirm your identity, for example with a code sent to your Account email. We reply within one month. You can lodge a complaint with the French data protection authority (CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr) or the authority of your country.
8. Security
Traffic is encrypted (HTTPS). Database security rules ensure each user can only read and change their own data. Sign-in uses one-time codes or Google, so no password is stored.
9. Changes
We may update this policy. The version in force is the one on this page, with its date. Account holders are notified by email of significant changes.