Privacy Policy

Information We Collect

To provide our chess-scanning service, we collect the following information:

• Account information: When you create an account with an email address and password, or sign in with Google (or with Apple, for accounts that use it), we receive your email address and a basic account identifier to create and manage your account.
• Content you upload: Photos of scoresheets, chessboards, and related images you capture or upload. Scoresheet images are sent to an AI model provider to be read into PGN. Board images are sent first to Chessvision.ai's recognition service; if it is unavailable or cannot read the board, they go to our own recognizer and then to an AI model provider. The result is standard chess notation (PGN or FEN).
• Games and analysis: The games you save or import, the engine analysis stored with them, practice positions built from your mistakes, opening repertoires, positions you save, and the reports you create.
• AI explanations: When you ask for an explanation of a game, a position or an event report, the moves, positions and engine lines it is based on are sent to an AI model provider to write it, and the text is kept with your game, position or report.
• Linked online accounts and scouting: If you link a Lichess or Chess.com username, we read that account's public games through the sites' public APIs and keep a summary of the statistics with your account; removing the link deletes it. An opponent scouting report reads the opponent's public games the same way and is kept in your account.
• Club workspaces: Coaches and clubs can keep a roster of the players they teach — name, the names they appear under on scoresheets, FIDE ID, rating and whether the player is a junior — together with the games and reports linked to them.
• Shared links: A public link to a game or a report is created by you, shows only what that page shows, and can be withdrawn at any time. Report links also expire on the date you choose.
• Credits and transactions: Your credit balance, purchase records, and consumption history, used for billing and abuse prevention.
• Usage and device information: For security and product improvement, we may log basic data such as device type, browser or extension version, and error reports.
• Website analytics: Google Analytics 4 and Microsoft Clarity may collect page views, referral sources, approximate city-level location and page interactions under the cookie rules and choices described below.

Browser Extension Sign-in and Scanning

From version 1.6 an account is optional: it is needed only for the server reader and for saving positions. If you connect your ScanChess website account, a session credential and basic profile stay in protected extension storage and are cleared on disconnection or expiry. Earlier releases may offer popup sign-in; passwords are sent only to the ScanChess authentication API and are not stored.

The extension captures visible webpage content only after you request a board scan. Selection and cropping happen on your device, and from version 1.6 the board is read there too: that image is not sent anywhere. Only when you choose the server reader (and in versions before 1.6, for every scan) is the selected image sent to api.scanchess.com and the board-recognition providers described in this policy (Chessvision.ai, our own recognizer, an AI model provider) for recognition.

Scan progress and results use browser session storage and clear when the session ends or you disconnect. Saved positions are stored in your ScanChess account. The extension does not collect browsing history in the background or include analytics scripts.

Opening a result on scanchess.com is optional. The transfer is bound to its destination and browser tab and expires after 30 minutes. Account, image and notation data are used only for the disclosed account connection, recognition, review and saving features.

How We Use Information

• To provide core functionality: recognizing your uploaded images, analyzing your games, and writing the explanations and reports you ask for.
• To manage your account, credit balance, and transactions.
• To keep the Service secure and prevent fraud and abuse.
• To respond to your support requests and improve the product.
• To train and test our own image-recognition models, such as the check in your browser that tells a chessboard photo from a scoresheet. For this we keep reduced-size copies of the photos you upload, apart from your account. They are never published, and the trained models contain no images. Email support@scanchess.com to have your photos left out or removed.
• To build your insights and practice positions from the games in your account.

Third-Party Services

We share the minimum necessary data with the following third parties to operate the Service:

• AI model providers (currently Google, Anthropic and OpenAI): the images you upload for recognition, and the moves, positions and engine lines behind an AI explanation you ask for, are sent to them for processing.
• Chessvision.ai: board images you upload are sent to Chessvision.ai's recognition service to be read into a FEN. If it is unavailable or cannot read the board, our own recognizer (operated by us) or an AI model provider reads it instead.
• Lichess and Chess.com: when you link a username, ask for a scouting report or use Chess Wrapped, that account's public games are requested from their public APIs.
• Google Sign-In (and Sign in with Apple, for accounts that use it): used for authentication.
• Waffo (Waffo Pancake): The merchant of record for web subscriptions. Your payment details are collected and processed by Waffo — we never see or store your card details. We receive only the order id, billing email, and subscription status, which we use to grant Pro.
• Google Analytics 4 and Microsoft Clarity: Website analytics subject to the cookie rules and choices described below.
• Cloudflare: Hosting, CDN, and email routing for the site and API, which processes the connection logs this requires.
• Sentry: Error reports from the site and API, so we can fix what breaks: the error, where in our code it happened, the page address without its query or any share-link token, and your browser and operating system. No account details, cookies, IP address or uploaded content are sent. Processed by Sentry (Functional Software, Inc.) in the United States.
• We do not sell your personal information, and we do not use it for advertising unrelated to the Service.

Cookies and Analytics

Your web sign-in session is kept in a secure, server-only cookie. Browser storage holds interface preferences and, after you confirm an import, may hold game data and images to restore your work. These drafts use session storage first and local storage when session storage is unavailable. The necessary session cookie cannot be turned off: without it you cannot stay signed in on the web. A second cookie records only whether this browser is signed in, so the scan page opens in the right layout before the session has been checked; it holds no account details.

Beyond that we use two analytics services, and both set cookies. Where prior consent is required by law — the EEA, the UK, and Switzerland — neither loads until you press "Accept" in the prompt. Elsewhere they are on by default and you can turn them off at any time (see below):

• Google Analytics 4: Visit counts, referral sources, and page performance. Processed by Google and may be transferred outside your country, including to the United States.
• Microsoft Clarity: Records clicks, scrolling, and mouse movement within a page (session replay) plus heatmaps, so we can find interface problems. We do not use it to identify you personally.

You can change your mind at any time from "Cookie settings" in the footer of every page, or from your account settings. When analytics are off, none of these scripts load at all. Turning them off does not stop a script that is already running in the tab you are on — reload the page and it will not come back.

Data Retention

We retain your account information, game history, and images only for as long as necessary to provide the Service. When the data is no longer needed, or when you request deletion, we delete it. Reduced-size copies kept to train our models (see “How We Use Information”) are not removed automatically when you delete a game or your account; email support@scanchess.com and we remove them.

Data Deletion and Account Deletion

You can delete your account at any time on the web at https://scanchess.com/delete-account. This deletes your account information along with the uploaded images, games and scan data associated with your account. Once deleted, this data cannot be recovered. Reduced-size copies kept to train our models are covered under “Data Retention”.

If you need help deleting your data, you can also email us at support@scanchess.com.

Data Security

We use reasonable technical and organizational measures to protect your data in transit and at rest. However, no method of transmission over the Internet or electronic storage is completely secure.

Your Rights

Wherever you live, you can exercise the following rights over the personal data we hold. To use any of them, email support@scanchess.com and we will respond within 30 days.

• Access: find out what data we hold about you and get a copy.
• Correction: ask us to fix data that is inaccurate.
• Deletion: delete your account yourself at any time, or ask us to do it.
• Restriction and objection: object to processing we base on legitimate interests, such as analytics.
• Portability: receive your game data in a common format — you can also export PGN yourself at any time.
• Withdraw consent: turn off analytics cookies at any time, without affecting processing carried out before you withdrew.

EU/UK visitors: we process data to perform our contract with you (account, scanning, billing), for our legitimate interests (security and abuse prevention), and on your consent (analytics cookies). You have the right to complain to your local data protection authority.

California residents: we do not "sell" or "share" personal information as those terms are defined by the CCPA/CPRA, and we will not treat you differently for exercising your rights.

International transfers: our providers (the AI model providers, Chessvision.ai, Cloudflare, Google, Microsoft, and Waffo) may process data outside your country, including in the United States and the EU.

Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact support@scanchess.com and we will delete it.

Coaches and clubs can add the players they teach, including junior players, to a club workspace, and are responsible for having the right to do so. A player is treated as a junior unless the club says otherwise: a shared report about a junior player never shows their full name, and its link lasts at most 30 days. A parent or guardian can ask us to delete a junior player's records by emailing support@scanchess.com.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated effective date at the top.

Contact Us

If you have any questions about this Privacy Policy, contact us by email at support@scanchess.com.