Legal
Privacy Policy
for the ChessLynx app and the website chesslynx.com
Last updated: September 29, 2026 · Version 1.2
1. Controller
CMZen Digital, owner Christian Mäusezahl, Grafinger Straße 113, 81671 Munich, Germany. Email: support@chesslynx.com, phone: +49 1522 198 1842. We have not appointed a data protection officer because the legal requirements for doing so are not met.
2. Summary
- ChessLynx is a chess learning app for children aged 5 and up. Your child does not need an account and does not enter anything about themselves.
- Without a parent account, no personal data leaves the device. The app does not connect to any of our servers.
- No advertising, no tracking, no analytics tools, no advertising IDs, no location data. We do not sell data and do not share it for advertising.
- A parent account is optional. It is needed to purchase the unlock and to back up your child’s progress and take it to another device.
- All parent account data is stored in the European Union and can be deleted completely at any time in the parent area.
3. Using the app without a parent account
The free part and everything your child plays works without an account. Learning progress (chapters completed, stars, puzzles solved, records, which explanations have already been heard) and settings (language, voice, subtitles, hints, time limit and today’s playing time) are stored on the device only and are not sent to us. Learning progress is removed when the app is deleted, when a parent selects “Reset progress” in the parent area or when the parent account is deleted on this device; settings remain until the app is deleted.
Lux speaks using the device’s built-in text-to-speech; where the app contains its own voice recordings, it plays those. Only fixed texts from the app are spoken; ChessLynx does not transmit any personal data in the process.
The app does not request permission to access the camera, microphone, location, contacts or photos and does not send notifications. Access to the microphone is additionally blocked at a technical level.
4. The parent account: which data, for what purpose, on what legal basis
Only an adult can create a parent account, behind the parent gate (see Section 8). The contracting party is the parent. When the account is created and afterwards, we process:
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, password (stored only as an encrypted hash at Google Firebase, never known to us), user ID, whether the email address is verified | Sign-in, verification of the email address, password reset, account-related enquiries | Art. 6(1)(b) GDPR (contract) |
| Proof of agreement: time, version of this Privacy Policy, of the Terms of Use and of the Notice to Parents | Evidence that and to what the parent agreed | Art. 6(1)(f) GDPR (legitimate interest in proof) |
| Child profile: a freely chosen nickname (optional; if left empty, the default “Entdecker:in”, German for “explorer”), time of creation | Display in the parent area | Art. 6(1)(f) GDPR (see below) |
| Progress overview: stars in the six basic-piece adventures, chapters completed, highest opponent level unlocked, time of the last transfer | Overview for parents in the parent area | Art. 6(1)(f) GDPR (see below) |
| Progress backup: the app’s complete game progress (chapters completed, practice tasks solved and stars, puzzle counter and record, which explanations and introductions have already been shown), time of the backup and of any reset | Backing up progress and transferring it to other devices of the same parent account (Section 5) | Art. 6(1)(f) GDPR (see below) |
| Unlock (yes/no), its time and proof of purchase (store, test or live environment, time of verification), and if the purchase moves to another account, the time of the move | Unlocking the full learning path for all child profiles in the account | Art. 6(1)(b) GDPR |
| Purchase assignment: user ID, store, environment, time of assignment, number of moves between accounts; as the key, a checksum (SHA-256) of store, environment and the store’s purchase identifier | Assigning a purchase to exactly one parent account (Section 6) and preventing misuse | Art. 6(1)(b) and (f) GDPR |
Data relating to the child: The nickname, progress overview and progress backup relate to the child, who is not a party to the contract. We therefore process them on the basis of legitimate interests (Art. 6(1)(f) GDPR): parents want to see, back up and transfer their child’s progress, and we want to offer this function. The child’s interests do not override this, because only an optional nickname and game progress are stored, nothing is shared or used for advertising, and parents can delete everything at any time. We do not ask the child for consent; Art. 8 GDPR therefore does not apply.
The actual playing time, language, voice and other device settings are not transferred to the account. We do not collect real names, dates of birth, photos, addresses or phone numbers of children.
5. When data is transferred: progress backup
Data is only transferred when a parent opens the parent area, is signed in and has verified their email address. The play part of the app does not itself connect to us. When the parent area is opened, the progress on this device is synchronised with the backup in the parent account: anything achieved on either device is kept; afterwards the device and the backup hold the same progress. This lets your child take their progress to a new device or keep it after reinstalling the app.
If a parent selects “Reset progress”, the backup is cleared. Other devices of the same account apply the reset the next time the parent area is opened.
6. Purchasing the unlock
The unlock is purchased through Apple’s App Store or Google Play. Apple or Google handle the purchase and payment under their own responsibility; their privacy policies apply. CMZen Digital does not receive any payment or card details. To verify the purchase, the app sends the purchase receipt to our verification function at Google Cloud (region Belgium), which has it confirmed by Apple or Google. We store the result (unlocked yes/no), the time and the purchase assignment described in Section 4 (Art. 6(1)(b) GDPR). A purchase always belongs to exactly one parent account. If it is restored with the same Apple ID or Google account in a different parent account, the unlock moves to that account and the previous account loses it. This prevents one purchase from being used for any number of accounts (Art. 6(1)(f) GDPR). We do not store the purchase identifier itself, only the checksum.
7. Service providers, recipients and transfers to third countries
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Firebase Authentication, Cloud Firestore, Cloud Functions, sending of account emails from noreply@chesslynx.com): the database is located in the “eur3” region (European Union), the verification functions in the Belgium region. Google processes the data as a processor under Art. 28 GDPR (Firebase Data Processing Terms). When a connection is established, Google necessarily processes the IP address and device data, including to prevent abuse such as automated sign-in attempts.
- Google LLC (USA): access from the USA cannot be completely ruled out. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); the European Commission’s Standard Contractual Clauses (Art. 46 GDPR) apply in addition.
- Apple and Google as store operators: for purchase, payment, download and updates of the app, each under their own responsibility.
- ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany: hosting of the website and the email mailbox, as a processor.
- MailerLite Limited, Ireland: only for the voluntary “Notify me” sign-up on the website (Section 11). MailerLite stores data in the EU but uses sub-processors in the USA for some services; transfers are then based on the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
Beyond this, we do not share any data, do not sell any data and do not use it for advertising.
8. Parental agreement and protection of children
Your child does not create an account. The parent area is protected by a parent gate (hold for three seconds and swipe, then solve a sum). When signing up, parents actively confirm: “I am an adult, I have read the Privacy Policy and the Terms of Use, and I agree.” This is how they accept the Terms of Use; the time and text versions are stored. They then verify their email address via a link (double opt-in). Only after this verification is the child profile created and progress data transferred; until then, the nickname also stays on the device only.
Parents can stop using the account at any time: via “Delete account and all data” in the parent area or informally by email to support@chesslynx.com. We then delete the account with all its data; the app can still be used without an account. Parents can also object at any time to the processing of data relating to their child (Art. 21 GDPR); we then delete it as well.
For parents in the United States, the “Notice to Parents (COPPA)” and the “Notice for California and other US states” at the end of this policy apply in addition.
9. Retention and deletion
- We store parent account data for as long as the account exists.
- “Delete account and all data” in the parent area (with password and two-step confirmation) immediately deletes the account, child profiles, progress backup, proof of agreement, unlock status, purchase assignment and settings in the cloud, as well as the account-related data on the device. On the device used for deletion, progress and the unlock are removed as well. A server-side function removes all related data, including the purchase assignment, both in this case and if an account is deleted by other means. We do not keep the proof of agreement after deletion. An account that has not yet been verified can be deleted again on the verification screen.
- We handle deletion requests sent by email to support@chesslynx.com without undue delay, at the latest within one month.
- Apple or Google document the purchase itself according to their own rules; it can be restored with the same Apple ID or Google account via “Restore purchases”.
- Data stored on the device remains until the app is deleted, the progress is reset or the parent account is deleted on this device; progress on other devices stays there.
- Technical connection data at Google is stored only briefly in accordance with Google’s specifications.
- Logs of our cloud functions (user IDs, store, environment, result of a purchase verification or deletion, and technical request data such as IP address and app identifier) are deleted by Google Cloud after 30 days.
- Our host deletes the website’s server logs after 7 days (Section 11).
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). The parent area shows an overview of progress; you can obtain full information about or a copy of the stored data by sending an informal request to support@chesslynx.com. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR); the authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.
11. Website chesslynx.com
Hosting and server logs: When you visit the website, our host ALL-INKL.COM processes technically necessary access data (date and time, page accessed, browser and operating system, referring page). The IP address is shortened before storage (11.22.33.44 becomes 11.22.0.0) so that it can no longer be attributed to a person. The logs are deleted automatically after 7 days. From the shortened logs, our host compiles access statistics without cookies and without reference to individuals. The purpose is the secure and trouble-free operation of the website (Art. 6(1)(f) GDPR).
Fonts: The website’s fonts are hosted on our own server. No connection to Google or other font providers is made when you visit.
Local storage: The website does not set any cookies itself. It only remembers the selected language in the browser’s local storage (entry “cl_lang_pref”) so that visitors see the language version they chose. This is strictly necessary for the function expressly requested (§ 25(2) no. 2 TDDDG). Details: section “Cookies and local storage”.
“Notify me” newsletter: If you voluntarily sign up for news about the app launch, you enter your email address in a form provided by our mailing service MailerLite Limited, 88 Harcourt Street, Dublin 2, D02 DK18, Ireland (processor under Art. 28 GDPR, data stored in the EU, sub-processors in the USA see Section 7). The legal basis is consent (Art. 6(1)(a) GDPR); the sign-up is confirmed via a confirmation link (double opt-in). The address is used only for messages about the app launch and stored until you withdraw consent. You can withdraw at any time via the unsubscribe link in every email or at support@chesslynx.com. The MailerLite script is only loaded when “Notify me” is clicked.
Contact by email: If you write to us, we process your message and email address to answer your enquiry (Art. 6(1)(b) or (f) GDPR) and delete them once the enquiry has been dealt with and no retention obligation applies.
Links to the app stores: You only leave our website when you click a store link; Apple’s or Google’s privacy policy applies there.
12. No automated decision-making
No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.
13. Changes to this policy
We increase the version number whenever the content changes. We inform parents about material changes in the parent area of the app; where new agreement is required, we obtain it there. Agreement given remains linked to the version that applied at the time it was given.
Notice to Parents (COPPA, United States)
ChessLynx is directed to children, including children under 13. This notice describes our practices under the US Children’s Online Privacy Protection Act (COPPA) and the amended COPPA Rule. It supplements the sections above.
Operator: CMZen Digital, owner Christian Mäusezahl, Grafinger Straße 113, 81671 Munich, Germany. Email: support@chesslynx.com, phone: +49 1522 198 1842. Christian Mäusezahl answers all questions about children’s privacy.
What we collect from your child: Without a parent account, nothing; all progress stays on the device. With a parent account, only the following is linked to a child profile: a nickname you choose (optional, never needed to be a real name), the progress overview and the progress backup described in Sections 4 and 5, and the times of transfers. We do not ask your child for a name, birth date, address, phone number, email, photo, voice, location, or any identifier used for advertising. The app contains no chat, no public profile and no way for your child to share information with others.
How we use it: only to show you your child’s progress, to back it up and to restore it on your other devices. We do not use it for advertising, profiling or any purpose unrelated to operating the app.
Disclosure: We do not sell, rent or disclose your child’s information to third parties. Google (Firebase) stores it on our behalf as a service provider and may not use it for its own purposes. Apart from that, no one receives your child’s information.
Verifiable parental consent: Consent is given only by an adult behind the parent gate: you actively confirm that you are an adult, have read this policy and the Terms of Use, and agree (time and version are recorded), and you confirm your email address via a link sent to you. Only then is a child profile created in the cloud and progress transferred. We use your child’s information only internally and do not disclose it.
Data retention policy:
| Information | Purpose and business need | Kept for | Deleted |
|---|---|---|---|
| Nickname, progress overview, progress backup | Showing, backing up and restoring your child’s progress | As long as the parent account exists | Immediately on “Delete account and all data”, on your email request (at the latest within one month), or when consent is withdrawn |
| Proof of consent (time, policy version) | Showing that you consented | As long as the parent account exists | Together with the account |
| Unlock status and purchase assignment | Providing the purchased full learning path to one parent account | As long as the parent account exists | Together with the account; the purchase itself stays restorable via Apple or Google |
| Data on the device only | Playing without an account | Until the app is deleted or progress is reset | By the parent at any time |
We do not keep children’s information longer than reasonably necessary for the purposes above and never indefinitely.
Your rights as a parent: You can at any time review your child’s progress in the parent area and request a full copy of the stored information by email to support@chesslynx.com; have the information deleted via “Delete account and all data” or by email; and refuse further collection or use by withdrawing consent, which we implement by deleting the account and its data. Your child can continue to use the app without an account afterwards. We never make a child’s participation depend on disclosing more information than is necessary.
Security: We protect children’s information with a written information security program appropriate to the size of our business: data is encrypted in transit and at rest, access rules allow each parent account to read only its own data, purchase verification and deletion run in protected server functions, and we review these measures at least once a year.
Notice for California and other US states
This notice supplements this policy for users in California (California Online Privacy Protection Act) and other US states. It is effective as of the date stated at the top of this policy.
- Categories and recipients: The categories of personal information we collect are described in Sections 4 to 6 and 11. We share them only with the service providers named in Section 7, who process them on our behalf.
- Do Not Track: The app and the website do not track users over time or across third-party websites or apps. We therefore do not respond differently to “Do Not Track” browser signals or similar mechanisms; there is nothing to switch off.
- Third-party tracking: We do not allow other parties to collect personally identifiable information about your online activities over time and across different websites or apps through ChessLynx.
- No sale or sharing: We do not sell personal information and do not share it for cross-context behavioral advertising. You can review and request correction or deletion of your information in the parent area or by email to support@chesslynx.com.
- Changes: We notify you of material changes in the parent area of the app and by updating the date at the top of this policy.