Privacy Policy
Gambit is an AI chess-coaching app. This policy explains what we collect, why, who it is shared with, and the choices you have. We wrote it to match what the app actually does. If something is unclear, write to [email protected].
Short version. We store your account, the chess games you import and the analysis of them so we can coach you. Text describing your games is sent to an AI provider to write explanations. We do not run advertising, we do not track you across other companies’ apps and websites, and we do not access the advertising identifier (IDFA). You can delete everything inside the app.
Who we are
Gambit is operated by [legal entity name and address]. For privacy questions, including data requests, contact [email protected].
What we collect
| Data | Why we need it |
|---|---|
| Email address and password | To create your account and sign you in. Passwords are handled by our authentication system and are stored only as a hash, never in readable form. |
| Account ID | A random identifier that links your data to your account. |
| Chess.com and Lichess usernames | Only if you provide them, so we can fetch your public games. We never ask for your Chess.com or Lichess password. |
| Imported games | Games fetched from Chess.com or Lichess, PGN text you paste or link, and positions recognised from a screenshot you choose. Used to diagnose your weaknesses and build your Post-Mortems. |
| Games you play in the app | Moves and results of games against the coach or a Gauntlet rival. |
| Analysis and progress | Engine analysis of your games, Post-Mortems, weakness diagnoses, Ghost puzzle cards and attempts, Codex and Gauntlet progress, and the days you were active (for streaks). |
| Subscription status | Your plan (for example free or paid) and its status, received from our subscription providers so the app can unlock the right features. We do not receive your card number or Apple ID payment details. |
| Usage counters | Short-lived counters that enforce rate limits and daily coaching allowances. They expire automatically, generally within a day. |
| Technical data | Standard server request data such as IP address and timestamps, used to run and protect the service. |
On your device we also keep settings (theme, reminder preference) and your sign-in session. The optional daily reminder is scheduled on your device.
Photos
If you import a screenshot, the app asks for access to the single image you choose. We do not read the rest of your library. The app does not use your camera.
How we use it
- To provide the service: analysing your games, coaching, drills and progress.
- To unlock features according to your subscription.
- To keep the service secure, prevent abuse and fix problems.
- To answer your support requests.
We do not sell your personal data, and we do not use it for advertising or share it with data brokers.
Who receives data
AI providers (explanations only)
Chess moves and evaluations come from the Stockfish engine on our own servers, not from an AI. To write coaching text and Post-Mortem explanations, our servers send the relevant facts (for example a position, the move played, the engine’s evaluation and short game context) to a third-party large language model provider. We use a swappable set of providers and may use, for example, DeepSeek, MiniMax, Google or Anthropic models. We do not include your email address in these requests. Providers process the text under their own terms.
Subscription providers
Apple processes payments. RevenueCat manages subscription entitlements, and Superwall displays the paywall. They receive an app user identifier and purchase information as needed to do this.
Chess platforms
To import games we contact Chess.com or Lichess with the username you provided. Their public APIs see our server’s request, not your Gambit account.
Hosting
Our servers and database run on infrastructure we operate or rent. Our service providers process data on our instructions.
Legal
We may disclose data if required by law or to protect rights and safety.
Analytics, tracking and children
No tracking. The app does not include third-party advertising or analytics SDKs, does not request App Tracking Transparency permission, and does not use the advertising identifier.
Ages 13 and up. Gambit is not directed to children under 13 and we do not knowingly collect their data. If you believe a child under 13 has an account, contact us and we will delete it. In some regions the minimum age for consent to data processing is higher than 13, and users below it need a parent’s permission.
How long we keep data
- Account, games, analysis and progress: until you delete your account.
- Usage counters: expire automatically, generally within 25 hours.
- After deletion: your data is removed from our live database immediately. Encrypted backups, if any, are overwritten on their normal cycle, up to [N] days.
- Purchase records held by Apple, RevenueCat and Superwall follow their own retention rules.
Deleting your data
Open Settings, then Delete Account in the app. This permanently removes your profile, imported games, analyses, Ghosts, Codex and Gauntlet progress and subscription-status record from our systems. If you cannot use the app, follow the deletion page. Cancelling a subscription is separate and is done in your Apple ID settings.
Your rights
Everyone
You can access and delete your data in the app, and you can ask us for a copy or correction by email.
EEA, UK and Switzerland (GDPR)
You have the right to access, rectify, erase, restrict or object to processing, and to data portability, and to withdraw consent at any time where processing is based on consent. Our legal bases are: performing our contract with you (providing the app), our legitimate interests (security, abuse prevention, improving reliability), legal obligations, and consent where we ask for it. You may complain to your local data protection authority. Some processing occurs outside your country, including in the United States. Where required we rely on appropriate safeguards such as standard contractual clauses.
California and other US states (CCPA/CPRA)
You have the right to know what personal information we collect and use, to delete it, to correct it, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising. To make a request, use the in-app deletion or email us. We may need to verify your identity, and you may use an authorised agent.
Security
We use encrypted connections, restrict database access, and keep AI provider keys on our servers, never in the app. No system is perfectly secure, so please use a strong, unique password.
Changes
If we change this policy in a material way we will update the date above and, where appropriate, tell you in the app.