This is an English translation for your convenience. ProxyChess is operated from Germany; in case of any discrepancy, the German version is legally binding.
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Philipp Skoda
Hauptstraße 10
91088 Bubenreuth, Germany
E-mail: [email protected]
We are not legally required to appoint a data protection officer.
We process our users' personal data only to the extent necessary to provide a functioning application and our content and services. The legal bases are in particular Art. 6 (1) (a) (consent), (b) (contract or pre-contractual measures) and (f) (legitimate interest) GDPR.
We host ProxyChess with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes, on our behalf, all data generated by operating the website and the game server (including connection and game data). This is based on a data processing agreement pursuant to Art. 28 GDPR. The servers are located in Germany. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure, efficient provision).
For delivery, acceleration and protection (DDoS protection) we use Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). All traffic between your browser and our server is routed through Cloudflare; in doing so your IP address may be processed. The transfer to the USA is safeguarded by Standard Contractual Clauses (Art. 46 GDPR) and certification under the EU-US Data Privacy Framework. Legal basis: Art. 6 (1) (f) GDPR.
On each request, the system automatically collects data and information from the requesting device. This includes: IP address, date and time of access, the resource requested, the amount of data transferred, browser type and version, and the operating system. The data is stored in log files to ensure a smooth connection, convenient use, and the security and stability of the system. Legal basis: Art. 6 (1) (f) GDPR. Log files are deleted or anonymised after no more than 14 days.
ProxyChess does not use advertising or analytics cookies and does not use a web analytics service. The following local storage is technically necessary:
localStorage or as a technically necessary cookie) so that
you stay signed in and can be assigned to an ongoing game.
As this is exclusively technically necessary storage, it does not require consent under § 25 (2) TDDDG. Legal basis for the associated processing: Art. 6 (1) (f) GDPR or (b) GDPR (provision of the game).
For rated games, the leaderboard and saving your deck, you can create an account. We process: username, e-mail address and your password (exclusively as a cryptographic hash, never in plain text). You may also play as a guest without registering; for this an anonymous identifier is generated to which your deck is assigned.
Legal basis is Art. 6 (1) (b) GDPR (performance of the usage contract). The data is stored for as long as the account exists. You can delete your account yourself at any time (Settings → Account → "Delete account") or contact the e-mail address above informally.
To send transactional e-mails (e.g. confirmation of your e-mail address, password reset) we use the service Resend (Resend, Inc., USA). For this, your e-mail address and the message content are transmitted to Resend. The transfer to the USA is safeguarded by Standard Contractual Clauses (Art. 46 GDPR). Legal basis: Art. 6 (1) (b) GDPR (provision of the account) or (f) GDPR (account security).
When you play, we process game-related data: moves, results, game duration, cards played, and your rating. This data is needed to run games, evaluate rated games and display the leaderboard (where your username is shown publicly together with your rating). Legal basis: Art. 6 (1) (b) GDPR. We may evaluate anonymised/aggregated game statistics to improve the game and the AI (Art. 6 (1) (f) GDPR).
Account and game data are stored in a MongoDB database with MongoDB Atlas (MongoDB, Inc.) in a data-centre region within the European Union. A data processing agreement pursuant to Art. 28 GDPR is in place with MongoDB; the data remains in the EU. Legal basis: Art. 6 (1) (b) and (f) GDPR.
The chess engine (Stockfish) runs entirely in your browser / on your device. When playing against the computer, no personal data is transmitted to our servers or third parties for this purpose.
You have the following rights vis-à-vis the controller:
An informal message to [email protected] is sufficient to exercise these rights.
Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for the controller is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
We store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods. Account data is removed when the account is deleted; inactive guest accounts are deleted automatically after 30 days of inactivity.
We adapt this privacy policy whenever changes to our processing require it. The version published here at the time applies.
Last updated: June 2026