Rookie

Privacy notice

What Rookie stores – and what it doesn’t.

In short

  • Without an account everything stays on your device. We see nothing.
  • The account is optional: no email, no name, no password, no tracking and no advertising.
  • You can download your server data at any time and delete your account instantly.

Controller

Maximilian Auer, Vienna, Austria · [email protected]. Legal notice and the general privacy policy: maximilianauer.at/legal.

Without an account

Your training progress is stored only locally in your browser (IndexedDB) and is never sent to us.

With an account (optional)

To make your progress available on all your devices, we store:

  • Account: a random account ID, the time it was created and last used.
  • Passkey: your passkey’s identifier, its public key, a signature counter and the transport type (e.g. “internal”). Your private key and biometric data (Face ID / Touch ID) never leave your device.
  • Sessions: only a SHA-256 hash of the sign-in token and its expiry date.
  • Training data (compressed): puzzle attempts, rating history, review cards, mistake exercises, repertoire, endgame and course progress, activity, settings (including a linked Lichess or Chess.com username, if any), games against bots and PGN games you pasted.

Not stored: email address, name, password, IP addresses or device identifiers. Games imported from Lichess or Chess.com are not uploaded because they contain other players’ names – they are loaded again on each device. Please don’t upload PGN games containing other people’s data if you don’t want that.

Purpose and legal basis

Providing the account and synchronisation you request – Art. 6(1)(b) GDPR (performance of a contract). Accounts are for users aged 14 and over or with parental permission.

Cookies

Only strictly necessary cookies, limited to the /api path: rk_session (sign-in, up to 180 days) and rk_challenge (only during sign-in, 5 minutes). No analytics or advertising cookies.

Recipients and storage location

Hosting and database: Cloudflare, Inc. (Cloudflare Pages and D1) as processor under Cloudflare’s data processing addendum. The database is restricted to the EU. Any access from the USA is covered by the EU-US Data Privacy Framework or standard contractual clauses. Passkeys are managed by your operating system (e.g. Apple iCloud Keychain) under that provider’s terms.

Retention

  • Until you delete your account – deletion is immediate and permanent. Technical database restore points expire after at most 7 days.
  • Accounts unused for 2 years are deleted automatically.
  • Sign-ins expire after 180 days without use; sign-in challenges after 5 minutes.

Security

Encrypted transport (HTTPS), passkey-only sign-in (phishing-resistant), no passwords, session tokens stored only as hashes, access strictly limited to your own data. Rookie itself does not log personal data (Cloudflare processes technically necessary connection data, see the general privacy policy).

Your rights

Access, rectification, erasure, restriction, data portability and objection. Access and portability: “Download my server data” in Settings. Erasure: “Delete account”. For anything else, write to [email protected]. You can also lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).

Last updated: 2026-11-11