Privacy

1. Who is responsible

ChessBase GmbH, Osterbekstraße 90a, 22083 Hamburg, Germany. Theory is a ChessBase product, so the company’s privacy policy and imprint apply. This page adds what is specific to Theory; where the two say different things about Theory, this one is the more precise.

2. Signing in

Theory has no user accounts of its own. Signing in checks your username and password against the ChessBase Account Server (users.chessbase.com), the same account you use elsewhere at ChessBase. We store no password, and we keep no user profile beyond the sign-in itself: the server remembers your name so the page can greet you and so the app can talk to the ChessBase live services on your behalf.

Each attempt to sign in is recorded — the account name, whether it succeeded or why it was refused, the time, your IP address and your browser’s identification — and so is signing out. This is a security log: it is how we would notice someone trying other people’s passwords. The IP address is deleted from it after 90 days; the rest is kept. Only the site’s administrator can read it.

The puzzle on the sign-in card is generated by us and solved in the same request. It is not a third-party captcha: nothing about your visit is sent to Google, Cloudflare or anyone else to prove you are human.

3. Cookies

Theory sets exactly one cookie, and it is the one that keeps you signed in. No analytics cookie, no marketing cookie, no tracking pixel, no third-party embed that sets one.

That is why there is no cookie banner and no cookie-settings dialog on this site: there is nothing optional to decide. The site does keep usage statistics (section 5), but they are cookie-less and server-side: nothing is placed in your browser to do it, and nothing about your visit is sent to any third party.

4. What stays in your browser

Theory keeps your settings and your own analysis in your browser’s local storage. None of it is sent to us, and none of it is readable by any other site. Clearing your browser data for this site removes all of it — including saved analysis, which has no copy on our side.

• theory:ai:lang — the language you picked in the header
• theory:ui:recoAnswers, theory:ui:recoPins — your answers to “Find your opening” and the systems you pinned
• theory:tree:… — your own analysis, autosaved as PGN so a reload does not lose it
• theory:ui:… — how you left the app looking: panel layout, theme, 2D or 3D board, which games list, the Coach’s panel height
• Your AI provider keys, if you entered any — see section 7

5. What the server records about a visit

When you look at a position on the board, the app tells our server which position that was, and the server counts it. What is stored is one row per chess position — a visit count and the first and last time anyone looked at it. There is no user column, no session id and no IP address in that table: it measures which openings are popular, not who looked at them.

Separately, the server keeps a request log: for each page or data request the time, the address requested, whether it succeeded, your IP address, your browser’s identification and — if you are signed in — your account name. We use it to see how the site is used and to tell people from automated traffic. Those rows are deleted after 90 days; what remains are daily counts per account and per anonymous visitor, in which the visitor is a one-way code that can no longer be matched to any address once the day’s rows are gone. No cookie is involved, nothing is shared with a third party, and only the site’s administrator can read it. The log also notes the site name a request was made to (theory.chessbase.com or radio.chessbase.com) and whether the address carried a known attack pattern; the rest of the address after a “?” is never stored.

From your IP address the server also notes the country and the network it belongs to (your internet provider, or a cloud host — which is how it recognises much automated traffic). It looks them up in a database kept on our own server (IP geolocation by DB-IP); your address is not sent anywhere for this, and nothing finer than the country is recorded. The country stays in the daily counts after the IP address is deleted — a country is not a person. The same applies to the sign-in log in section 2.

On Radio ChessBase the player reports which song it plays and how much of it was played (and whether with sound), so we can see which songs are listened to and for how long. Such a report carries the same one-way visitor code, your account name if you are signed in, and the radio’s language — no IP address. These play counts are kept; only the site’s administrator can read them.

Web-server request logs are a separate matter and are kept by ChessBase under the company policy linked above.

6. ChessBase services your browser talks to

The live chess data is not proxied through us — your browser connects to the ChessBase servers directly, which is what makes it fast. Those connections carry the chess position you are looking at and, once you have signed in, your ChessBase identity:

• TeraBrain (tbserver.chessbase.com) — the LiveBook statistics. It keeps a shared “Visits” counter per position, and Theory increments it only for the position you are actually looking at, never for the lookups it makes in the background.
• The online game database and the player database — master games at the position, player photos and flags.
• The live broadcast server — only while the Live games list is the one on screen. Selecting another list stops it.
• The cloud engine (remoteengine.chessbase.com) — only when you switch the engine on.

7. The AI Coach and your own API key

The Coach is bring your own key. Your key is stored in your browser, the request goes from your browser straight to the provider, and we never see either.

If you enter a key for Anthropic, OpenAI or ElevenLabs, the Coach calls api.anthropic.com, api.openai.com or api.elevenlabs.io directly from your browser. What you type into the Coach, and the position it is asked about, therefore reach that company under their terms and privacy policy, on your account. Ours do not apply to what happens there.

Without a key the Coach still answers, from the shared cache — and then nothing leaves our servers at all. How the AI on this site works is its own page.

8. The shared answer cache is public

Answers to the Coach’s standard questions, and the narrations spoken over them, are cached and shown to other visitors at the same position. That is deliberate: it is what lets someone with no API key use the Coach at all.

So treat a standard question as something you are publishing, not as a private note, and do not put personal information in one. Your own free-form questions are not cached and are not shown to anyone.

9. Your rights

Under the GDPR you can ask for access to your data, its correction or erasure, a restriction of processing, a copy in portable form, and you can object to processing (Arts. 15–21). For Theory specifically, most of the answer is short: the sign-in, the sign-in log and the request log (sections 2 and 5) are the only things tied to you on our side, and signing out plus clearing this site’s browser data removes what is on yours.

Reach us through the ChessBase contact page, or the compliance hotline if you would rather not go through the usual channel. You may also complain to a data protection authority; ours is the Hamburg Commissioner for Data Protection and Freedom of Information.