Privacy policy

Last updated: 9 September 2026

Blunderbase is software you run yourself. The desktop app, the Docker image and the iOS app send nothing to us: no analytics, no crash reports, no tracking, and there is no account with us. What we do process is limited to this website and the public demo, and is described below.

1. Controller

The controller responsible for data processing on this website and the demo is:

2. Your own Blunderbase

When you install Blunderbase, everything it holds stays on the machine or server you run it on: the games it imports, the Stockfish and Maia analysis, your notes, repertoires, settings and the password you set. We have no access to that installation and no knowledge of its existence. For that data you are the controller, not us.

Your installation talks to third parties only when you ask it to: Lichess, Chess.com or FICS when you import games from an account there, and an AI assistant of your choice if you connect one over MCP. Each of those providers processes what your installation sends under its own privacy policy, which we do not control. Please read theirs.

3. The iOS app

The app is a client for a Blunderbase server you name. It sends your requests, and the password you enter, to that server and nowhere else, and keeps the server address and a session cookie on the device so you stay signed in. It contains no analytics, advertising or tracking code and no third-party SDKs. The app collects no data within the meaning of Apple's App Privacy disclosure.

If you tap Try the demo, the app connects to the demo described in section 5. Apple may process crash and usage diagnostics according to the sharing settings on your device; that processing is Apple's and is governed by Apple's privacy policy.

4. This website

blunderbase.org, including the manual under /manual/, is a static site delivered through Cloudflare. When you open a page, Cloudflare and our server process the technical data a browser sends with every request: IP address, time, requested URL, referrer and user agent. This is needed to deliver the page and protect the site against abuse (Art. 6(1)(f) GDPR). We set no cookies. Your light/dark theme choice is stored in your browser's local storage and never leaves it.

5. The demo

demo.blunderbase.org is a read-only Blunderbase we operate, filled with anonymised games, so that anyone can look at the software before hosting their own. It has no accounts and no password, and nothing you do there is stored: the library is read-only. The server keeps ordinary access logs (IP address, time, requested URL, user agent) for a short time for security and operations, on the basis of our legitimate interest in running a stable service (Art. 6(1)(f) GDPR), and is delivered through Cloudflare like the website.

6. What we do not do

• No analytics, advertising or tracking on the website, the demo or in any app.
• No accounts, no email addresses, no newsletters.
• No sale or sharing of personal data with anyone.
• No processing of your games, notes or chess accounts: they never reach us.

7. Recipients and international transfers

The only processor we use is Cloudflare, Inc., which delivers the website and the demo and protects them against attacks. Cloudflare may process the request data above outside the EU/EEA, including in the United States; for that it relies on the EU adequacy decision for the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. Contact us for more information on the safeguards.

8. Retention

Access logs of the website and the demo are kept only as long as necessary for security, abuse prevention and troubleshooting, and are then deleted. We hold no other personal data.

9. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interest (Art. 21).

You can exercise these rights by writing to info@blunderbase.org. Since the only data we hold are short-lived access logs, there is usually nothing to hand over or delete. We do not use automated decision-making within the meaning of Art. 22 GDPR.

You also have the right to lodge a complaint with a supervisory authority. The competent authority is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (www.baden-wuerttemberg.datenschutz.de).

10. Security

The website and the demo are served over encrypted connections only. For your own installation, the manual describes how to put it behind TLS and how to back it up; the security of that installation is in your hands.

11. Children

The website, the demo and the app are not directed at children under 16, and we do not knowingly collect data from them.

12. Changes

We may update this policy from time to time. Changes are posted on this page with a new date at the top.

13. Contact

Questions about this policy or your data: info@blunderbase.org.