Move Forge Privacy Policy

Data controller and contact

The controller of personal data processed in connection with Move Forge is TOMASZ CZOPUR, conducting business activity, Polish tax number NIP 8741749149, REGON 524257325, address: Franciszka Rakoczego 23/266, 80-288 Gdańsk, Poland. Privacy contact: support@moveforge.pl.

Categories and sources of data

The scope depends on the features used. Move Forge may process information provided directly by a user, information created while using the application, and public chess information retrieved from external services.

• Account: nickname, email address, optional city, cryptographic password hash, account identifiers, preferences, PRO status and period, the Terms version and acceptance timestamp, and information required for authentication and session security.
• Google or Facebook sign-in: provider name, the provider permanent account identifier, email address and Google email-verification status. Move Forge does not store first or last names from social sign-in. See “Google and Facebook sign-in” below.
• Application use: saved repertoires and variations, training tasks, settings, activity required to perform a requested feature, messages, comments, and support reports.
• Payments: order and transaction identifiers, payment status, amount, product and date, and billing details. Move Forge does not store the full payment-card number or CVV.
• Technical and security information: IP address or derived information required to protect the service, timestamps, request and error information, abuse signals, and device or browser information where needed for diagnostics and security.
• Game history: when a nickname is supplied or an account is connected, the application may retrieve public game and profile information from Chess.com or Lichess.org, including opponent nicknames and game records.

Purposes and legal bases

Personal data is processed only for specified purposes and on the appropriate legal basis. Consent is not used as an artificial basis for data necessary to perform a contract.

• Account creation and operation, sign-in, training, game review, saved user data, PRO and purchased content: Article 6(1)(b) GDPR — performance of a contract or steps requested before entering into it.
• Accounting, invoices, KSeF, and tax obligations: Article 6(1)(c) GDPR — compliance with a legal obligation.
• Security, abuse prevention, diagnostics, attack protection, moderation records, and establishment, exercise or defence of legal claims: Article 6(1)(f) GDPR — legitimate interests of the controller.
• Questions, complaints, withdrawals and other requests: Article 6(1)(b) or (c) GDPR where applicable, otherwise Article 6(1)(f) GDPR.
• Analytics and advertising technologies that are not strictly necessary for a service explicitly requested by the user: after obtaining any consent required under Article 6(1)(a) GDPR and applicable Polish electronic-communications rules.

Payments, Autopay and invoices

Online payments are handled by Autopay S.A. Move Forge receives information required to identify and settle a transaction but does not receive or store complete payment-card data. Where an invoice is issued, buyer data required by law is processed. Accounting and transaction records are retained for the period required by applicable tax, accounting and payment rules.

Chess.com, Lichess.org and other sources

When a user requests an import or analysis of public game history, some data may originate from Chess.com and Lichess.org. This may include public nicknames, game records, results, time controls and other information made public by those services. The information is used to perform the requested analysis, report and training. Games may contain information relating to other players. Move Forge does not retrieve private messages or private account information from those services.

Google and Facebook sign-in

Google and Facebook are optional methods for creating an account or signing in. After a provider is selected, the user is redirected to that provider, which authenticates the user under its own terms and privacy policy. Registration and sign-in with email and password remain available.

• Google: Move Forge requests only the openid and email scopes. It receives the permanent Google identifier (sub), email and email_verified and stores the provider identifier and email; it does not request the profile scope.
• Facebook: Move Forge uses only the data needed for authentication and requests the email address; the user-info request reads only id and email. Move Forge stores the provider identifier and email and does not store first or last names from Facebook. An email address is required to create a Move Forge account this way.
• The database stores the provider, its permanent user identifier, the provider email, link creation date, last sign-in date, and a reference to the Move Forge account. These data are used only for authentication, account protection, and the requested sign-in; they are not sold or used for advertising.
• A Google or Facebook access token is used transiently to retrieve the profile during the OAuth callback. Move Forge does not persist provider tokens in its database and removes them from the active OAuth client memory after processing the sign-in.
• Where a Move Forge account already exists with exactly the same email, a Google identity may be linked automatically only if Google confirms the email is verified. Facebook is not linked automatically to an existing account with the same email; the existing password must be used instead. Provider sign-in does not bypass an account suspension or disabled status.
• Google Ireland Limited generally supplies Google services to EEA users, while Meta Platforms Ireland Limited supplies Facebook services in the European Region. Providers also process data as separate controllers under their own documents.

Cloudflare Turnstile and form protection

Move Forge may use Cloudflare Turnstile during registration to distinguish a person from automated abuse. The browser then connects to challenges.cloudflare.com, and the backend sends a one-time token and the IP address, where available, for verification. Move Forge relies on Article 6(1)(f) GDPR — service security and prevention of automated registrations.

• Turnstile may use necessary device and browser mechanisms. If Cloudflare pre-clearance or a WAF challenge is enabled, a necessary cf_clearance cookie may be set; its lifetime depends on the Cloudflare security configuration.
• The Turnstile token is short-lived and single-use. Move Forge does not use Turnstile data for advertising or marketing profiling.
• Cloudflare may process data in infrastructure outside the EEA under its privacy policy and applicable transfer mechanisms.

Recipients and transfers outside the EEA

Data is disclosed only to recipients required to operate the service or comply with the law, including hosting and infrastructure providers, Autopay S.A., email or communications providers, accounting providers, KSeF, Google Ireland Limited or the applicable Google entity for Google sign-in, Meta Platforms Ireland Limited or the applicable Meta entity for Facebook sign-in, Cloudflare for Turnstile and traffic protection, analytics or advertising providers activated after the required consent, and authorized public bodies. A transfer outside the European Economic Area relies on a Chapter V GDPR mechanism such as an adequacy decision — including the EU–US Data Privacy Framework for a participating entity — or Standard Contractual Clauses, as applicable to that provider.

Retention periods

Data is retained no longer than required for the purpose for which it was collected, subject to legal obligations and limitation periods.

• Account data and user content — for the lifetime of the account and afterwards only for the period needed to settle the contract, comply with legal duties, ensure security or protect legal claims; unnecessary data is deleted or anonymized.
• Google or Facebook identity link — for the lifetime of the account or until a verified request removes it. The MF_OAUTH_STATE cookie and matching server-side state expire after the callback or within five minutes; the one-time sign-in ticket normally expires within 120 seconds.
• Ordinary application logs — generally 30 days; unexpected-exception logs — generally 90 days, unless an incident requires evidence to be preserved longer.
• Moderation and account-ban decision records — for the period required for appeals, security and claims; the current operational policy allows retention for up to seven years where there is a continuing legal basis.
• Accounting and transaction information — for the period required by tax, accounting and payment law.
• Consent-based data — until consent is withdrawn or the data becomes unnecessary earlier, without affecting the lawfulness of processing before withdrawal.

Your rights

Depending on the legal basis and circumstances, a user may request access and a copy of personal data, rectification, erasure, restriction, and portability, and may object to processing based on legitimate interests. Consent can be withdrawn at any time where consent is the basis, without affecting earlier lawful processing. Requests may be sent to support@moveforge.pl. Users also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).

Required and optional data

Information marked as required for registration, payment, or a specific requested feature is necessary to enter into or perform the relevant contract. Failure to provide it may prevent account creation, payment, or that feature from operating. City is optional; if provided, it is part of the profile visible to other signed-in users. Optional information may be omitted without losing unrelated functionality.

Cookies, localStorage and similar technologies

Move Forge uses technologies required to operate the service, including session, security, language and requested-feature settings. Storing or accessing device information for a purpose that is not necessary to transmit a communication or provide a service explicitly requested by the user takes place only after the required consent. Selecting Google or Facebook is not marketing consent; it starts only the requested authentication flow.

• MF_OAUTH_STATE: a necessary random identifier protecting the Google/Facebook flow; it contains no user profile, is HttpOnly, SameSite=Lax, Secure over HTTPS, applies to /, and is removed after the callback or expires within five minutes.
• Session localStorage: a JWT and basic current-account data keep the user signed in until sign-out, site-data removal, or session expiry, currently no more than 30 days. Language, theme, engine preferences, favourites, and selected analysis-resume data may also be stored; sessionStorage holds temporary imports, positions, and training queues until the tab closes or they are consumed.
• Cloudflare: Turnstile and security controls may use necessary mechanisms, including cf_clearance only where pre-clearance or WAF configuration requires it.
• Analytics: Google Analytics 4 may be activated only after the required consent for optional technologies. Message content, FEN, PGN, moves, nicknames, tokens and login data should not be sent to Google.
• Advertising: Google AdSense or other advertising technologies may be activated only in accordance with the user choice and applicable consent requirements.
• Privacy controls allow optional categories to be rejected and the choice to be changed later. Withdrawing consent must be as easy as giving it and must not disable features that do not rely on optional technologies.
• The analytics choice is stored in localStorage under move_forge.analytics_consent.v2 to remember your decision, not to profile you. Change it in cookie preferences or delete site data. A legacy v1 grant is not treated as consent to the new configuration; an earlier refusal is respected.

Google AdSense and advertising

AdSense serving is disabled while Move Forge is being prepared and reviewed. The verification meta tag and ads.txt do not display ads. The following also describes processing if serving is subsequently enabled. Ads may then appear only in manually approved placements alongside complete News articles, away from boards, exercises, forms and private tools.

• Third-party vendors, including Google, may use advertising cookies and similar technologies to serve ads based on previous visits to this website or other websites. Google advertising cookies allow Google and its partners to serve personalized ads based on those visits.
• When an ad is enabled, providers may receive an IP address, browser and device information, browser advertising identifiers, the public article URL, consent choices and ad interactions. Move Forge does not send email addresses, account IDs, linked nicknames, private report contents or payment details as ad parameters. Google Ireland Limited generally provides Google services to EEA users; Google and other providers also process data under their own policies.
• In this configuration, serving requires an appropriate choice in a separate Google-certified advertising consent management platform (CMP), supporting the current TCF. Analytics consent, Terms acceptance and signing in do not grant advertising consent. Without the required choice, if advertising is rejected, or if the CMP is unavailable, we do not send ad requests. Access to the article is unaffected.
• Personalization requires additional consent for its purposes. Non-personalized ads may still use cookies, for example for measurement and abuse prevention; we do not assume they are exempt from consent requirements. Purposes, legal bases (consent or legitimate interest where permitted), and vendors can be inspected and changed in the CMP.
• You can change or withdraw advertising consent using “Change advertising consent” in privacy settings or on this page. Refusal or withdrawal does not remove account progress. Withdrawal does not affect the lawfulness of earlier processing. The page may reload after a change to stop an advertising script that was already running.
• You can also opt out of Google ad personalization in Google Ads Settings (linked below). These settings do not replace your cookie choices on Move Forge. If other ad vendors or networks are enabled, the CMP lists the current providers, links to their websites and policies, and available choices. The Digital Advertising Alliance tool linked below also offers opt-out choices for some third-party providers.
• Advertising data retention and identifier lifetimes depend on the provider and accepted purposes; details are available in the CMP and the linked provider policies. Google information about data use on partner websites, available settings and transfers is linked below. Move Forge does not use advertising data to award ratings or badges or decide access to accounts.

Deleting Google or Facebook sign-in data

To remove a Google or Facebook link or close a Move Forge account, email support@moveforge.pl from the address assigned to the account and identify the provider and scope of the request. After identity verification, Move Forge deletes the provider identifier, provider email and link history unless a specific item must remain for a legal obligation, security, or legal claims.

• Removing a link in Move Forge does not delete a Google or Facebook account. Revoking access in Google or Facebook settings does not automatically delete the Move Forge account.
• If social sign-in is the only working access method, set a password first through password recovery for the account email; otherwise access to the account may be lost.
• Deleting the whole Move Forge account also removes the social-identity record. Billing, moderation, or evidentiary data may remain only for the period described in this Policy.

Automated decisions and profiling

Move Forge may use automated security mechanisms such as request-rate limits. As of this Policy version, a permanent account ban is not imposed solely through automated decision-making. If solely automated decisions producing legal or similarly significant effects are introduced later, this Policy will be updated before that processing begins.

Withdrawal statements

We process the name, email, contract identification and statement entered in the withdrawal form, its reference and receipt time to exercise consumer rights and acknowledge receipt (Article 6(1)(c) GDPR in conjunction with consumer-rights law). Contract settlement also relies on Article 6(1)(b); necessary evidence for legal claims on Article 6(1)(f). No marketing consent or password is required. Case records are retained during handling and settlement, then only to the extent needed for a legal obligation or legal claims under the retention principles above.

Policy changes and contact

The Policy may be updated when features, providers or law change. The current version is published here with its effective date. For privacy rights and account matters, contact support@moveforge.pl or use the support-case panel after signing in.