Privacy policy

Last updated 27 August 2026 · In effect from 27 August 2026

Motify reads the chess games you tell it to read, works out which tactics you missed, and keeps the record of how you did on them. This page says exactly what is stored, who else sees it, and how to delete it. It is written from what the software actually does rather than from a template, so where it names a thing, that thing exists.

The short version. Your account details, the chess accounts you connect, the positions mined from your games, and your attempt history. No advertising or analytics cookie is set until you agree to one, and in the UK and EEA you are asked before anything loads. Payment card details never reach our server. Deleting your account really deletes it, immediately and irreversibly.

Who is responsible for your data

Motify is operated from Australia by the individual who runs motifychess.com. For anything in this policy, including a request to see or delete your data, write to support@motifychess.com. If you would like a postal address for a formal request, ask and it will be provided.

What is stored, and why

Everything below lives in a single database on the server that runs the site. Nothing in this table is sold, and nothing is shared with anyone except the processors named further down.

Email address: Identifies the account, and is how you would reset a password or be contacted about billing. Supplied by you at sign-up, or by Google if you sign in with Google.
Username: How you appear in the app. Chosen by you.
Password: Stored only as a hash. The original is never written down and cannot be recovered from what is stored, by us or by anyone who obtained the database.
Google account id: Only if you use Sign in with Google. It is the stable identifier Google issues for you and it is what lets you sign in again next time. We do not receive your Google password, and we ask Google for nothing beyond your identity and email address.
lichess and Chess.com usernames: The accounts whose games you have asked Motify to read, and a flag recording whether each was proven to be yours.
A lichess access token: Only if you authorise Motify through lichess. It exists so your game exports count against your own rate quota rather than a shared anonymous one. It is stored on the server, never sent to your browser, and deleted with your account. You can revoke it at any time from your lichess security settings, which takes effect immediately and regardless of anything we do.
Positions from your games: The chess positions where the analysis found a tactic you did not play, the moves that answer them, and enough of the game around each to show you where it came from. This is derived from games that are already public on the platform you connected.
Which games have been analysed: So the same game is not analysed twice.
Your attempt history: For each puzzle: whether you solved it, how long it took, how many wrong moves, whether you used a hint or revealed the answer, and which tactical motifs it involved. This is what the dashboard's accuracy figures and the per-motif breakdown are made of.
Which warm-ups you have seen: So the same practice puzzle does not come round again.
Your settings: Difficulty threshold, which time controls to mine, board and sound preferences, and a puzzle rating the software estimates for you so warm-ups are pitched sensibly.
Billing identifiers: If you subscribe, the customer and subscription reference numbers Stripe issues. Card numbers, expiry dates and security codes never reach our server at all: payment details are entered on Stripe's own hosted page.
Where you came from: If you arrived through a tagged link, the campaign tag from it, for example reddit-ads. It is a word naming a channel and contains nothing about you.
Trial records: If you try Motify without an account, a random identifier, which platform you typed a username for, and timestamps for starting and finishing. If you later create an account, the two are linked so the channel figures make sense.
Server logs: The web server keeps ordinary access logs, including IP addresses, for security and for diagnosing faults. They are not used to build any profile of you.

What we do not do

Motify does not sell personal data, does not share it with data brokers, does not use it to train machine learning models offered to anyone else, and does not send marketing email to people who have not asked for it. There is no automated decision-making that produces legal or similarly significant effects about you.

Reading your chess games

This is the part worth being explicit about, because it is the whole product. When you connect a lichess or Chess.com account, Motify downloads your game archives from that platform's public interface and replays each game through a chess engine to find positions where a tactic was available and something else was played. Those positions become your puzzles.

Two limits on this. Motify only reads games that the platform already publishes, the same records anyone visiting your profile can see. And it will only do so for an account you have proven is yours: on lichess by signing in through lichess, and on Chess.com by placing a one-time code on your public profile where we can read it back. Typing somebody else's username is not enough to have their games analysed.

Your use of those platforms remains governed by their own terms and privacy policies, which we do not control.

Who else sees your data

Only the following, and only for the purpose named. They are service providers processing data on our behalf, not parties buying it.

Stripe takes payments and holds the card details we never see. Stripe is the data controller for the payment information you give it directly.
Google, if you use Sign in with Google, confirms who you are. Separately, Google's advertising tag runs on the public pages of this site, but only under the conditions in the next section.
lichess and Chess.com receive requests for the game archives of the account you connected. They see that a request was made; they do not receive anything about your Motify account.
The company hosting the server, which stores the database as part of providing the machine it runs on.

Data may also be disclosed where the law requires it, or to protect the security of the service. If Motify were ever sold or transferred, your data would move with it and you would be told before that happened.

Cookies and similar storage

Motify sets as little as it can get away with.

A session cookie, once you sign in. It is what keeps you signed in. It is marked HttpOnly so scripts cannot read it, restricted to this site, and sent only over HTTPS. This one is strictly necessary and there is no version of a signed-in account that works without it. It is not used for tracking.
Local storage for your preferences, such as the board theme and whether sound is on. It stays in your browser and is never sent to us.
Advertising cookies, only with your consent. Google's advertising tag measures whether an advert led to a sign-up. In the UK and the EEA nothing is loaded and no cookie is set until you choose, the banner offers accept and reject with equal prominence, and refusing means the tag is never loaded at all rather than loaded in a quiet state. Your choice is remembered in your browser under motify.ads.consent, and clearing your browser data will cause you to be asked again.

Email we send you

Two kinds, and they are governed differently.

Email your account needs to send you: a receipt, a notice that a payment failed, a confirmation that something about your account changed. These are part of running the service you asked for and are sent whether or not you want anything else.
Email about Motify itself: what is new, and the occasional position worth looking at. You are asked when you create an account, the box is ticked and you can untick it before the account exists, and you can change your mind at any time from the account page or from the unsubscribe link at the foot of anything we send. We record your answer and the moment you gave it. Accounts created before we started asking are not on this list.

We do not sell, rent or share the list, and your chess is never in it: what we hold for this is your address, the name you chose, and when you agreed.

How long it is kept

Your account data is kept for as long as the account exists. Two details worth knowing:

On the free plan, the record you can see is windowed, to the most recent thirty days of history and the fifty most recent tactics. That is a limit on what the app shows you rather than a deletion, and upgrading makes the rest visible again.
Deleting your account deletes the data, in one transaction, immediately, with no archived copy and no way back. The one exception is the anonymous trial records described above, which are stripped of the link to your account rather than removed, so that a trial which really happened is not silently un-counted. What is left is a random identifier, a platform name and two timestamps, which identifies nobody.

Server access logs and backups age out on their own ordinary schedule, so a deleted account may persist in those for a short period before being overwritten. Stripe keeps payment records for as long as its own legal obligations require, which is outside our control.

Your rights over your data

Wherever you live, you can ask for a copy of what is stored about you, ask for it to be corrected, or ask for it to be deleted, and you can delete the account yourself from the account page without asking anyone. Write to support@motifychess.com and you will get an answer within 30 days.

If you are in the UK or the EEA, the UK GDPR and the GDPR give you the further rights to object to processing, to restrict it, to withdraw consent at any time, and to receive your data in a portable form. Our lawful bases are: performance of a contract, for running the account and the subscription you asked for; consent, for advertising cookies, which you may withdraw by clearing the stored choice, and for email about Motify itself, which you may withdraw from the account page or any unsubscribe link; and legitimate interests, for keeping the service secure and working. You may complain to your national data protection authority, and in the UK to the Information Commissioner's Office.

If you are in Australia, you may complain to the Office of the Australian Information Commissioner if you think your privacy has been mishandled, after raising it with us first.

If you are in California, you may request disclosure or deletion of your personal information and may not be discriminated against for doing so. Motify does not sell or share personal information as those terms are defined there.

Where your data is held

The server is operated from Australia and the database sits on it. If you are outside Australia, using Motify means your data is transferred there. Our processors, in particular Stripe and Google, operate internationally and move data between countries under their own safeguards, including the standard contractual clauses where those apply.

Children

Motify is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has created an account, write to us and it will be removed. Where local law sets a higher age for consenting to online services, that age applies instead.

Security

The site is served only over HTTPS. Passwords are stored hashed. Session cookies are restricted so that scripts cannot read them. Card details never reach the server. No system is perfectly secure, and nothing here is a guarantee against every possible failure, but if a breach affecting your data occurs you will be told, and the relevant regulator notified where the law requires it.

Changes to this policy

If this policy changes, the date at the top changes with it. For a change that materially affects what is collected or who sees it, account holders will be emailed before it takes effect rather than being left to notice.

Questions, or a request about your data: support@motifychess.com.