Note
This English translation is provided for convenience. Only the German version is legally binding.
1. Controller
The controller for the processing of personal data in the Mattly app and on the website https://mattlyapp.com is Omid Efazat, Gartenfelder Str. 52, 13599 Berlin, Germany, email: support@mattlyapp.com. We have not appointed a data protection officer because we are not required to. For all privacy matters write to us at support@mattlyapp.com.
2. The essentials
We use no advertising, no tracking, no analytics tools, no advertising IDs and no third party cookies. We do not sell data. Engine, review and coach run on your device or in your browser. Our server is located in a data centre in Frankfurt am Main, Germany. We only use service providers where a feature needs them; each is named below.
3. Legal bases
We only process data on one of these GDPR bases: to perform the contract with you and for steps prior to entering into it (Art. 6 (1) (b)), to comply with legal obligations, for example under tax and commercial law (c), on the basis of legitimate interests (f) or with your consent (a), which you can withdraw at any time for the future. Each purpose below states its basis.
4. Visiting the website and website hosting
The website is delivered via Cloudflare Pages, with the content delivery network and DNS service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare). When you visit, Cloudflare processes technically necessary access data: IP address, date and time, requested address, referrer, browser and operating system. The purpose is secure, fast delivery and protection against attacks. The basis is our legitimate interest in a secure and stable service (Art. 6 (1) (f) GDPR). Cloudflare processes the data as our processor and keeps log data only briefly. Cloudflare is certified under the EU US Data Privacy Framework; standard contractual clauses apply in addition.
Fonts are served from our own server. There is no connection to Google Fonts or other font providers. We only load external scripts when you click "Sign in with Apple" on the website (see section 7).
5. Cookies and local storage
We only set cookies and storage entries that are strictly necessary for the features you use (§ 25 (2) no. 2 TDDDG). That is why there is no cookie banner.
Cookie "kn_rt": keeps you signed in on the website (httpOnly, only for signing in at api.mattlyapp.com, 60 days, deleted when you sign out).
Cookie "mt_ref": only when you open an invitation link; remembers the invitation code for your sign up (30 days).
Your browser's local storage: settings, designs, puzzle progress, local games, reviews, notes, bot clones, a sign in hint and, if you connect Lichess, your Lichess access token. Also a random device ID ("mt.device") that we receive when you sign in, to prevent abuse of invitation rewards. Otherwise this data stays in your browser and can be deleted in the browser settings.
Further processing is based on the contract (Art. 6 (1) (b) GDPR) and, for the device ID, on our legitimate interest in fair rewards (f).
6. What stays on your device
App and website store games against bots, reviews, game notes, bot clones and settings locally. Engine, review and coach compute on your device. In the app a Lichess access token is stored securely in your device's keychain. We do not receive this data.
7. Account and sign in
Without an account we process no account data on our server. For an account you sign in:
With Apple: Apple gives us a user identifier and, if you agree, your name and email address (on request an anonymous relay address from Apple). On the website your browser loads a script from Apple (appleid.cdn-apple.com) after your click; Apple receives your IP address. The provider is Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA, or for users in the EU Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple Inc. is certified under the EU US Data Privacy Framework.
With email: we store your email address and send you a six digit code valid for 10 minutes.
For your account we store: user identifier, email address, username, display name, profile photo, country, bio, social links, birth year, language, time zone, settings (for example voice chat, message requests, read receipts, notifications), ratings, games, statistics, achievements, friends, blocks, clubs, leagues, Kronen, designs, Plus status, sign in tokens and the creation date. To prevent abuse we also store the device ID (section 5 or 12) and a keyed hash (created with a secret key) of the IP address of your first and your last sign in, not the IP address itself.
The purpose is to provide your account and the online features (Art. 6 (1) (b) GDPR); abuse prevention is based on our legitimate interest in security and fair rewards (f). We only use your birth year for age limits (voice chat and messages with strangers from 16, vouchers from 18); it is not public. We keep the data until you delete your account.
8. Server and hosting of the online features
Our server (API at api.mattlyapp.com, database, voice relay and file storage) runs on Oracle Cloud Infrastructure in a data centre in Frankfurt am Main. The provider is Oracle Corporation or its European companies; Oracle processes the data as our processor. Where Oracle exceptionally accesses data from third countries, for example in support, the EU US Data Privacy Framework certification or standard contractual clauses apply.
Every request to the server creates logs with IP address, time, request, status code and device type or browser. They serve security, troubleshooting and abuse prevention (Art. 6 (1) (f) GDPR) and are deleted automatically after 14 days. We back up the database every night; backups are kept for 14 days on the server and in storage at Oracle in Frankfurt. Deleted data therefore disappears at the latest when the backups expire.
9. Profile and public data
Publicly visible, also on the website at mattlyapp.com/@username and to people without an account, are: username, display name, profile photo, country, bio, social links, ratings, statistics, achievements, Plus badge and profile frame, your recent games and your places in leagues, leaderboards and clubs. Others can find you by username. Your online status and "last seen" are visible to your friends.
A profile photo is cropped on your device or in your browser; our server resizes it to 512 pixels and removes embedded metadata such as location (EXIF). We store social links as usernames only; a click opens the page of the respective network.
The basis is the contract (Art. 6 (1) (b) GDPR), because public profiles are part of Mattly. You decide what you put in your bio and links.
10. Online games, leagues, Mattly TV and sharing
For online games we process user account, moves, clock times, result, rating and game mode. Finished games can be replayed publicly via a link, also with a preview image. Others can watch ongoing rated live games on Mattly TV. For Daily games we also store deadlines and challenges. The basis is the contract (Art. 6 (1) (b) GDPR).
We keep games as long as your account exists. If you delete your account, your games remain for your opponents but without reference to you ("deleted player").
11. Fair play review
After every rated game our server analyses both sides with the chess engine Stockfish and stores metrics such as average centipawn loss and agreement with the best engine move. Over the last 15 games an algorithm detects values that are implausible for your rating and flags the account for review; reports of cheating are taken into account. A human always decides on a ban; there is no solely automated decision within the meaning of Art. 22 GDPR. The basis is our and our users' legitimate interest in fair games (Art. 6 (1) (f) GDPR). We keep the data as long as your account exists.
12. App Attest
The app uses Apple's App Attest service to check that rated games and shop redemptions come from an unmodified Mattly app on a genuine Apple device. Your device creates a key that Apple attests; we store the key identifier and the public key. The key identifier also serves as the device ID for preventing abuse of invitation rewards. The basis is our legitimate interest in fair play and fraud prevention (Art. 6 (1) (f) GDPR).
13. Chat, direct messages, voice chat and voice messages
In game text chat: we store messages for 30 days so they can be delivered and reports can be reviewed, then we delete them.
Direct messages: we store messages, read status and message requests until one of the two accounts is deleted. You can turn off read receipts. Messages pass a word filter; we keep the unfiltered original text of filtered messages for 30 days to review reports.
Voice chat: you decide whether to turn it on and with whom (nobody, friends only or everyone). We only use the microphone when you start voice chat or a voice message. Voice is transmitted encrypted (WebRTC with DTLS SRTP) directly between the devices or, if no direct connection is possible, relayed through our relay server. We process IP addresses to establish the connection. Conversations are not recorded.
Captions and translation (Plus): in the app your iPhone recognises speech exclusively on the device and also translates on the device. On the website you use your browser's speech recognition and, where available, its translation; depending on the browser, the browser vendor may process audio or text on its servers. The recognised text goes to your opponent through our server and is not stored.
Voice messages (Plus): we store the audio file and delete it automatically after 7 days. Recordings from browsers are converted into a format iPhones can play.
The basis is the contract (Art. 6 (1) (b) GDPR); reviewing reports is based on our legitimate interest in a safe community (f).
14. Friends, clubs and activity
We process friendships, requests, blocks, club memberships and an activity feed for your friends (for example games won, promotions, achievements, new bot clones). We delete feed entries after 60 days. You can also add friends with a QR code containing your profile address. The basis is the contract (Art. 6 (1) (b) GDPR).
15. Importing games and bot clones
If you enter a Chess.com or Lichess username, your device or browser fetches the public games directly from Chess.com (Chess.com, LLC, USA) or from lichess.org (run by the non profit association Lichess, France). The respective service receives your IP address and the username. We do not receive this data. Your device computes the bot clone and stores it locally. If you share a new clone with friends, we store platform, username, name and rating of the clone in the feed. Please only use usernames of public profiles. The basis is the contract (Art. 6 (1) (b) GDPR) and, for processing public games of third parties, our legitimate interest in the clone feature (f).
16. Lichess pool
If you connect your Lichess account, you sign in directly at lichess.org. The access token only allows playing, stays on your device or in your browser and is not sent to us. Games in the Lichess pool run directly between your device and Lichess; the Lichess privacy notices apply. When you disconnect, we revoke the token at Lichess.
17. Roast mode
Your device or browser creates the roast text from the game. It is read aloud with a voice of your device or browser; some browsers use online voices of their vendor for this. In the app, when the service is active, the text may be sent for a natural voice to our server and from there to a speech synthesis provider, currently OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117 to 126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, as our processor. Only the text, the language and the chosen voice are transmitted, no account data. We cache the generated audio so that a replay costs nothing. For the daily limit we count per account how many roasts with voice you play per day. Where OpenAI processes data in the USA, standard contractual clauses apply. The basis is the contract (Art. 6 (1) (b) GDPR).
If you share a roast card, we store title, two lines, level, language and, where applicable, the game; the card is visible with username, display name and profile photo to everyone with the link until you delete your account.
18. Push notifications
If you allow notifications, we store the device token from Apple, platform, language, time zone, app version and your settings for each type (for example your move in Daily games, challenges, messages, streak, league, Kronen, news) and quiet hours. They are delivered through Apple's Push Notification service. We use a log of sent notifications for quiet hours and limits and delete it after 30 days. Daily training reminders and reminders before an App Store trial ends are local notifications on your device. The basis is your consent via the iOS notification permission (Art. 6 (1) (a) GDPR); you can turn off each type in the settings and withdraw the permission in iOS at any time. Notifications about Mattly news (new features, at most one per week) are off at first; you only get them if you turn them on yourself in the settings under Notifications (consent, Art. 6 (1) (a) GDPR), and you can turn them off there again at any time. When you sign out we delete the token.
19. Emails
We send sign in codes, for website purchases the contract confirmation and the reminder before the trial ends, and confirmations of receipt for cancellations, withdrawals and contact form messages via Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) as our processor. Brevo processes the email address, content and delivery data. The basis is the contract (Art. 6 (1) (b) GDPR). We do not send advertising emails.
20. Feedback and enquiries
When you send feedback we store stars, category, text, optionally a screenshot or attachment, app version, platform, device, operating system, language and, if you are signed in, your account, and forward it to our inbox. Please make sure a screenshot shows no data of others.
With the contact form you send us your name, email address, topic and message. We store them with the time and a keyed hash (created with a secret key) of your IP address (abuse prevention) in our database, forward them to our inbox and send you an automatic confirmation of receipt (at most three per address and day, without the text of your message).
Emails to us, forwarded enquiries and feedback are kept in our mailbox at our email provider Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland (iCloud+ with custom domain), which stores them as our processor.
We process enquiries by email or contact form to answer them. The basis is our legitimate interest in improving Mattly and in answering enquiries (Art. 6 (1) (f) GDPR) or the contract (b). We delete feedback linked to your account together with your account. We delete contact form messages from our database after 6 months and emails in the mailbox once the enquiry is settled and no retention obligation applies.
21. Reports and moderation
If you report someone, we store the reason, description, affected game and messages and your account. Reported persons do not learn who reported them unless the law requires otherwise. We document measures and statements of reasons. The basis is our legitimate interest in a safe community (Art. 6 (1) (f) GDPR) and our obligations under the Digital Services Act (c).
22. Kronen, shop, invitations and vouchers
We store your Kronen history, daily goals, streaks, shop purchases and redemptions. For invitations we store your invitation code, clicks on the link, who invited whom, the status and the rewards and, to prevent fraud, the device ID and IP hash (section 7). We review conspicuous rewards by hand.
For a voucher we check age (birth year), country, account age and fair play status. After approval we transmit display name, email address and voucher type to Tremendous, Inc., New York, USA, which delivers the voucher by email. Standard contractual clauses apply to the transfer to the USA. We keep delivered vouchers with recipient data even after account deletion for as long as commercial and tax law require.
The basis is the contract (Art. 6 (1) (b) GDPR); fraud prevention is based on our legitimate interest (f), retention on legal obligations (c).
23. Purchases in the app through Apple
Apple processes purchases in the app; we do not receive payment data. The app sends us the purchase receipts signed by Apple; Apple also informs us about renewals, cancellations and refunds. We store product, transaction identifiers, purchase and expiry dates and refund status to unlock Plus. We delete notifications from Apple after 90 days. The basis is the contract (Art. 6 (1) (b) GDPR). Apple's privacy notices apply to processing by Apple.
24. Purchases on the website through Stripe
If you buy Plus on the website, we redirect you to the checkout page of Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (Stripe). Stripe processes name, email address, billing address, payment data and device and connection data to process the payment, create invoices and prevent fraud. We never see card details. From Stripe we receive a customer identifier, subscription status, payments, invoices and the billing address. Stripe may also process data in the USA (Stripe, Inc. is certified under the EU US Data Privacy Framework; standard contractual clauses apply in addition). Stripe is itself responsible for its own purposes such as fraud prevention and legal obligations, more at stripe.com/privacy.
The basis is the contract (Art. 6 (1) (b) GDPR); we keep invoices and accounting records because of legal obligations (c, § 147 AO, § 257 HGB), usually for 8 to 10 years. After the purchase we send you a contract confirmation with the terms and the withdrawal policy by email; for this and as proof we store the order number, plan, price, time and your declaration on the checkout page. If you declare a withdrawal or cancellation on the website or in the settings, we process the details and send you a confirmation by email. If a yearly subscription ends after its first period before the end of the paid time, we initiate the pro rata refund through Stripe.
25. Recipients and transfers to third countries
Only the service providers named above receive your data, as far as needed for the respective feature, and other users, as far as content is public or addressed to them. Authorities only receive data if we are legally obliged. Transfers to the USA only go to recipients certified under the EU US Data Privacy Framework (Art. 45 GDPR) or are based on standard contractual clauses of the EU Commission (Art. 46 (2) (c) GDPR). You access Chess.com and Lichess directly yourself.
26. Retention at a glance
Account data, games, profile, Kronen and direct messages: until you delete your account (games anonymised afterwards). In game chat: 30 days. Unfiltered original texts of direct messages: 30 days. Voice messages: 7 days. Activity feed: 60 days. Log of sent notifications: 30 days. Server logs: 14 days. Contact form messages: 6 months in the database. Notifications from Apple: 90 days. Sign in codes: until they expire after 10 minutes. Database backups: 14 days. Invoices, accounting records and delivered vouchers: until the end of the statutory retention period. Local data: until you delete it on your device or in your browser.
27. Deleting your account
You can delete your account yourself at any time in the app or on the website under Settings, "Delete account". We then immediately delete your account data, profile photo, friends, messages, voice messages, feedback, Kronen and settings; running games are forfeited and your games anonymised. Excluded is data we must retain (sections 24 and 22). We end a website subscription automatically and immediately (terms § 15 (2)); please cancel an App Store subscription yourself in your Apple Account.
28. Children and teenagers
People aged 16 and over may create an account themselves, aged 13 to 15 only with the consent of their legal guardians; under 13 only the features without an account are available. Where processing is based on consent, people under 16 need the consent of their legal guardians (Art. 8 GDPR). Voice chat and message requests with strangers are only possible from 16, vouchers from 18. If we learn that an account was created without the required consent, we delete it. Legal guardians can reach us at support@mattlyapp.com.
29. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7 (3)). Write to us at support@mattlyapp.com. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77), for example where you live or with the authority responsible for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany.
30. Right to object under Art. 21 GDPR
Where we process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. The objection needs no particular form, ideally email support@mattlyapp.com.
31. Obligation to provide data and security
You are not obliged to give us data. Without an account, however, you cannot use online features, and without a birth year no features with age limits. All connections to website and server are TLS encrypted. We protect the data with technical and organisational measures under Art. 32 GDPR.
32. Changes
We adapt this privacy policy when features or legal requirements change. The version published here applies.
Last updated: 21 October 2026