Privacy
Short version: we don't want your data. We have nothing clever to do with it, and collecting it would just get in the way of writing chess code. The full GDPR-flavoured version follows.
Controller
Arnold Schneeberger
Software Engineer
Email: chess@oxbow.at
Full company-style details are on the Imprint page.
What we process, why, and on what legal basis
Gameplay data over SignalR. ProZero is a Blazor Server app, so a SignalR channel between your browser and our server keeps the board in sync as you play. That channel carries moves, board positions, and engine output — purely the chess game. Nothing personal, no behavioural tracking, no profiling. Legal basis: Art. 6 (1) (b) GDPR (performance of the service you requested by visiting the site). Retention: in memory only, dropped the moment the SignalR circuit closes.
Session ID. ASP.NET Core sets a session cookie needed to route SignalR messages to your circuit. It is strictly technically necessary, contains no personal data, and is gone when you close the tab. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in operating a functioning website) and § 165 (3) TKG (technically necessary, no consent required).
Backend-affinity cookie. The reverse proxy in front of the app sets a small cookie called __Host-pz_aff so your browser keeps reaching the same backend instance during a redeploy — otherwise your in-progress SignalR connection would break mid-game. Its value is an opaque routing identifier generated by the proxy: no personal data, no tracking, never read by anyone else. It is a session cookie and is gone when you close the tab. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a stable connection) and § 165 (3) TKG (technically necessary, no consent required).
Server logs. The web server records the minimum it needs to stay healthy: request paths, response codes, timestamps, and the requesting IP address. Logs are retained for up to 14 days for debugging and abuse defence, then discarded. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in security and operability). No games, no positions, no moves are stored on disk.
Game state in localStorage. So a reload doesn't wipe your game, the current position, full move history, undone moves, and your cursor are saved as JSON in your browser's localStorage under the key proZero.game. It stays on your device — never sent to the server, never sent to anyone — and it contains chess data only (no name, no IP, no identifier). Legal basis: Art. 6 (1) (b) GDPR (performing the service of a resumable game). Retention: until you clear your browser storage, or start a new game in a way that overwrites it.
What we don't do
No analytics. No telemetry. No third-party trackers. No profiling. No advertising. No cookies beyond the two technically required ones described above, and the only browser storage we use (the localStorage key above) holds chess moves — never an identifier, never a token. No CDN: all CSS, JS, fonts, and icons are served from our own server, so no third party sees your IP just for loading the page.
Recipients and transfers
Data is processed solely on infrastructure operated for this site within the EU. We do not share, sell, or transfer your data to third parties. There are no transfers to countries outside the EU/EEA.
Your rights
Under the GDPR you may request access to the data we hold about you (Art. 15), have it rectified (Art. 16) or erased (Art. 17), restrict its processing (Art. 18), receive it in a portable form (Art. 20), and object to processing based on legitimate interest (Art. 21). Where processing is based on consent (it isn't here), you may withdraw consent at any time. To exercise any of these rights, write to chess@oxbow.at.
You also have the right to lodge a complaint with a supervisory authority — in Austria, the Datenschutzbehörde at dsb.gv.at.
No automated decision-making
The ProZero engine decides chess moves; that's not a decision about you in the sense of Art. 22 GDPR. We do not carry out automated decision-making with legal or similarly significant effect on you.