Privacy Policy

Last updated 24 July 2026

Latest change: added the "Guest mode" section — you can now use OpenBook without an account — and clarified what we hold about sign-ins and page-view counting.

OpenBook is a chess opening trainer. This page explains what we collect, what we don't, and what we do with it. We've tried to keep it plain.

What we collect

Your Lichess username, returned by Lichess when you sign in.
A Lichess access token, used by our server to call the Lichess Opening Explorer on your behalf. Stored in our database.
Your repertoire — the positions, moves, and notes you save.
Your practice progress (spaced-repetition state).
Your practice pacing settings — how many new lines per day you've chosen, and how many you've done today.
If you turn on daily reminders: a push subscription for that device (an address supplied by your browser's push service, plus encryption keys), your time zone, and the date we last sent you one. We keep this only while reminders are on.
Your rating band preference.
The date you last signed in, and a lifetime count of practice reviews — used to understand whether the app is being used, not what you browse.
A session cookie (opaque ID, 30-day expiry) so you stay logged in.

What we don't collect

Email address. We don't request it from Lichess.
Your real name.
Payment information. The app is free.
Advertising IDs or cross-site tracking cookies. Page views are counted with Vercel's cookieless analytics, which can't identify individual visitors.

We do collect error traces via Sentry when something in the app breaks — see "Third parties" below.

Guest mode

If you use OpenBook without signing in, your repertoire and practice progress are stored in your browser only (localStorage) — nothing you build is sent to or kept on our servers. Requests to the opening database are rate-limited by IP address; those IP counters are kept for about 48 hours and then reduced to anonymous daily totals. Guest data stays in your browser until you clear it, sign in and merge it into an account, or your browser evicts it — export a backup from the menu if you're keeping serious work there.

Cookies

session — opaque ID, HttpOnly, Secure, SameSite=Lax, 30-day expiry. Lets you stay signed in.
lichess_oauth — short-lived (10 minutes), used only during the sign-in flow.

Third parties

Lichess — OAuth identity provider and opening-data source. The login grant includes read-only access to your Lichess studies, used solely by the study import feature to list and fetch studies you choose; OpenBook never modifies anything on your Lichess account. Their privacy policy applies to the Lichess side.
Neon — Postgres database host (US region). Your repertoire and progress live here.
Vercel — application host. Standard server access logs may apply.
Sentry — error tracking. We use this to diagnose crashes. Sentry's privacy policy.
Push services — if you enable reminders, delivery goes through the push service your browser uses (Apple, Google, or Mozilla, depending on your device). They handle the delivery; the notification content is encrypted so only your device can read it.

Your rights

Export all your data anytime: menu → Export → JSON (a complete backup, including practice progress). A PGN export of your opening lines is also available there for use in other apps.
Delete your account anytime: menu → Delete account. This permanently removes your repertoire, practice state, and any other data tied to your account.
Turn off reminders anytime: menu → Reminders. This deletes the push subscription for that device.
Questions: email feedback@openbookchess.com.

Children

OpenBook isn't directed at users under 13.

Changes

If we change anything material, we'll update the date at the top of this page.