TengenGoPrivacy notice
Your games, your account, clear choices.
How the hosted service at tengengo.app uses personal data.
Who is responsible
The data controller is Dmitrij Sosnovic, Czech Republic. Contact [email protected] for privacy questions, access, correction, export or deletion requests. You can browse these public pages without an account.
What is stored, and why
| Data | Purpose and basis |
|---|---|
| Account ID, username, password hash, sign-in sessions and optional OGS identity | Provide and secure the account you request, under the service terms (contract). Local passwords are hashed, not stored as readable passwords. |
| Profile and preferences, games, moves, imported records, invitations, reviews, explanations and selected practice evidence | Provide play, study and cross-device features (contract). Do not upload records containing someone else's private information without permission. |
| AI teaching preferences and daily provider-request counts | Provide optional explanations and enforce the service allowance (contract and legitimate interests in availability and cost control). The hosted service uses an operator-funded provider; you do not supply an API key. Earlier saved account-provider settings, if any, are inactive in this hosted mode and remain subject to account deletion. |
| IP address, request paths and timing, status codes, browser/request information, diagnostic events and security records | Operate, troubleshoot and protect the service against misuse (legitimate interests in availability and security). |
| Messages you send to the operator | Answer support or privacy requests (contract, legitimate interests, or applicable legal obligations depending on the request). |
Who can see the data
Games are accessible to their players and to authorised service operators. They are not end-to-end encrypted from the operator. A game shared with another account is visible to that opponent.
- Cloudflare provides the domain's delivery, HTTPS and tunnel/security services. Traffic passes through Cloudflare, which can process IP addresses and request information. See its privacy policy and data-processing addendum.
- Online-Go.com is contacted only when you choose its sign-in. TengenGo receives your OGS identifier and username; it does not receive your OGS password or automatically import your games or rank. The temporary OGS access token is used for the identity lookup and revocation is requested afterwards.
- The operator's configured model provider receives board positions, moves, analysis and relevant teaching preferences when you request an explanation or open a new review that generates optional commentary. The provider's own retention and data-use terms apply. The AI coach settings show the configured provider hostname, model and allowance; contact the operator for the provider identity and processing arrangements before using explanations if you need further information. Ordinary KataGo play and hints do not require a language-model provider.
- The operator's email service processes messages you send for support. Data may also be disclosed where a valid legal obligation requires it.
Cloudflare and a model or email provider may process data outside the EEA. Cloudflare's addendum describes its transfer safeguards, including standard contractual clauses where applicable. The configured model provider's locations and safeguards depend on that provider. Contact the operator for information about the service's processing arrangements. TengenGo does not sell account data or use it for advertising.
Storage on your device
On the HTTPS hosted service, a necessary, first-party sign-in cookie restores your session after a reload or in another tab. It is HttpOnly, Secure and SameSite=Strict, expires no later than seven days after sign-in, and is cleared on successful sign-out. The server checks revocation before restoring a session. The browser keeps the active API bearer token in memory, not in local or session storage. Plain HTTP and native clients do not use this browser cookie. Device and match preferences use local storage. A pending OGS flow uses session storage and is cleared after completion or expiry. You can clear this data through your browser settings. TengenGo includes no advertising or behavioural-analytics scripts. Cloudflare may use security cookies under its own policy.
Retention and deletion
- Account records, games, reviews and settings remain while your account exists, until you request deletion or another stated legal reason requires retention. Account deletion removes its database records and games involving that account; this can also remove the opponent's shared game record.
- Daily provider-attempt counters are retained for up to 31 calendar days and account-linked counters are removed with the account. The aggregate service count remains until expiry to prevent deleted accounts resetting the service allowance.
- Backend daily diagnostic files are cleaned on a 30-day schedule (up to 31 days between daily runs). Nginx access/error logs rotate daily with 14 archived rotations. Traces expire after seven days. The host system journal separately rotates according to its configured storage limits, rather than a guaranteed fixed number of days.
- Encrypted local database backups rotate on a 14-day schedule. Deleted data can remain in a backup until rotation removes that copy. Backups are used for recovery, not ordinary account access. The operator must reapply relevant deletion requests if an old backup is restored.
- Support correspondence is retained until the request is resolved, then only while needed to handle follow-up, security incidents or legal claims. An incident or legal obligation can require specific records to be preserved longer.
To delete your account or request a data copy, email [email protected] with your TengenGo username. Do not send your password or API key. The operator will arrange an appropriate identity check. Game export in SGF is also available in the app.
Practice profiles and your rights
The personal trainer derives practice suggestions from the games you choose to include. These are learning recommendations, not decisions with legal or similarly significant effects.
Depending on the applicable conditions, you can request access, correction, erasure, restriction, portability and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw that consent. Requests are handled within the time limits required by law. You may complain to the Czech Office for Personal Data Protection, or the authority where you live or work. The European Commission's guide explains these rights.
Changes
The effective date above identifies this notice. Material changes in providers, purposes or handling will be reflected here. Contact the operator if you need information about an earlier version.