Privacy Policy
Last updated: March 13, 2026
This Privacy Policy describes how Chessiic collects, uses, and protects your personal information. By using Chessiic, you agree to the practices described here and in our Terms of Service.
1. Information We Collect
Information you provide
- Email address and password (at registration)
- Display name
- Avatar image
- Chess.com and/or Lichess username
Information from third-party services
- Google OAuth: If you sign in with Google, we receive your email address and name. We do not access any other Google account data.
- Chess.com / Lichess: We import your publicly available chess game data via their public APIs. This data is already public.
- Stripe: When you subscribe, Stripe processes your payment. Chessiic never receives, stores, or has access to your credit card number. We receive your Stripe customer ID and subscription status.
Information generated by your use
- Puzzle completion data (scores, times, accuracy)
- Leaderboard scores
- Analysis results (blunders, openings, accuracy)
- Drill and study progress
Technical information
Standard server logs may include IP addresses, browser type, and timestamps (via Vercel hosting). We do not use analytics or advertising trackers.
2. How We Use Your Information
| Data | Purpose |
|---|---|
| Email, password | Account creation, authentication, service communications |
| Display name, avatar | Personalization, leaderboard display |
| Chess.com/Lichess username | Importing your public game data |
| Game data, analysis results | Core product features (blunder review, opening lab, etc.) |
| Puzzle scores | Daily tactics, leaderboard rankings |
| Subscription status | Managing your access to Pro features |
| Server logs | Security, debugging, abuse prevention |
We do not sell your personal information. We do not use your data for advertising. We do not share your data with data brokers.
3. Data Sharing
We share data only with the service providers necessary to operate Chessiic:
| Service | Data shared | Purpose |
|---|---|---|
| Supabase | Email, game data, puzzles, avatars | Database, authentication, file storage |
| Stripe | Email, subscription plan | Payment processing |
| Email (received from Google) | OAuth authentication | |
| Vercel | Server logs | Application hosting |
| Chess.com / Lichess | Username (sent to their API) | Game data import |
We may disclose information if required by law, subpoena, or court order. In the event of a merger or acquisition, your data may be transferred with prior notification.
4. Data Storage and Security
- Data is stored in Supabase (hosted on AWS infrastructure in the United States).
- Passwords are hashed and never stored in plaintext.
- Row-level security ensures users can only access their own data.
- Payment data is handled entirely by Stripe (PCI DSS compliant).
- All data transmission uses HTTPS encryption.
5. Data Retention
- Account and game data is retained as long as your account is active.
- After account deletion, personal data is deleted within 30 days.
- Server logs are retained for 90 days.
- Stripe retains payment records per their own policies and legal requirements.
6. Your Rights
All users
- Access your data (viewable in-app or by contacting us for a full export)
- Request correction of inaccurate data
- Request account and data deletion
- Cancel your subscription at any time
EU/EEA residents (GDPR)
You additionally have the right to:
- Receive your data in a machine-readable format (data portability)
- Restrict or object to processing
- Withdraw consent where consent is the legal basis
- Lodge a complaint with your local data protection authority
Our legal basis for processing is contractual necessity (providing the service you signed up for) and legitimate interest (security, abuse prevention).
California residents
- Right to know what personal information is collected and how it is used
- Right to request deletion of personal information
- Right to opt out of the sale of personal information (we do not sell your data)
- Right to non-discrimination for exercising your rights
7. Cookies and Local Storage
Chessiic does not set tracking cookies. Authentication sessions are managed through secure browser cookies. Board preferences (theme, piece set) are stored in localStorage. Stripe may set cookies during the checkout process, governed by Stripe's privacy policy.
8. International Data Transfers
Chessiic is based in the United States. If you are located outside the US, your data is transferred to and processed in the US. For EU users, transfers are conducted under Standard Contractual Clauses or other approved mechanisms as provided by our service providers.
9. Children's Privacy
Chessiic is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has created an account, contact us and we will delete it.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification. The "Last Updated" date at the top reflects the most recent revision.
11. Contact
Questions about this Privacy Policy? Contact us at support@chessiic.com.