Privacy Notice

Effective 2 August 2026 · Version 2026-08-02

ChessStride does not sell personal information, display advertising, provide open chat, or use cross-site behavioural tracking. Limited first-party usage events help operate and improve the product. This notice is provided in line with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and describes how personal data is handled.

Information used

We process the account owner's email, learner username, date of birth, country, connected chess usernames, imported games, reviews, training attempts and progress. For a learner under 18, we also record the parent or guardian's name, email and consent record.

Community profiles and leaderboards

The permanent username chosen during registration may appear to signed-in members alongside opted-in puzzle, tactics and endgame ratings, attempts, accuracy, join month, avatar colour and — only when enabled — country code. Account owners can hide the profile and leave leaderboards in Settings. Email, age, birth date, guardian information, chess-platform usernames, games, reviews and mistakes are never included in this community profile.

Why it is used

Data is used to authenticate the account, import requested games, analyse chess decisions, select training, maintain progress, protect and improve the service, and answer support or legal requests. We rely on the consent you give at registration, and on our legitimate need to run and secure the service, as the basis for this processing.

Cookies and analytics

We use only strictly-necessary first-party cookies to keep you signed in (Supabase authentication) and to protect the service. We record a small set of first-party product events — such as page views and when a training session starts or completes — to understand and improve how the app is used. We do not use advertising cookies, third-party ad networks, or cross-site tracking, so no cookie-consent banner is required for non-essential tracking.

Children

Users under 18 may only use a parent-created and parent-controlled account, and we obtain verifiable parental consent at registration as required by the DPDP Act. We do not knowingly permit independent child registration, targeted advertising, public posting, or behavioural monitoring of children for advertising. Parents may access, export, correct, hide the community profile, or request deletion of the learner's data.

Processors and transfers

Supabase provides authentication and database services, and Vercel provides application hosting, each as our data processor under contract. Processing and storage may occur outside India; where that happens we take reasonable steps for the data to remain protected consistent with this notice and applicable law.

Retention and your rights

Account data is retained while the account remains active and while reasonably necessary for security or legal obligations, after which it is deleted or anonymised. Under the DPDP Act you may access and correct your data, withdraw consent, and request erasure. The account owner can download their data or request deletion from Settings, and contact us for access, correction, or to raise a grievance.

Grievance officer and contact

For any privacy question, consent withdrawal, or grievance, contact our Grievance Officer through the Support page. We aim to acknowledge grievances promptly and respond within the timelines expected under the DPDP Act. If you remain unsatisfied, you may approach the Data Protection Board of India.

Security

Access controls, row-level security, encryption in transit, rate limits and operational logging protect the service. No online service can be guaranteed perfectly secure, but we work to protect your data and will act on any confirmed incident as required by law.