Privacy Policy

1. What Information Do We Collect?

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You

The personal information we collect may include the following:

• Email addresses
• Usernames
• Passwords — stored only as a cryptographic hash using bcrypt. We never store your password in plain text.

Chess Data

We store the chess data you create and import, including: opening repertoires and moves, spaced repetition drill history and scheduling data, imported games from Lichess and Chess.com, puzzle solving history, and Stockfish analysis results.

Payment Data

We do not collect or store any payment information. If you choose to make purchases, all payment data (such as card numbers and billing details) is handled entirely by Stripe. We never have access to your payment instrument numbers or security codes. You may find Stripe's privacy notice here: https://stripe.com/privacy.

Technical Data

We use a single HTTP-only session cookie to keep you logged in. This cookie is:

• HTTP-only (not accessible to JavaScript)
• Secure (transmitted only over HTTPS when configured)
• SameSite: Lax (prevents cross-site request forgery)
• Expires after 14 days of inactivity

We do not use tracking cookies, analytics scripts, or advertising pixels. Server logs may temporarily record IP addresses for security purposes (e.g., rate limiting login attempts).

Sensitive Information. We do not process sensitive information.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

2. How Do We Process Your Information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To provide the Service. We use your chess data to store and display your repertoires, schedule spaced repetition reviews, import and analyze your games, and track your drill progress.
• To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
• To send you marketing and promotional communications. We may process the personal information you send to us for our marketing purposes, if this is in accordance with your marketing preferences. You can opt out of our marketing emails at any time. For more information, see "What Are Your Privacy Rights?" below.

3. When and With Whom Do We Share Your Personal Information?

In Short: We may share information in specific situations described in this section and/or with the following third parties.

Stripe

If you subscribe to a paid plan, payment processing is handled by Stripe. Stripe receives your payment information (card number, billing address) directly — this data never passes through our servers. Stripe's privacy policy governs how they handle your payment data.

Lichess API

If you choose to import games from Lichess, we make API requests to Lichess on your behalf using your Lichess username. We receive your game data (moves, results, timestamps) and store it locally for analysis. We do not send any of your Chessstack data to Lichess.

Chess.com API

If you choose to import games from Chess.com, we make API requests to Chess.com on your behalf using your Chess.com username. We receive your game data and store it locally. We do not send any of your Chessstack data to Chess.com.

Loops

We use Loops to send transactional emails such as email verification and password reset messages. Your email address is shared with Loops solely for the purpose of delivering these communications.

Business Transfers

We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

4. How Long Do We Keep Your Information?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than the period of time in which you have an account with us.

If you delete your account, all associated data (repertoires, drill history, imported games, settings) will be permanently removed from the database. Expired session records are automatically cleaned up every 6 hours.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

5. How Do We Keep Your Information Safe?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. Specifically:

• Passwords hashed with bcrypt (never stored in plain text)
• Session-based authentication with HTTP-only secure cookies
• Rate limiting on login attempts to prevent brute-force attacks
• CSRF protection via SvelteKit's built-in mechanisms
• Security headers (HSTS, CSP, X-Frame-Options, etc.)

However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

6. Do We Collect Information From Minors?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at support@chessstack.app.

7. What Are Your Privacy Rights?

In Short: You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us using the contact details provided in the section "How Can You Contact Us About This Notice?" below.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Opting out of marketing and promotional communications: You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send, or by contacting us using the details provided in the section "How Can You Contact Us About This Notice?" below. You will then be removed from the marketing lists. However, we may still communicate with you — for example, to send you service-related messages that are necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Log in to your account settings and update your user account
• Export your repertoire data in PGN format at any time

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

If you have questions or comments about your privacy rights, you may email us at support@chessstack.app.

8. Do We Make Updates to This Notice?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

9. How Can You Contact Us About This Notice?

If you have questions or comments about this notice, you may email us at support@chessstack.app or contact us by post at:

Chessstack LLC

10. How Can You Review, Update, or Delete the Data We Collect From You?

Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please contact us at support@chessstack.app.