Privacy Policy

1. Who we are

Data controller: Chessry, operating from Ghana. Contact for anything privacy-related: support@chessry.com. We aim to reply within 2 business days.

2. Data we collect

2.1 Account data (via Clerk)

When you create an account we receive your email address, name (if provided), and user identifier from our authentication provider, Clerk. We use this to create your account, keep you signed in, and contact you about the service.

2.2 Your chess content

Games, PGN files, opening repertoires, puzzle attempts, training history, ratings, and preferences you create or upload. This is the core of the service. Without it there is nothing to review or train on.

2.3 Third-party imports you request

If you connect a Lichess or Chess.com account, we fetch only the public data you ask for (username, public games, public ratings) using those platforms' public interfaces. We never ask for your Lichess or Chess.com password, and you should never send it to us. Their own privacy policies govern data held by them.

2.4 Technical data

Device and browser type, approximate location derived from IP address (used for security and for showing correct pricing regions), error logs, and records of feature usage needed to run and improve the service.

2.5 Support correspondence

Emails you send to support, including any account details needed to resolve your request.

We do not collect payment card details. When paid plans launch, payments are handled by our Merchant of Record (see Terms), which never shares full card numbers with us.

3. Why we process it (legal bases)

• Contract: providing the training workspace you signed up for (account, chess content, imports, support).
• Legitimate interests: keeping the service secure, preventing abuse, and improving training quality (e.g. aggregated, non-identifying usage statistics).
• Consent: anything optional, such as marketing emails. You can withdraw consent at any time by emailing us or using the unsubscribe link.
• Legal obligation: retaining records the law requires (e.g. transaction records once paid plans exist).

4. Who processes data on our behalf

• Clerk: authentication and account management.
• Groq: AI-generated move and position explanations. The position and surrounding context needed to explain it are sent for inference; your email or name is not. Identical positions may reuse a cached explanation generated for another user, so explanations are never private to you. Do not put personal information in content you ask us to explain.
• Upstash (Redis): short-lived operational caching so the app stays fast.
• Hosting infrastructure: servers and databases hosting the application.
• Polar: payments and subscription billing once paid plans launch (acts as Merchant of Record and data controller for payment data).

Each provider processes data only to provide its service to us, under contractual data-protection terms. We do not sell personal data and we do not share it with advertisers or data brokers.

5. International transfers

We operate from Ghana and some providers process data in the US, the EU, or other countries. Where data leaves Ghana or the EU/UK, transfers are safeguarded by the provider's contractual commitments and, for EU/UK data, mechanisms such as EU Standard Contractual Clauses or equivalent protections.

6. Retention

Account and chess content is kept while your account is active. If you delete your account (see §8), your content is deleted or irreversibly anonymized within 30 days, except where the law requires longer retention (e.g. tax records for paid transactions). Error logs are kept for up to 12 months. Cached AI explanations for generic positions may persist without any link to you.

7. Security

Access is authenticated (Clerk), traffic is encrypted in transit (HTTPS), and access to production data is limited to what is needed to operate the service. No system is perfectly secure; if we discover a breach affecting your data, we will notify you and the relevant authority as the law requires.

8. Your rights

Depending on where you live (including under GDPR/UK GDPR and Ghana's Act 843), you may have the right to access, correct, delete, or receive a copy of your data, restrict or object to processing, and withdraw consent. To exercise any of these, email support@chessry.com from your account email with what you want done, including data deletion requests, which we action within 30 days. You also have the right to complain to a supervisory authority: Ghana's Data Protection Commission, or your local EU/UK data protection authority.

9. Children

The service is for users aged 13 and older. We do not knowingly collect data from children under 13; if you believe a child has provided data, contact us and we will delete it. Users aged 13 to 16 in EU member states must have any parental consent their country's law requires for information-society services.

10. Cookies

We use only strictly necessary cookies and similar storage: sign-in and session security (Clerk), load balancing, and remembered preferences such as board settings. There are currently no analytics, advertising, or cross-site tracking cookies, so no consent banner is needed. If that ever changes, this policy will be updated first and consent requested where the law requires it. You can already block non-essential storage in your browser without breaking sign-in.

11. Changes to this policy

If we change this policy materially, we will post the new version here with a new “Last updated” date and, for significant changes, notify you by email or in the app before they take effect.

12. Contact

Questions, requests, or complaints: support@chessry.com. See also Contact, Terms of Service, and Refund & Cancellation Policy.