ChessGrade respects your privacy. This Policy describes what data we collect, how we use it, and what your rights are. For Brazilian users, we comply with the General Data Protection Law (LGPD — Law No. 13.709/2018).
1. Controller and contact
ChessGrade is the controller responsible for processing your personal data. To exercise your rights or ask privacy questions, reach our data protection contact through the Contact page.
2. Data we collect
Provided by you at sign-up: email address (required); password (stored hashed, never in plain text); age range, nationality, training goal, and referral source (optional).
Generated by using the service: puzzle performance (correct answers, mistakes, time, themes); games imported from Chess.com or Lichess (only those you upload); analysis history and spaced-repetition reviews; date and IP of your last login.
Collected automatically: access logs (HTTP method, endpoint, status code, response time) and session cookies to keep you authenticated.
3. Purpose and legal basis
- Contract performance: providing features, processing payments, and sending transactional emails (account verification, password recovery).
- Legitimate interest: platform security, fraud prevention, and access logs.
- Consent: displaying Google AdSense ads in the free training areas. You may decline via the consent banner or your browser settings.
- Legal obligation: retaining data when required by law.
4. Vendors and sub-processors
We rely on vendors that process data strictly for the purposes below. We do not sell, rent, or share your personal data with third parties for marketing.
| Service | Purpose |
|---|---|
| Stripe | Payment and subscription processing |
| Google AdSense | Ad display in free areas |
| AWS (Amazon) | Hosting, database, and analysis processing |
| Google Gemini | Generating game-analysis narratives |
| Resend | Sending transactional emails |
5. Cookies and ads
We use a session cookie (chessgrade_token) required to keep you authenticated, with HttpOnly and SameSite=Strict attributes. In the free training areas, Google AdSense may use cookies to display ads; they load only after your consent and can be disabled in your browser settings.
6. Retention and your rights
We keep your data while your account is active. After account deletion, personal data is removed within 30 days, except where retention is required by law (for example, tax records of Stripe transactions, kept for up to 5 years). You have the right to access, correct, delete, port your data, and withdraw consent. To exercise them, use the Contact page.
7. Artificial intelligence
Narrative game analyses are generated with AI support (Google Gemini) from the moves you upload. The output is a didactic interpretation and may contain inaccuracies; it does not replace your own judgment. We explain the system's limits on our Methodology page.