Privacy Policy

What We Collect

We keep data collection to an absolute minimum:

• Account holders: If you create an account, we store your chosen username and a hashed version of your password. We never store your password in plain text.
• Puzzle data: Your puzzle scores, rating, and theme performance (e.g., forks, pins, endgames) are stored to track your progress.
• Google Sign-In: If you choose to sign in with Google, we receive your Google profile name, email address, and profile picture. We only use these to personalize your account.
• Guest users: If you play without an account, we collect no personal data whatsoever. Your puzzle progress is stored locally in your browser.

What We Don't Collect

• No tracking cookies. We do not use cookies to track your behavior across sessions or websites.
• No third-party analytics beyond Cloudflare Web Analytics, which is anonymous, cookie-free, and GDPR-compliant.
• No advertisements. We don't run ads and never will.
• No data sales. We do not sell, rent, or share your data with anyone. Period.

Data Storage

All user data is stored in Cloudflare KV, a globally distributed key-value store. Data is encrypted at rest. Session tokens are generated on login and expire automatically. We do not maintain long-lived sessions or persistent identifiers beyond what is needed for your account to function.

Children's Privacy (COPPA)

PlayChessAI is designed with children in mind from the ground up:

• No email required. Kids can create accounts with just a username and password.
• No personal information collected from children. We don't ask for names, ages, locations, or any identifying details.
• Coach accounts are managed by educators. Students are added by their coach and identified only by a display name chosen by the educator.
• Share codes are anonymous. Progress sharing between students, coaches, and parents uses randomly generated codes that contain no personal information.

Cloudflare Web Analytics

We use Cloudflare Web Analytics to understand basic usage patterns like page views and performance metrics. This service is fundamentally different from traditional analytics:

• It does not use cookies or any form of client-side storage.
• It does not collect personal identifiers, IP addresses, or device fingerprints.
• It is fully GDPR, CCPA, and PECR compliant.

For more details, see Cloudflare's privacy policy.

Third-Party Services

PlayChessAI integrates with a small number of third-party services. Here is exactly what each one does:

• HuggingFace — Powers AI coaching responses. Your puzzle positions are sent to generate explanations. Queries are not stored or logged by us.
• Lichess — Provides game data and puzzles. This is publicly available data released under the CC0 (public domain) license.
• Google Sign-In — Optional. Only used if you explicitly choose to sign in with Google. We receive only your name, email, and profile picture.
• DiceBear — Generates anonymous cartoon avatars based on your username. No personal data is sent.

Your Rights

You are in full control of your data:

• Delete your account at any time from the Profile page. When you delete your account, all associated data — your username, scores, ratings, and progress — is permanently removed from our servers.
• Play without an account. You always have the option to use PlayChessAI as a guest with zero data collection.

Contact

If you have any questions or concerns about this privacy policy, please contact us at privacy@playchessai.com.