Privacy Policy

We collect the following categories of information:

• •Account information: your email address, provided during account creation.
• •Sign-up platform: we record which platform you signed up on (web, iOS, or Android).
• •Profile information: gender and age, if you choose to provide them in your profile. Both are optional and the profile works without them.
• •Chess platform usernames: your Chess.com or Lichess username, which you provide so that we can fetch your public game archives.
• •Game history: chess games we retrieve from public APIs operated by Chess.com and Lichess. We access only the data those platforms expose to anyone — we never log into your account.
• •Usage data: drill completions, readiness scores, session timestamps, and progress metrics generated while you use ChessReady.
• •Payment data: subscription state and billing identifiers. Payments are processed by Paddle, our Merchant of Record. We do not see or store card numbers, CVVs, or full bank details.
• •Push notification subscriptions: if you opt in, we store the push subscription your browser creates — an endpoint URL and the encryption keys that go with it — so we can deliver Daily Prep reminders.

Historical game records. ChessReady holds a database of approximately 1.5 million chess games played by third parties, sourced from publicly available archives. These records contain players' names, ratings and results as published in official tournament and correspondence records.

We process this data on the basis of legitimate interest: aggregated position statistics are the core function of the service, and the records are public sporting results. Individual games are not browsable, downloadable or exportable from the app — only aggregated per-position statistics are shown.

If you are a player whose games appear in this database and you wish to object to that processing, contact support@chessready.app.

We deliberately exclude the following from our system:

• •We never access your Chess.com or Lichess account during play. ChessReady operates only against the public game archive after a game has finished and been published.
• •We never inject scripts, observers, or instrumentation into your chess client.
• •We do not sell your data to third parties.
• •We do not monitor live games, broadcasts, or in-progress events.
• •We do not collect biometric data, precise location data, or device contacts.

We use the information we collect to:

• •Run the opening-gap diagnostic that identifies where your preparation breaks down.
• •Schedule spaced-repetition drills tuned to your individual forgetting curve.
• •Deliver Daily Prep push notifications (only if you have opted in).
• •Process subscription payments through Paddle.
• •Keep the optional profile details you enter — gender and age — on your account so they are there when you return to your profile. We do not currently use them for recommendations, statistics, or advertising.
• •Investigate and resolve security incidents, abuse, or technical failures.

We do not use your data for advertising, profiling, or unrelated commercial purposes.

Our legal basis. We process your account information, chess platform usernames, game history and usage data to provide the service you have asked for — that is, to perform our contract with you. We process payment data to meet our legal obligations for tax and record-keeping. The optional profile details described above— gender and age — are processed on the basis of your consent, given by entering them; you can withdraw it at any time by contacting support@chessready.app and we will erase them. We send push notifications only where you have given consent, which you can withdraw at any time in your settings. The historical game archive described in section 1 is processed on the basis of legitimate interest, as explained there.

Your data is stored in a managed PostgreSQL database hosted by Railway in their EU region. All connections to ChessReady are protected by HTTPS/TLS in transit. Passwords are hashed with bcrypt; we cannot recover the original plaintext. We follow standard industry practices to protect data at rest and in transit, but no system is completely secure — we encourage you to use a strong, unique password and to keep your device up to date.

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with comparable rules, you have the following rights with respect to your personal data:

• •Right of access: you can request a copy of all data we hold about you.
• •Right to rectification: you can correct inaccurate or incomplete data.
• •Right to erasure: the “right to be forgotten” — you can request deletion of your account and all associated personal data.
• •Right to data portability: on request, we will provide a copy of your game history, drill records and readiness metrics in a machine-readable format. Contact support@chessready.app and we will respond within 30 days.
• •Right to object: you can object to specific uses of your data.
• •Right to lodge a complaint: with your local data protection authority.

To exercise any of these rights, contact us at support@chessready.app. We will respond within 30 days.

For active accounts, we retain your data while the account remains active. When you delete your account, we permanently purge your personal data within 30 days. Aggregated, anonymised statistics that cannot be traced back to you may be retained for analytics purposes.

ChessReady uses only essential cookies required for authentication and session management. We do not use advertising cookies, cross-site tracking pixels, or third-party analytics that profile users.

We rely on a small set of third-party providers, each chosen for privacy alignment:

• •Paddle: payment processing as Merchant of Record. Paddle handles all card data and tax compliance on our behalf.
• •Railway: database and backend hosting (EU region).
• •Vercel: web application hosting.
• •Chess.com API: public game data fetched on your behalf with the username you provide.
• •Lichess API: public game data fetched on your behalf with the username you provide.
• •Resend: transactional email delivery. When we email you — currently only password-reset links — your email address and the contents of that message are passed to Resend to send it.
• •Web Push (VAPID): push notification delivery, only if you opt in. We use the browser's standard Web Push API rather than a vendor SDK: your browser issues a subscription endpoint, we store it, and the reminder is relayed by whichever push service your browser vendor operates. We do not choose that service and send it only the notification itself.

Each provider operates under its own privacy policy. We share only what is required for them to render their service to you.

International transfers. Your account data and chess data are stored in the European Union. Some of the providers listed above operate outside the European Economic Area. Where personal data is transferred outside the EEA, it is covered by the transfer safeguards those providers publish, such as Standard Contractual Clauses. You can find the details in each provider's own privacy policy.

ChessReady is not directed at children. You must be at least 13 years old to use the service. Where the digital age of consent in your country is higher than 13 — it is 16 in some EU member states — you must be at least that age. We do not collect a date of birth and rely on your confirmation at sign-up.

The age field in your profile is optional and is not used to verify your age. If you enter an age below the applicable minimum, we treat that as notice that the account should not exist: we will close it and delete the associated data, as described in section 6.

We do not knowingly collect personal information from anyone below the applicable age. If you believe a child below that age has provided us with personal data, please contact support@chessready.app and we will delete the data promptly.

We may update this Privacy Policy from time to time. For material changes that affect how we handle your data, we will notify registered users by email at least 30 days before the change takes effect. Continued use of the service after the effective date constitutes acceptance of the revised policy.