Privacy Policy
Last updated: 24 June 2026
This Privacy Policy explains how Chess Blues ("Chess Blues", "we", "us") collects, uses, and protects your personal information when you use chessblues.com and our related services (the "Service"). We aim to comply with the EU/UK GDPR and South Africa's POPIA; where they differ, we apply the stricter standard.
1. Information we collect
- Account data: your email address, full name, and (optionally) a username and avatar.
- Authentication data: a securely hashed password (we never store it in plain text).
- Usage & profile data: your chess rating, lesson/puzzle progress, games you import or paste, and coaching interactions.
- Voice data: if you use the voice coach, the audio you record is sent to our speech provider for transcription. We do not retain raw audio after processing.
- Payment data: your subscription status and plan. Card details are entered on our payment provider's secure pages and are never seen or stored by us.
- Technical data: basic product analytics (e.g. via Google Analytics and PostHog), device/browser information, and a login token stored in your browser.
When you choose social sign-in, we receive a verified provider identifier, email address and available display name from Google or Apple. We request only basic sign-in information, not access to your mailbox, contacts or files. We never receive your Google or Apple password. Apple may provide a private forwarding address if you choose Hide My Email.
2. How we use your information
- To provide and operate the Service (accounts, coaching, analysis, lessons, puzzles).
- To process subscriptions and payments.
- To generate AI coaching commentary on your moves and positions.
- To improve the Service and understand usage, including page journeys, button interactions and feature usage. Signed-in activity can be associated with your account ID.
- To communicate with you about your account, security, and support.
- To tell you by email about your subscription, such as an upcoming renewal, a payment that did not go through, or a cancellation. Every such email has a link to stop them; receipts for payments still go out.
3. Third-party processors
We share limited data with service providers strictly to operate the Service:
| Provider | Purpose | Data shared |
|---|---|---|
| OpenAI | AI coaching text, transcription & voice narration | Chess positions/moves and, for voice, recorded audio. No account identifiers are sent. |
| PayFast | Payment processing | Handled directly by PayFast; card data never reaches us. |
| Lichess & Chess.com | Game import, opening & evaluation data | Public game/position data you choose to import. |
| Railway | Application hosting | All Service data, as our infrastructure host. |
| Google / Apple (where offered) | Social sign-in | Provider account identifier, verified email and available display name used to authenticate you. |
| Resend | Transactional email | Your email address and account verification, password-reset or subscription email content. |
| Google Analytics | Usage analytics | Anonymised/technical usage data. |
| PostHog | Product analytics | Pageviews and feature-usage events; for signed-in users, an account identifier is included. |
4. Legal bases (GDPR)
We process your data to perform our contract with you (providing the Service), on the basis of your consent (e.g. voice recording, optional analytics), and for our legitimate interests in securing and improving the Service.
5. Data retention
For the private owner dashboard, a random session identifier, page category and last activity time indicate recent visible activity. These presence records expire after 24 hours. We do not include form values, passwords, card details or URL query strings in this presence data.
We keep account data for as long as your account is active. When you delete your account we remove your personal data within a reasonable period, except where we must retain limited records for legal or accounting purposes.
To stop the introductory offer being claimed more than once, we keep a one-way, keyed fingerprint of the email address that received it, including after the account is deleted. It cannot be turned back into your address and is used for nothing else.
6. Your rights
Subject to applicable law, you may request access to, correction of, or deletion of your personal data, object to or restrict certain processing, and request a copy of your data.
You can do the two main ones yourself, immediately, from your settings page: download everything we hold about you, or delete your account. For anything else, email support@chessblues.com.
Deleting your account removes your personal data. Records of payments are kept in anonymised form, because they are financial records we may need to answer a bank or tax query. They no longer identify you.
7. Children
The Service is not directed at children under 13 (or the minimum age in your country). We do not knowingly collect data from children below that age.
8. Security
We use industry-standard measures (encryption in transit, hashed passwords, access controls). No method of transmission or storage is perfectly secure, but we work to protect your data.
9. Changes
We may update this policy; material changes will be reflected by the date above.
10. Contact
Data controller: Chess Blues, South Africa. Questions: support@chessblues.com.