DRAFT for review by your lawyer. This is not legal advice. Fill in every [PLACEHOLDER] and answer every ⚖ question before you publish. Remove this box when the page is approved.
Privacy Policy
Effective date: [EFFECTIVE DATE] · Who we are: [COMPANY NAME], [REGISTERED ADDRESS] · Contact: [CONTACT EMAIL]
The short version
- Chess Mirror works on your own device. Your games, analyses, puzzle progress and settings stay in your browser unless you switch on an optional feature.
- You do not need an account to use the free app.
- If you create an account, we keep your email address. If you turn on cloud sync, we store an encrypted copy of your analyses and progress that we cannot read. Your games are never uploaded.
- We use no cookies, show no advertising, and use no tracking by other companies. Opening the page loads nothing from other sites.
- Anonymous usage numbers are optional and off until you say yes.
- If you train with a coach, you choose whether the coach sees a small weekly summary. A coach never sees your games.
1. What we collect, by feature
| Feature | Information | Why | Where it lives | How long |
|---|---|---|---|---|
| Using the app (no account) | Games, analyses, puzzle progress, settings | To work | Only in your browser, on your device | Until you delete it (the "Delete everything on this device" button, or your browser's settings) |
| Loading games | The username you type is sent by your browser to chess.com or Lichess | To fetch your public games | Sent to that site, not to us | Governed by that site's policy |
| Account | Email address; sign-in codes | To sign you in and tie Pro to you | Our hosting provider ([SUPABASE REGION]) | Until you delete your account |
| Cloud sync (optional) | Encrypted analyses and progress (at most 50 MB per person) | To keep your devices in step | Our hosting provider, encrypted on your device first | Until you delete it or your account |
| Pro subscription | Subscription status and dates, linked to your account email; a payment reference | To give you Pro and handle refunds | Our hosting provider | While your account exists, and as long as the law requires us to keep payment records [⚖ YEARS] |
| Payment | Card and billing details | To take payment | Paddle (our payment provider). We do not receive your card details | Per Paddle's policy |
| Coach plan (coaches only) | Coach's email, the price and seats agreed, "I have paid" requests with the payment method, amount, date and reference you type, our approval, and a ledger | To run coach plans and keep accounts | Our hosting provider | As long as the law requires us to keep accounts [⚖ YEARS] |
| Training with a coach (optional) | Your chosen display name, your age group (adult or under 18) and a guardian's name if under 18, the date you agreed, and, only while you share, a weekly summary: games played and analysed, accuracy, blunders per 100 moves, share of games short of time, score, puzzles solved and missed, weekly-plan progress and a day streak, and your first result on each puzzle your coach assigns | To let your coach follow your training | Our hosting provider. The coach sees it through the app | Summary: the last 26 weeks, and deleted at once when you stop sharing, leave your coach or are removed. Consent record: while you are a trainee |
| Usage numbers (optional) | An event name, rounded labels (device type, two-letter language, app version, size groups), a random code that changes at every page load, and the hour | To see which features are used | Our hosting provider | At most 400 days |
2. What we never collect
Your games, moves, positions, opponents or analyses (except the encrypted copy you choose to sync, which we cannot read); your chess.com or Lichess password; your card details; anything you type into the app; cookies; advertising identifiers; your precise location.
3. Who receives information
- Supabase (hosting provider and database). It stores the account, sync and coach data described above and acts for us. [⚖ confirm roles, region and transfer terms.]
- Paddle (payments), only if you subscribe. Paddle is the merchant of record: it handles payment, tax and receipts under its own terms and privacy policy, and sends us your subscription status.
- chess.com and Lichess, only when you load games from them. They see your internet address and the username you typed, as if you had visited them.
- Your coach, only what the "Training with a coach" row says, and only while you share.
- We do not sell your information and we do not share it for advertising.
- Our hosting provider's own server logs may keep internet addresses for a short time, as for any website. We do not store them with the usage numbers.
4. Your choices and rights
- See and take your data: "Download a backup" in the app gives you your analyses, puzzle list and progress. Your games come from chess.com and Lichess and can be loaded again at any time.
- Delete: "Delete everything on this device" (in Privacy and your data); "Delete my cloud data" and "Delete my account" in the Sync screen; "Leave my coach" and "Stop sharing" in My coach.
- Stop optional collection: the usage numbers can be turned off at any time, and your browser's Do Not Track or Global Privacy Control setting always switches them off.
- Other requests (access, correction, objection, a complaint): write to [CONTACT EMAIL]. See also our Data requests page. [⚖ list the specific rights and the authority you answer to, for example Egypt's Personal Data Protection Centre, and any rights for people in the EU or UK.]
- Legal basis [⚖ for each row of the table above: for example contract, consent or legitimate interest].
5. Children
The free app is for everyone. Training with a coach is open to people under 18 only with a parent or guardian's agreement: the app asks for the guardian's name and records that they agreed. We cannot check anyone's age or that a guardian really agreed. Coaches must obtain proper permission from parents (see the Coach terms). A coach sees only the small summary above, never games or messages: the app has no messaging. [⚖ minimum age, local rules on children's data, and whether written consent is required.]
6. Security
Cloud sync is end-to-end encrypted: your analyses are encrypted on your device before they are uploaded, with a key only you hold. Everything is sent over HTTPS. Access to our database is controlled so each person can reach only their own rows, and only the owner account can use the owner tools. See the Security page for the details and the limits. No system is perfectly secure.
7. Cookies and similar storage
We set no cookies. The app uses your browser's storage to keep your own data on your device. See Cookies and storage for the list.
8. Changes
If we change this policy in a way that matters, we will say so in the app before it takes effect. The date at the top shows the current version.
9. Contact
[COMPANY NAME] · [REGISTERED ADDRESS] · [CONTACT EMAIL] [⚖ data protection officer or representative, if required]