Privacy Policy

At chessfeed.ai ("we," "our," or "us"), we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, applications, and services (collectively, the "Services").

1. Information We Collect

1.1 Information You Provide

• Account Information: When you create an account, we collect your email address, name (optional), and authentication credentials through Google OAuth or Microsoft Azure AD.
• Chess Platform Credentials: If you connect your Chess.com or Lichess accounts, we collect your usernames for those platforms to import your games.
• User Content: Chess games (PGN files), scoresheets, images, tags, notes, and other content you upload or create within the Services.
• Communication Data: Information you provide when you contact our support team or interact with AI coaches.
• Payment Information: Payment details are collected and processed securely by Razorpay, our authorized payment processor. We do not store complete card or banking credentials on our servers.

1.2 Automatically Collected Information

• Usage Data: Information about how you use our Services, including game analysis history, features accessed, AI coach interactions, and exercise completion.
• Device Information: IP address, browser type, operating system, device identifiers, and mobile network information.
• Analytics Data: We use Google Analytics to collect data about website traffic, user behavior, and Service performance.
• Location Data: Approximate geographic location derived from your IP address for geo-based pricing and service optimization.

1.3 Information from Third Parties

• Chess Platforms: Games, match history, and public profile information from Chess.com and Lichess when you connect these accounts.
• Authentication Providers: Basic profile information from Google or Microsoft when you use OAuth authentication.

2. How We Use Your Information

We use the collected information for the following purposes:

• Service Delivery: To provide, maintain, and improve our chess analysis, AI coaching, and learning features.
• Game Analysis: To analyze your chess games using Stockfish engine and generate AI-powered insights and commentary.
• Personalization: To create personalized exercises, track your progress, and tailor AI coaching recommendations.
• Account Management: To manage your account, authenticate your identity, and provide customer support.
• Communication: To send you service-related notifications, updates, security alerts, and support messages.
• Analytics and Improvement: To understand how users interact with our Services and improve features, performance, and user experience.
• Security: To detect, prevent, and address fraud, security breaches, and technical issues.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.
• AI Model Training: We may use anonymized, de-identified chess game data and associated metadata to train and improve our proprietary AI models and coaching algorithms. No personally identifiable information is used in this process.

3. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

3.1 Service Providers

We work with third-party service providers who perform services on our behalf:

• Cloud Hosting: Our Services are hosted on cloud infrastructure providers.
• AI Services: We use Google Vertex AI (Gemini) for AI coaching and insights generation.
• Analytics: Google Analytics for website and application analytics.
• Authentication: Google OAuth and Microsoft Azure AD for secure authentication.
• Payment Processing: Razorpay handles all billing and payment transactions on our behalf. Their processing is governed by Razorpay's own Privacy Policy.

We maintain a list of authorized sub-processors (such as Razorpay and cloud infrastructure providers) and ensure they are bound by strict data protection agreements.

3.2 Public Game Feed

If you choose to make your games public, they will be visible on our public game feed to other users. You can control game visibility settings in your account.

3.3 Academy Administrators

If you are a student in an Academy plan, your academy administrators will have access to your game analysis, progress data, and exercise completion status for educational purposes. For Academy (B2B) plans, the Academy is recognized as the data owner for all student data collected under their account. The Academy retains the right to export, transfer, or request permanent deletion of that data at any time, in accordance with their internal data policies and applicable law. Chessfeed.ai acts solely as a Data Processor for such data and will fulfill export or deletion requests within a reasonable timeframe upon written instruction from the Academy administrator.

3.4 Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or if we believe such action is necessary to comply with legal obligations, protect our rights, or ensure user safety.

4. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience:

• Essential Cookies: Required for authentication, security, and basic Service functionality.
• Preference Cookies: Remember your settings, such as theme preference (dark/light mode) and language selection.
• Analytics Cookies: Help us understand how users interact with our Services through Google Analytics.
• Local Storage: Used to cache geo-location data and user preferences for improved performance.

You can control cookie settings through your browser, but disabling certain cookies may affect Service functionality.

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption of data in transit using HTTPS/TLS
• Secure authentication using OAuth 2.0 and JWT tokens
• Regular security audits and updates
• Access controls and authentication for internal systems
• Secure database storage with encryption at rest

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Data Breach Notification

In the event of a security breach that compromises personal data, chessfeed.ai will notify affected users and relevant regulatory authorities within the timelines mandated by the Digital Personal Data Protection Act (DPDP), 2023, and other applicable laws.

7. Your Privacy Rights

Under Indian law and in accordance with GDPR/UK GDPR principles (where applicable), you have the following rights:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your account and personal data, subject to legal retention requirements.
• Data Portability: Request a copy of your data in a structured, machine-readable format.
• Objection: Object to processing of your personal information for specific purposes.
• Withdraw Consent: Withdraw consent for data processing where consent is the legal basis.

EU and UK Users: Where personal data is transferred outside the European Economic Area (EEA) or the United Kingdom, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission, or equivalent transfer mechanisms recognized under UK GDPR, to ensure an adequate level of protection. You may request a copy of the applicable transfer safeguards by contacting us at the address below.

To exercise these rights, please contact us at privacy@chessfeed.ai. We will respond to your request within 30 days.

8. Data Retention

We retain your personal information for as long as necessary to provide the Services and fulfill the purposes outlined in this Privacy Policy:

• Active Accounts: Information is retained while your account is active.
• Deleted Accounts: After account deletion, we retain certain data for 90 days for recovery purposes, then permanently delete it.
• Legal Requirements: Some data may be retained longer if required by law or for legitimate business purposes (e.g., dispute resolution, fraud prevention).
• Anonymized Data: We may retain anonymized or aggregated data indefinitely for analytics and improvement purposes.

9. Children's Privacy

chessfeed.ai actively supports young chess players. To comply with applicable child data protection laws globally, including the Digital Personal Data Protection Act (DPDP), 2023 and the U.S. Children's Online Privacy Protection Act (COPPA), minors may use the Services only under a verified Parent/Guardian Consent model.

For direct consumer (B2C) users under 18, we require that:

• A parent or legal guardian creates and maintains the account on behalf of the minor.
• A parent or legal guardian provides verifiable consent for collection and processing of the minor's personal data.
• A parent or legal guardian is responsible for managing privacy choices, account permissions, and subscription settings for the minor.

For Academy (B2B) plans, the institution and/or academy administrator is responsible for obtaining any parental or guardian authorizations required under applicable law before student onboarding.

Children's data is processed strictly to provide the chess coaching and training Services, including game analysis, progress tracking, and gameplay improvement. We do not use children's personal data for targeted advertising and we do not sell children's personal data to third parties.

If you believe we have inadvertently collected information from a child under 13, please contact us immediately at privacy@chessfeed.ai.

10. Data Residency & International Transfers

Primary Data Residency — India: All personal data collected through our Services is primarily stored and processed on infrastructure located within India. We prioritize keeping your data within Indian territory in alignment with the Digital Personal Data Protection Act (DPDP), 2023.

Certain service providers (such as Google Vertex AI and analytics platforms) may process data outside India. In such cases, we ensure appropriate contractual and technical safeguards — including Standard Contractual Clauses (SCCs) where applicable — are in place before any cross-border transfer. By using our Services, you acknowledge and consent to such transfers subject to these protections.

11. Third-Party Links

Our Services may contain links to third-party websites (such as Chess.com and Lichess). We are not responsible for the privacy practices of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated Privacy Policy on our website with a new "Last Updated" date
• Sending an email notification to your registered email address for significant changes
• Displaying a prominent notice on our Services

Your continued use of the Services after such changes constitutes your acceptance of the updated Privacy Policy.

13. U.S. State Privacy Rights

If you are a resident of California or another applicable U.S. state, you may have specific rights regarding your personal information, including the Right to Know, the Right to Delete, and the right to opt-out of the "sale or sharing" of personal data. chessfeed.ai does not sell personal data. To exercise these rights, contact us at privacy@chessfeed.ai.

14. Compliance with Indian Law

Chessfeed.ai complies with Indian data protection legislation, including:

• Digital Personal Data Protection Act (DPDP), 2023: India's principal data protection law governing the processing of digital personal data. We observe the rights of Data Principals and fulfill the obligations of a Data Fiduciary as required under the Act.
• Information Technology Act, 2000: We implement and maintain reasonable security practices and procedures as mandated under the IT Act and its associated rules.

Role Classification: For direct consumer (B2C) services, Chessfeed.ai acts as the Data Fiduciary, determining the purpose and means of processing personal data. For Academy and enterprise (B2B) clients, Chessfeed.ai acts as a Data Processor, processing data solely on the instructions of the client organization.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

16. Data Protection Officer

For data protection inquiries or to exercise your privacy rights, you may contact our Data Protection Officer at dpo@chessfeed.ai.