Privacy

Who is responsible

ChessPillar’s operator determines how your account and training information are used and is the data controller. Contact the operator at support@chesspillar.com for privacy questions.

Account, training and uploaded content are processed to provide the service you request. Limited security and diagnostic records protect the service. Optional generated explanations and permission to contact you about feedback can be declined without losing access to training.

What is stored

• Account: your email address and a hashed password, or the identifier your sign-in provider (Google, Discord or GitHub) gives us. Never the provider’s password.
• Profile: the answers you give at onboarding: where you play, a rough rating, your goal, your weekly time, and the name you want to be called.
• Training evidence: every attempt you make, kept raw, because mastery is recomputed from it rather than stored as a score.
• Imported games: PGN you paste, upload, or fetch from a Lichess or Chess.com account you name.
• Files you upload: the documents and images you add, kept as you gave them to us, together with the notes and marks you make on them. They are stored against your account and served back only to you — there is no share link, no public address and no copy sent anywhere else. We store what you upload; we do not go and fetch anyone else’s material for you.
• Studies, repertoires and everything a feature saves for you: analysis workspaces, saved searches, personal puzzles, leak reports, briefings and the rest — each one stored against your account and nobody else’s.
• Sharing: when you share anything by link or with a person — a study, a collection, an analysis workspace, a briefing, a report or a preparation dossier — we store who you shared it with, what they may do, and a hashed copy of any share link. The link itself is shown to you once and never stored in a form we could read back.
• Billing: if you subscribe, the subscription’s state and the payment provider’s own record of each event. Card details never reach us.
• Preferences: appearance and board settings, as a cookie and, when signed in, on your profile.
• Product analytics: which surfaces you use and how training went, tied to your account, so the planner can be judged on whether it helps.

What is not done with it

• It is not sold, and it is not shared with advertisers.
• It is not used to train machine-learning models.
• Your moves in a Fight are evaluated by an engine running in your own browser; they are not sent anywhere to be scored.

How an image of a board is read

When you add an image — a screenshot of a board, a page from a file on your shelf — ChessPillar tries to read the position off it so you have something to correct rather than an empty board. That reading happens on ChessPillar’s own server: the image is compared, square by square, against this product’s own piece artwork. Nothing about it is sent to anyone, and nothing about it is used to train anything.

A deployment can be configured with a hosted recognition provider, and no such provider is configured here. If one were, the image itself would be sent to that provider and to nobody else, and this notice would name it. Either way the answer is a suggestion: the position appears on a correction board, the rules refuse anything illegal, and nothing is stored until you accept it.

Where a language model is involved

Some explanations are written by a language model. When you ask for one, the position, the moves, the engine’s own readings and the detectors’ output are sent to the model provider — and nothing else. There is no free-text box, so nothing you type reaches a model, and your email address and account id never do.

A language model never decides anything: not whether an answer is right, not what you have mastered, not what to train next, and not what you are charged. Those are decided by rules, by the chess engine, and by the curriculum. We keep a ledger of how many calls were made and how large they were — a hash of the question, never the question — so the cost is visible and the budget is enforceable.

Who processes it

Supabase provides the database, authentication and private upload storage. Vercel hosts the application. When configured, PostHog receives limited server-side product events and Sentry receives diagnostic errors. Paddle handles payments when paid plans are available and receives card details directly. Optional Anthropic explanations send only the question and context described beside the opt-in control. Training works without generated explanations. Providers may process information outside your country; applicable contractual safeguards must be confirmed for the deployment.

Cookies

A session cookie keeps you signed in. A theme cookie remembers light or dark if you chose one. There are no advertising cookies and no advertising trackers. Configured server-side analytics and error reporting use the providers described above.

How long information is kept

Account information, training attempts and uploaded content are kept while your account exists so you can resume, export and review them. Account deletion removes the live account records and private files. Security, diagnostic and backup retention follows the configured provider periods; deletion from a backup occurs as that backup expires. Financial records may need to be retained to meet accounting duties. We do not promise immediate erasure from backups.

Minimum age

The closed cohort is for adults aged 18 or older. It is not offered to children. Contact support if a child’s account or information has been added so it can be removed.

Your rights

You do not have to ask us for a copy: sign in and use Settings → Account → Export everything. It builds a zip you can open without ChessPillar — JSON for your records, PGN for your chess, and the files you uploaded, unchanged. It contains everything stored against your account, including collections added by features built after this notice was written.

Deletion is in the same place, behind a typed confirmation. It removes your account and everything it holds: profile, training evidence and mastery, reviews, level progress, studies, opening repertoires and their recall history, game reviews, imported games, archived games and their search index, puzzle sets, uploaded files, every document any feature stored for you, your sharing grants and links, any coach connection, your subscription record and your language-model usage ledger. The sign-in record goes last.

Two things survive a deletion, and neither names you. Aggregate statistics that cannot identify you are kept, and the payment provider’s record of money received is kept with your account identifier removed from it — a business has to be able to account for what it was paid, and a payment record with no name on it cannot be used to find you again.

Anything else — a correction, a question about what is stored — can be requested at support@chesspillar.comor through feedback. Depending on applicable law you may request access, correction, erasure, restriction or portability, object to processing, withdraw optional consent, and complain to your data protection authority.

Changes

This draft will change when the beta opens. Material changes are announced on the site and, for account holders, by email, before they take effect.