Chessschool Privacy Policy

Chessschool (www.chessschool.be) is a website in Dutch and English for learning chess, with lessons, exams, puzzles and a chess bot. This page explains which personal data we process, why, who we share it with, how long we keep it and what rights you have.

Who we are Data Google user data Sharing Retention and deletion Your rights

1. Who we are

Chessschool is the controller of your personal data under the GDPR. You can reach us at info@chessschool.be or through the contact form.

2. Data we process and why

Data	Purpose	Legal basis
Account data: email address, password (only as an unreadable hash), optionally your name	Create an account, sign you in and keep your progress across devices	Performance of the service you request
Google sign-in data: name, email address and profile picture from your Google account (see section 3)	Let you sign in with one click and recognise your account	Performance of the service, at your request
Progress and settings: points, exam scores, solved puzzles, results against the chess bot, achievements, language and dark mode	Show your learning results, statistics and diploma	Performance of the service
Browser local storage: the same progress and settings, plus your choice in the cookie notice	Make the site work, also without an account	Strictly necessary for the service
Contact messages: name, email address and message	Answer your question	Legitimate interest
Usage statistics (Google Analytics 4): pages viewed, device and browser type, approximate location and your IP address (processed by Google)	Understand how the site is used so we can improve it	Consent (optional, withdrawable at any time)
Technical data: IP address and requests in server logs of our hosting and service providers	Security, debugging and preventing abuse	Legitimate interest

We do not collect payment data and we do not sell personal data. We do not use your data for targeted advertising or profiling.

3. Sign in with Google and Google user data

You can sign in to Chessschool with the "Continue with Google" button. This uses Google OAuth 2.0, handled by our authentication provider Supabase.

Which Google data we access

We only request the basic information needed to sign you in (the scopes openid, email and profile): your name, your email address and your profile picture. We do not request access to Gmail, Google Drive, Calendar, Contacts or any other Google service, and we do not read or modify anything there.

How we use this data

Your email address identifies your account and links your progress to you.
We show your name in the site (for example "Welcome, name" and on your diploma).
Your profile picture may be stored in your account profile by the sign-in provider. The site currently displays your initials.

We use Google user data only to provide and improve the user-facing features of Chessschool that you use. Not for advertising, not for profiling and not for any other purpose.

Sharing of Google user data

We do not sell Google user data and do not share it with third parties, except with our processor Supabase, which stores it on our behalf so your account works (see section 4). We also disclose data where required by law.

Protection

All connections are encrypted (HTTPS/TLS). Passwords are never stored in readable form, and with Google sign-in we never receive your Google password. Access to the database is limited to the site administrator, and the database is set up so that a signed-in user can only read and change their own progress. Humans only view your account data when needed for support, security or legal compliance.

Retention, deletion and revoking access

We keep your Google user data for as long as your account exists. If you delete your account, we delete it together with your progress (see section 5). You can revoke Chessschool's access to your Google account at any time at myaccount.google.com/permissions.

Limited Use

Chessschool's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Party	Role	Data
Supabase	Processor: sign-in (email and Google) and storage of progress	Account data, Google profile data, progress
Google (OAuth)	Identity provider for "Continue with Google"	Your sign-in activity at Google
Google Analytics	Usage statistics	Pseudonymous usage data and IP address
Google Fonts	Loading the typeface	IP address and browser data when the font loads
Hosting and email provider	Running the website and receiving contact messages	Technical data and contact messages

Some of these parties process data outside the European Economic Area, including in the United States, on the basis of appropriate safeguards such as the EU-U.S. Data Privacy Framework or standard contractual clauses.

Advertising. No rewarded advertising network is currently connected. Hint credits are available through practice and starter credits. A future rewarded advertisement is shown only after you choose the ad button, see the partner information and press Start advertisement. You can always keep playing without ads. The article index also has a permanent partner listing with a reciprocal backlink to Democratic Chess. Images in this listing load from their website, whose server receives your IP address and browser information. This partner listing is separate from optional rewarded advertisements.

5. How long we keep data and how to have it deleted

Account and progress: as long as your account exists. Request deletion at info@chessschool.be from the email address of your account. We delete your account and all linked data (including in Supabase) within 30 days.
Browser local storage: stays on your device until erased. Settings lets you reset learning results while keeping preferences. Use your browser settings to erase all local storage.
Contact messages: at most 12 months after we have handled them.
Google Analytics: according to the retention period configured in Google Analytics, at most 14 months.
Server logs: short term, only for security and debugging.

Backups may briefly still contain deleted data until they are overwritten automatically.

6. Your rights

You have the right to access, correct, delete, restrict, port and object to the processing of your data. Where we rely on consent, you can withdraw it at any time. Email us at info@chessschool.be; we reply within one month. If you disagree with how we handle your data, you can lodge a complaint with the Belgian Data Protection Authority.

7. Children

Chessschool is also meant for children. Children under 13 only create an account with the permission of a parent or guardian. Without an account the site can be used in full, with storage only on the child's own device. If you notice a child has an account without permission, email us and we will delete it.

8. Cookies and local storage

We use necessary local storage for progress, settings and your privacy choice. Google Analytics loads only after you allow analytics. Choose Necessary only to decline, or change your choice using Privacy preferences in the home page footer. Withdrawing consent stops new measurements and removes Analytics cookies accessible to this site. We use no advertising cookies. You can clear all local storage in your browser settings.

9. Changes

We update this policy when our practices change, for example with new features or a different way of using Google user data. The date at the top shows the latest change. For important changes we will also notify you in the site.