Privacy Policy

What we collect

• Account information such as your email address, display name, and authentication provider details when you sign in with email or Google.
• Chess data you create in ChessRelay, including games, moves, PGNs, analysis results, training sessions, opening prep, stream sessions, and related settings.
• Public practice activity, including Daily Vote choices, Evaluation Quiz answers, Visualization Practice sessions, hints and reveals, ratings, history, and daily allowance usage, whether you play as a guest or sign in.
• Camera frames or still images you choose to process through camera-based features. These frames may be sent to our model backend to detect a board, pieces, or position state.
• Basic technical data such as device/browser information, IP-derived logs, request timing, error logs, and service diagnostics needed to keep the app reliable.

How we use it

• To let you sign in, save your games and practice progress, vote on positions, analyze positions, run training modes, and use camera tracking or streaming features.
• To operate and improve board detection, move inference, Stockfish analysis, onboarding, and debugging workflows.
• To send account emails such as confirmation, magic link, and password reset messages.
• To protect the service from abuse, diagnose errors, and understand whether beta users can use the product successfully.

Camera and model processing

• Camera features are designed to process frames for chess-board understanding, not for general surveillance. ChessRelay does not need continuous video storage to provide the core experience.
• For camera tracking, board testing, opening training, and evaluate-position features, selected frames may be sent to a model server so the app can detect pieces and map them to squares.
• If a future feature lets you confirm or correct scans for model improvement, we will use those submitted or corrected positions as training candidates only when the product flow makes that clear.

Guest play and saved progress

• You can use public practice features without an account. A random guest cookie lets us resume your browser’s practice, remember votes, and apply daily allowances. The cookie lasts up to one year; our database stores a hash of its identifier.
• If you choose to sign in, this browser’s activity can be linked to your account for daily allowances. Where offered, you can choose to import guest progress into your account. Clearing browser cookies does not delete activity already saved on our servers.

Voice and language processing

• When you choose microphone input, your browser’s speech-recognition service processes your speech and may send audio to its own provider. ChessRelay does not save your microphone recording. You can review or edit the transcript before sending it, or type instead.
• Submitted natural-language moves and questions may be sent to Typesafe.ai’s Jev model with limited puzzle interaction context to identify the requested action and move details. Exact chess notation and supported short moves can be checked directly. We save structured session results and request fingerprints rather than raw microphone recordings.
• Google Cloud Text-to-Speech converts our chess position descriptions and coach replies into narration. Generated narration is kept in private storage and may be reused for other players hearing the same text. These files contain the generated coach voice, not recordings of your voice.

• How browser speech recognition works

Traffic and performance

• Vercel Web Analytics and Speed Insights help us understand aggregate visits and performance on public landing, practice, and legal/contact pages using data such as public page paths, referrers, browser and device information, general location, and loading metrics. We exclude streaming overlays, saved-game links, private dashboards, account and recovery flows, and pages containing unknown query parameters or URL fragments. Campaign query values are removed from event URLs. Referrers containing any query string or fragment, sensitive first-party paths, and browser privacy opt-outs also suppress these events.
• Our private activity dashboard also records page categories, timestamps, referring-site hostnames, and broad device categories. A random identifier in browser session storage distinguishes a tab’s activity; our server stores a daily hash for estimated browser-session counts. Traffic payloads do not include full URLs, query strings, IP addresses, microphone recordings, or answer text.
• To limit abuse of internal page tracking, our server converts the trusted network address into a purpose-specific daily hash and applies session, network, and shared request caps. Raw network addresses are not stored in these records. The hash changes each UTC day and differs from feedback hashes and between Production and Preview. Network hashes and their counters are removed after seven completed UTC days when maintenance runs. Requests discarded by limits or outages are not included in visit counts.
• Internal page-visit records and completed activity notifications use a 90-day retention policy. Scheduled maintenance, when configured, and owner-triggered cleanup remove older records. Undelivered notifications are kept until resolved. This policy is separate from saved games and practice progress, and from messages retained by Discord.
• We record successful sign-ins when Supabase creates a new authenticated session. Restoring an existing session and refreshing its tokens do not count as a new sign-in. Private sign-in records store the account identifier, time, and a one-way source fingerprint for deduplication, separately from authentication sessions, under the normal 90-day cleanup policy; records needed for undelivered notifications remain until resolved. They do not store authentication tokens, raw session identifiers, speech-recognition content, or network addresses.
• We can send account-creation notifications, real-vote notifications, daily practice summaries, and successful sign-in notifications to separate private Discord channels used by the site owner. New-account, successful sign-in, and signed-in vote notifications can include your current account display name and email address. Practice summaries can also include your display name, email address, and the number of quizzes and visualization attempts you completed. Guest activity remains anonymous. Notifications do not include authentication tokens, transcripts, or quiz answer text. Names and emails are looked up for delivery rather than copied into traffic event records, sign-in records, or saved summary records; messages remain in Discord until removed there.

• Vercel Web Analytics privacy
• Vercel Speed Insights privacy

Feedback

• When you use the feedback form, we save the category, message, broad page category, and any reply email you choose to provide. You can send feedback without an account. We do not automatically attach your account name or email to these submissions.
• Your submission is sent to the site owner’s private Discord channel so we can review problems and suggestions and reply when you provide an email. Raw network addresses are not saved in feedback records; a daily network hash and short-lived counters help limit spam.
• When maintenance is configured, delivered feedback records are removed after their delivery record is more than 90 days old. Pending or failed submissions are retained until resolved. Discord messages remain there until removed in Discord.

Third-party services

• ChessRelay uses Supabase for authentication, database storage, and private narration storage; Vercel for hosting, Web Analytics, and Speed Insights; Resend for transactional email; and Google OAuth for Google sign-in. Camera features use our configured computer-vision model backend. Stockfish provides chess analysis in your browser.
• Visualization Practice also uses Google Cloud Text-to-Speech for generated narration, Typesafe.ai’s Jev for supported language requests, and your browser’s speech service for microphone input when available. Discord receives the limited activity notifications and voluntarily submitted feedback described above when configured.
• Each provider’s own privacy and security practices also apply to the processing it performs.

Your choices

• You can choose not to use camera-based features and still use manual game entry and review tools.
• You can type instead of using the microphone and review or edit recognized text before sending it. Public practice is available without an account, within guest allowances.
• You can contact us to request help with account access, data questions, or deletion requests.
• During beta, some controls may be manual while we improve account and data-management tooling.