Privacy

ChessWhiz is intended for children learning chess. This notice is designed around COPPA-style parent notice, consent, review, deletion, and retention expectations. A parent or guardian should set up the child's experience and must approve any feature that saves progress to ChessWhiz, sends chess coaching context to service providers, receives parent emails, or starts a paid subscription.

Operator contact: ChessWhiz, hello@chesswhiz.com. The operator mailing address and a counsel-approved phone number or contact alternative must be added before production COPPA legal sign-off.

• Child first name or nickname and age band — used to choose coach tone, reading level, and board clues. Name fields are sanitized to avoid emails, phone numbers, URLs, and address-like text.
• Game state and learning progress — Chess Power, games, moves, puzzle attempts, mistakes, concepts, XP, missions, and coach history. This powers adaptive coaching, parent proof, replay practice, and progress recovery.
• Anonymous device ID — lets the browser resume one kid profile. A device ID alone cannot access parent email, billing, sibling profiles, or the parent dashboard.
• Parent account data — parent email, sign-in session, active kid profile, digest settings, and subscription status.
• Billing data — paid checkout and subscription management are handled by Stripe. ChessWhiz stores Stripe customer/subscription identifiers and entitlement status, not full card numbers.
• Coach and safety logs — limited runtime events, latency, trigger type, and moderation reasons so we can debug safety and learning quality. Moderation logs avoid storing raw rejected unsafe text.

• No child email accounts or child passwords.
• No precise location, contacts, photos, uploads, or child voice recordings.
• No third-party advertising trackers, pixels, or analytics SDKs that profile children.
• No social features, public profiles, user-generated posting, multiplayer chat, or stranger contact.
• No open-ended child chat with an AI. The child experience is board actions, coach messages, buttons, and constrained choices.

• Supabase — stores parent accounts, kid profiles, learning progress, puzzle schedules, and parent settings.
• Vercel — hosts the site and may process standard server logs such as IP address, user agent, URL, and timestamp.
• Stripe — processes parent-paid subscriptions and customer billing portal access.
• AI coaching provider — may receive the chess position, age band, coach profile, and sanitized child display name when deterministic coaching is not enough.
• Voice provider — may receive approved coach text to generate Coach Pawn audio when voice is enabled.

These providers are used to operate ChessWhiz. They are not used for targeted advertising, selling children's data, or letting strangers contact children.

For children under 13, a parent or guardian must provide consent before ChessWhiz collects, uses, or discloses child personal information through parent-owned cloud progress, paid subscription features, parent emails, AI coaching, or voice. A paid Stripe checkout must be completed by a parent or guardian and provides transaction notice to the account holder.

Parents may consent to core collection and use needed to run ChessWhiz without consenting to optional features where they are not integral, such as parent digests or voice. If a parent withdraws consent, ChessWhiz may disable features that require the removed data.

Parents can ask to review the categories of child information we have, delete a child profile, refuse further collection or use, unsubscribe from parent emails, or withdraw consent by emailing hello@chesswhiz.com. We may need to verify that the requester is the parent or guardian for the child profile before disclosing or deleting data.

• Anonymous local play — local progress stays in the browser until the family clears site data. In-progress game resumes expire after 24 hours.
• Cloud kid profiles and progress — retained while the parent account is active because the coach needs it to adapt. Deleted within 30 days of a verified parent deletion request or account closure, except for backups and legal/security records.
• Coach runtime and safety logs — retained up to 90 days for debugging, safety review, and quality monitoring, then deleted or aggregated.
• Parent accounts and digest settings — retained while the parent account is active and deleted within 30 days of verified account deletion, except records needed for legal, tax, billing, fraud-prevention, or security purposes.
• Billing records — Stripe and ChessWhiz retain subscription and transaction records for the period required by law, tax, accounting, chargeback, and fraud-prevention obligations.
• Consent-not-completed contact data — if we collect parent contact information only to request consent and consent is not completed, we delete that contact data within 30 days.
• Backups — deleted data may remain in encrypted backups for up to 90 days before normal backup rotation removes it.

Parent dashboards require parent authentication. Child device IDs are scoped to gameplay and do not unlock parent billing or dashboard data. Internal coach/admin tools are blocked in production unless internal credentials are configured.

For anonymous play, clearing browser site data for chesswhiz.app removes local progress from that browser. For parent-saved progress, email us to request review or deletion of the remote kid profile and related parent-account data.

Questions or privacy requests? Email hello@chesswhiz.com.