Chessruto · Last updated 24 October 2026

Privacy policy

How Chessruto collects, uses and protects your personal information when you use Chessruto. We handle it under the Australian Privacy Act 1988 and the Australian Privacy Principles, and give the rights in the EU and UK GDPR to everyone, wherever they live.

What we collect

Account details: your email address, a securely hashed password, and when you accepted these policies.
Training data: the positions you attempt, whether you solved them, hints used, threat-check answers and your review schedule.
Chess.com data: the Chess.com username you connect and the public games we fetch for it, with the lessons and analyses we build from them.
Billing details: your plan, subscription status and Stripe customer reference. Card details go directly to Stripe; we never see or store them.
Usage and technical data: sign-ins, a few product events (such as finishing a lesson or subscribing), error reports, and server logs including IP addresses, kept for security.

Board and sound preferences are stored only in your browser. We use only essential cookies: one for your session, one for security (CSRF) and one that tells the site you are signed in. There are no advertising or third-party tracking cookies.

How we use it

To provide the service: your account, lessons, progress, review queue and analyses (performance of our contract with you).
To take payments and manage subscriptions (contract, and legal obligations such as tax records).
To send account emails such as verification and password resets, and notices about your subscription or these policies. We do not send marketing email without your consent.
To keep the service secure, prevent abuse and fix errors, and to understand in aggregate which features help (our legitimate interests).

We do not sell your personal information or use it for advertising.

Who we share it with

Service providers that process data for us, under contracts that require them to protect it:

Stripe for payments and invoices.
Resend to deliver account emails.
Railway (application servers and database) and Netlify (website hosting).
Sentry for error reports, if enabled.

Some of these providers store data outside Australia, including in the United States and the European Union. We take reasonable steps so that they handle it consistently with the Australian Privacy Principles. We may also disclose information when the law requires it.

How long we keep it

We keep your data while your account is open. When you delete your account, we delete your personal information immediately from our application database; copies in encrypted backups expire within 30 days. We keep billing records that tax law requires (in Australia, five years), which Stripe holds.

Your rights

Access and portability: download your data at any time from Settings → Your data.
Correction: change your Chess.com username on the Connect Chess.com page, or contact us to correct anything else, such as your email address.
Deletion: delete your account from Settings.
Objection and restriction: contact us about any processing based on our legitimate interests.

If you are unhappy with how we handled your information, contact us first. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in the EU or UK, your local data protection authority.

Children

The service is not intended for children under 13, and we do not knowingly collect their information.

Security

Data is encrypted in transit, passwords are hashed, access to production systems is restricted, and the analysis engine is only reachable from our own servers.

Contact

Questions about this page: support@chessruto.com. Chessruto operates Chessruto.