Privacy Policy

ChessWoodie ("we", "our", or "the app") is a chess tactics training application designed to help users improve tactical pattern recognition using the Woodpecker Method. It has a permanent free tier and an optional paid Premium subscription.

Your privacy is important to us. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

1. Information We Collect

We collect only the information necessary to provide and improve the service.

a. Account Information

When you create an account or sign in, we collect:

• Your email address
• A username and display name
• A profile photo, if you upload one or your sign-in provider supplies one
• The sign-in methods on your account (email, Google, Lichess or Discord). For each one we store the account identifier that provider gives us, the email address it reported, and whether it confirmed that address as verified.

The address a sign-in method reports can differ from your account's main email address. We keep it with that method only, so we can show you which account each method belongs to.

You can also start as a guest without giving us any personal information. A guest account is a real account on our servers, identified only by this device. If you later sign in, your guest progress is moved into the account you sign in with and the guest account is deleted.

b. Usage & Training Data

We collect data related to your use of the app, including:

• Created courses and settings
• Puzzle attempts and results
• Training speed (e.g., puzzles per minute)
• Accuracy and cycle progress

This data is used to provide training functionality, progress tracking, analytics, and leaderboards.

c. Technical & Diagnostic Data

We may collect limited technical information such as:

• Device type, operating system, and browser or app version
• Error and performance reports, linked to your account ID but not to your name or email address
• The IP address a sign-in request comes from (see below)

This data helps us improve stability, performance, and user experience.

IP addresses. When you ask us to email you a sign-in code, we record the IP address the request came from. We use it only to limit how many sign-in emails can be requested, so the feature cannot be used to flood someone's inbox or guess codes. It is deleted automatically, together with the code, about a day after the code expires.

2. How We Use Your Information

We use collected information to:

• Provide core training features
• Track progress and analytics
• Enable leaderboards (where applicable)
• Authenticate users, keep accounts secure, and sync progress
• Monitor performance and fix issues
• Improve the app and user experience

We do not use your data for advertising, and we do not sell it.

3. Signing In and Linked Accounts

You can sign in with a code or link sent to your email address, or with Google, Lichess or Discord. From those providers we receive only basic profile information: an account identifier, your name or username, your email address and whether the provider has verified it, and a profile photo if you have one. We never receive your password for any of them.

Several methods, one account. You can add more than one sign-in method to your account from Settings, and remove any of them except the one you created the account with. We link a new method to an existing account only when you add it from that account, or when you prove you own the existing account by signing in to it. Two accounts having the same email address is never enough on its own to join them.

The one exception is email sign-in: if you prove you can receive email at the verified address of an existing account, by entering the code we send there, you are signed in to that account. This is also how you get back into your account if you lose access to your other sign-in methods.

Separate accounts. If you sign in with a method whose email address already belongs to another account, we ask whether to link it or keep a separate account. A separate account created this way has no main email address, so it will not receive training reminders until you add an address in Settings.

4. Emails We Send

Sign-in and account emails include sign-in codes and links, codes confirming a change of email address, a notice to your old address when your address changes, and a confirmation when your account is deleted. We send them only when they are needed to use or protect your account. They are sent even if you turn reminder emails off, and they carry no unsubscribe link, because opting out of them would lock you out of your own account.

Training reminders and similar messages are optional. Every one includes an unsubscribe link, and you can turn them off in Settings at any time.

5. Third-Party Services

ChessWoodie relies on the following services to operate. Each processes data only as necessary to provide its function and is subject to its own privacy policy.

• Sign-in providers (Google, Lichess, Discord): confirm your identity when you choose to sign in with them.
• Resend: delivers our emails, including sign-in codes and links. It receives your email address and the content of the message.
• Lemon Squeezy: processes Premium payments as our Merchant of Record. Your payment details go to Lemon Squeezy, never to us.
• PostHog: product analytics. When you are signed in it receives your account ID, name, email address and sign-in method, along with how you use the app, so we can understand which features help people train.
• Sentry: error monitoring. Error reports carry your account ID but not your name or email address, and our servers remove sign-in codes and tokens from them before they are sent.
• Fly.io and Cloudflare: hosting, our database, and storage for uploaded profile photos.

If you use Game Import, we also contact the chess platform you connected (Lichess or Chess.com) to read your finished games. Connecting a platform for game import is separate from how you sign in: signing in with Lichess does not give us access to your games, and connecting Lichess for game import does not make it a sign-in method. See Game Import below for what each connection involves.

6. Data Sharing

We do not sell, rent, or trade your personal data.

Your data may be shared only:

• With the services listed above, when required to operate the service
• When required by law

7. Data Retention

We retain your data only as long as necessary to provide the service.

Sign-in data is short-lived by design:

• The record of a sign-in in progress with Google, Lichess or Discord expires after 10 minutes.
• The one-time code that completes a sign-in in this app expires after 60 seconds, or 15 minutes while you are deciding whether to link two accounts.
• Email sign-in codes and links expire after 15 minutes.

Each of these, together with the IP address and any name it carries, is deleted automatically about a day after it expires.

When you delete your account, your personal data is removed from our systems immediately, except where we are required by law to keep it. Copies in our database backups disappear as those backups expire, within a few days. Payment records are kept by Lemon Squeezy as required for tax purposes, and analytics events already sent to PostHog are kept according to its retention settings. You can ask us to delete those analytics events by contacting us.

8. Game Import

If you connect a chess account, ChessWoodie can import your own completed games to turn tactics you missed into practice puzzles. Lichess and Chess.com are both supported, and the two connect differently, so this section covers each in turn.

a. How Each Account Is Connected

Lichess uses OAuth. You authorize ChessWoodie on Lichess itself, and we store the resulting access token in encrypted form so we can fetch your games on your behalf. You can revoke that authorization at any time, from Lichess or by unlinking in the app. Unlinking in the app also asks Lichess to revoke the token, so it stops working straight away rather than only being forgotten by us.

Chess.com uses no authorization at all. You give us your username, and we read your games through Chess.com's public Published Data API, which serves the same data any visitor can already see on your profile. We never ask for your Chess.com password, we are never granted access to your account, and there is no credential for us to store or for you to revoke. The only thing we keep is the username you entered.

b. What We Fetch

When you trigger an import, we fetch your own finished games from the platform you chose (moves and PGN data). Opponent name and rating are incidentally present in that game data, the same way they appear on the platform itself. Requesting your games necessarily tells that platform which username was asked for.

c. Why We Fetch It

We analyze your finished games only to find tactical positions you missed and turn them into puzzles for you to practice. This is post-game analysis of games that have already ended, never live assistance during a game in progress, and we never post or play on your behalf. On neither platform do we have the ability to do so.

d. Purpose Limitation

Imported game data is used solely to generate and serve your puzzles. We do not use it for any secondary purpose, and we do not build opponent profiles, scouting reports, or rating histories from your opponents' data.

e. Retention & Deletion

You can delete your imported games and generated puzzles at any time using the "Delete generated data" control in the app.

Unlinking an account removes that platform's imported games and generated puzzles automatically, and leaves anything imported from the other platform untouched. Deleting your ChessWoodie account (see Your Rights below) removes all of it, from every platform, and revokes the Lichess authorization in the same way.

9. Your Rights

Depending on where you live, you may have the right to access, correct, export, or delete your data, and to object to or restrict how we process it.

You can change your email address, sign-in methods and profile in Settings. You can delete your account at any time from Settings, Data & privacy, Delete account. Deletion is immediate and permanent, cancels any Premium subscription so you are not charged again, and revokes the access we were given by Lichess.

If you cannot sign in, you can also ask us to delete your account by following the instructions on our Account Deletion page:

10. Contact

If you have any questions about this Privacy Policy or your data, you can contact us at:

• Email: support@chesswoodie.com
• Website: https://www.chesswoodie.com