Privacy Policy

We process the data an academy enters or connects in order to run its operations:

• Account data: names, email addresses, and roles of academy staff
• Student and guardian data entered by the academy: profiles, enrollment, attendance, notes, and contact details
• Chess data: linked Lichess or Chess.com identifiers, imported games, ratings, and engine analysis results
• Billing data: invoices, payment status, and receipts (card and bank details are handled by Razorpay or Stripe, not stored by ChessCore)
• Usage data: logs needed to operate, secure, and improve the service

Data is used to provide the service the academy signed up for: scheduling, attendance, billing, game analysis, reports, AI assistance, and communication with families. We do not sell personal data. AI processing is described in section 3.

Does AI chess software train on student data? Masking data before an AI request does not answer that question. ChessCore sends data to configured providers for inference; provider training use and retention depend on their contracts. We cannot verify a no-training guarantee from the product code and have not published those contract terms.

ChessCore's AI features work with the academy's own records, such as class notes, games, and progress. Before the copilot, report drafts, game reviews, and class summaries send text to an AI model, ChessCore replaces or shortens student and guardian names and removes email addresses, phone numbers, ID numbers, and dates. Two exceptions apply: selected-text rewriting sends the selected passage as is, and class transcription sends unmasked recorded audio to a speech-to-text provider. AI agents the academy connects through the ChessCore API or MCP server receive the records the academy authorises them to read.

Our AI providers are Google (Gemini, including through Google Cloud Vertex AI), Anthropic (Claude), and OpenAI. Speech-to-text for recorded classes runs on Google Gemini by default; ChessCore can instead use Sarvam AI, Microsoft Azure AI Speech, or Fireworks AI. These are processing integrations; they do not establish provider training or retention terms. Those terms are not published here.

Chess evaluations come from the Stockfish engine, and numbers in reports come from the database, not from a model. Messages the AI drafts for families wait for academy staff to review and send them, except class recaps when the academy switches on recap auto-publish. Routine messages the academy switches on, such as class and fee reminders, go out automatically as fixed templates with no AI-written text.

Most students on ChessCore are children. When a parent or guardian accepts this policy (when they set up their parent account, or when they submit a booking, enrollment, or registration form), they agree, for themselves and for each child linked to them, that the academy and ChessCore may:

• Use the child's class information to run classes: profile, date of birth, attendance, homework, games, ratings, progress, and coach notes
• Contact the parent by email, phone, SMS, or WhatsApp about classes, schedules, reminders, fees, receipts, progress, and academy announcements
• Use AI features on this information as described in section 3
• Link and import the child's Lichess or Chess.com games when the academy connects them

Recording a class on video is the one use that needs separate permission. An academy can record a child only after the parent has said yes to recordings for that child, and the parent can withdraw that permission at any time in the parent portal. A child's data is never used for advertising or sold.

Parents can mute any kind of message in the parent portal settings, or reply STOP to a WhatsApp message, and the academy will stop sending that kind of message. Receipts and invoices may still be sent because they are part of the service the parent is paying for.

Every academy's data is isolated from every other academy's, enforced at the database layer. Access is role-based, actions are audit-logged, data is encrypted in transit, and rating history is append-only so records cannot be silently rewritten.

Core student records remain in the academy account until deletion or erasure is requested. Copilot conversations are stored so staff can resume them; archiving hides a conversation without deleting it.

The code defaults remove in-app notifications after 180 days and support-chat mirror messages after 730 days. A support conversation is removed only after its retained messages are gone and its last activity is outside that window. These are configurable defaults, not guaranteed deletion deadlines or the support provider’s own retention terms.

Raw class recordings have a default retention of 30 days. Processed recordings move to cold storage after a default 30 days and become eligible for deletion 365 days after that move. Academy overrides, retention policies, keep flags and legal holds can change or suspend deletion. Background jobs perform the storage deletion.

Family erasure requires a person to complete it; a legal hold can block it. Personal details are anonymised first, and the remaining chess history becomes eligible for permanent deletion after a 30-day grace period. Records for a child still linked to another guardian are excluded from that purge. De-identified billing records, consent records and audit history remain.

The database backup configuration specifies encrypted storage and retention of 14 full backups. That count is not a verified 14-day retention window. The deployed backup schedule, expiry of erased data from backups and recovery commitments require confirmation from the service operator; no calendar-day backup guarantee is stated here.

We rely on a small set of processors to operate: payment providers (Razorpay, Stripe), communication channels (WhatsApp Business, email), the AI and speech-to-text providers named in section 3, chess platforms the academy connects (Lichess, Chess.com), and hosting infrastructure. Each receives only the data needed for its function.

On this public website (chesscore.io) we use Microsoft Clarity, and may use Google Analytics, to understand how visitors use the site: which pages are viewed, how people click and scroll, and session recordings of those interactions. These tools use cookies or similar technologies and process device and browser details and an approximate location derived from your IP address. Clarity masks text typed into form fields by default. This applies to the marketing website only, never to the student, guardian, or academy data inside the ChessCore product.

Microsoft and Google process this data under their own privacy statements (privacy.microsoft.com and policies.google.com/privacy). You can block these cookies in your browser settings without losing access to anything on the site.

Depending on where you live, including under India's DPDP Act and the EU's GDPR, you may have rights to access, correct, export, restrict, or delete your personal data, and to withdraw your agreement to this policy. Requests can be made through your academy or directly to us at privacy@chesscore.io, and we respond within the timelines the applicable law requires.

If this policy changes in a way that matters, we will notify academy owners by email and note the new date at the top of this page.