Privacy & Cookies

ChessGrains is a chess tactics and review application with spaced repetition. For privacy questions, contact us at hello@chessgrains.com.

• Account data: email address and optional display username, stored in Supabase Auth and our users profile table.
• Authentication secrets: passwords and OAuth tokens are handled by Supabase Auth. We do not store plaintext passwords in our own database.
• Linked Lichess username: used only to request your public games from the Lichess API under their policies, with an identifiable User-Agent.
• Game library: PGN text and metadata for games you sync from Lichess or import yourself, stored in user_library_games.
• Training data: flashcards, SRS schedules, notes, deck preferences, and community posts or upvotes you create.

We do not sell your personal data.

ChessGrains uses strictly necessary cookies for Supabase session authentication. No advertising or analytics cookies are set by default.

Clearing cookies in your browser will sign you out.

• Supabase— authentication, transactional email delivery (via Supabase's native Resend integration), and PostgreSQL hosting (region per your project settings).
• Vercel — application hosting and serverless function execution. Vercel may retain short-term request and function logs for operational purposes.
• Cloudflare — DNS for chessgrains.com and inbound email routing for our hello@chessgrains.com address (which forwards to a maintainer mailbox; we do not host an inbox at Cloudflare).
• Stripe — payment processing for Pro subscriptions. Stripe receives your email address, billing details you enter at checkout, and your card details. We never see or store card numbers ourselves. Stripe processes payments under its own privacy policy.
• Lichess — when you link an account, we read your public game archive per Lichess API rules.

Depending on your jurisdiction, you may have rights to access, correct, export, or delete personal data. You can update your profile and unlink Lichess in Settings → Account.

To delete your account and associated training data, contact the maintainers with the email address you used to register. We will request deletion of your auth user and application rows subject to Supabase and backup retention limits. Some anonymised aggregates may remain where the law allows.

See also the full list on our Licenses page.

• Stockfish (GPLv3) — in-browser engine via WebAssembly.
• Lichess puzzle database (CC0).
• chess.js (BSD-2) and react-chessboard (MIT, © 2022 Ryan Gregory).
• Algorithm SM-2 spaced repetition — see Licenses for SuperMemo World attribution (© SuperMemo World, 1991).

ChessGrains is an independent tool and is not affiliated with or endorsed by Lichess.org, the Stockfish team, or SuperMemo World.

If we make material changes to this notice we will update the date above.