Privacy Policy

Last updated: 27 July 2026

This policy explains how Strong Squares handles personal data when you use strongsquares.com: the chess training app (the "Service"). We collect very little, we do not sell it, and we say plainly below what never leaves your device. This policy forms part of our Terms of Service.

1. Who is responsible

The data controller is Berg Capital ehf., Seltjarnarnes, Iceland, trading as Strong Squares. For anything in this policy, write to privacy@strongsquares.com.

2. What we collect

• Account email and authentication. If you create an account, we store your email address. Password and Google authentication sessions are handled by our authentication provider.
• Learning progress and settings. Your course progress, puzzle results, ratings, and app settings are synced to our database so they follow you across devices.
• Optional communication settings. If you enable learning reminders, we store whether push and email are enabled, delivery history, suppression state, and a device messaging token. Message bodies and provider credentials are not stored in the analytics system.
• Optional measurement data. If you allow product reports, we process limited product events and technical errors. If you separately allow advertising measurement, advertising providers may process campaign and conversion data, browser or device identifiers, advertising cookies, and consented customer data used for features such as enhanced conversions or remarketing. We do not send chess moves, study text, answers, or private coaching records to advertising providers.
• Optional coaching records. Adult learners who deliberately connect one trusted person store the relationship, assignments, messages, shared positions, safety reports and coaching notes described in Section 12A.
• Local preferences. Some preferences (for example, board and sound settings) are stored only in your browser's local storage and stay on your device.

You can explore the free portion of the Service without an account, in which case we hold no account data about you at all.

3. What we do not collect

• No payment card data. Payments are handled by Polar as Merchant of Record. Polar processes your payment details; we never see or store your card number.
• No precise location data.
• No sale or rental of personal data.
• No advertisements inside Strong Squares. Optional advertising measurement does not place third-party advertisements in the academy.
• No advertising data without permission. Advertising storage, user-data sharing, personalisation, enhanced conversions, and remarketing remain denied unless you make a separate affirmative advertising choice.

4. How we use your data

We use your data to run the Service: to authenticate you, sync your progress and settings, provide coaching features you deliberately connect, respond to reports, process purchases, and send essential service emails. If you enable learning reminders, we use your channel choices and delivery records to send only eligible messages and enforce caps, suppression and unsubscribe choices. If you consent to product reports, we use limited usage and error data to understand and repair the Service. If you separately consent to advertising measurement, we may use advertising data to measure which campaigns lead to useful learning actions, improve campaign bidding, create consented remarketing audiences, and personalise advertising outside Strong Squares. We do not use private learning content for those purposes.

5. Legal bases (EEA/UK)

Where the GDPR applies, we process your data on the basis of: performance of a contract (providing the Service you signed up for) and legitimate interests (keeping the Service secure). For optional product analytics, error monitoring, advertising measurement, enhanced conversions, remarketing, and ads personalisation, we rely on your consent. Product-report consent and advertising consent are separate choices. You can decline either and withdraw either at any time in the academy settings or through the privacy choices on this page.

6. Where your data lives

Our database and authentication are hosted on Supabase in the European Union. The website itself is delivered through our hosting provider. Optional product and advertising providers may process data outside Iceland or the EEA under their contractual transfer mechanisms and applicable safeguards. Product and error reports exclude your chess moves, study text and private coaching records. Any transfers by our subprocessors' own subprocessors are governed by their data processing agreements and applicable safeguards.

7. Subprocessors

Current subprocessors:

• Supabase: database and authentication (EU region).
• Website hosting provider: delivery, security logs and anonymous technical error reports, with optional reports used only after consent.
• PostHog EU: consented, limited product events with autocapture and session replay disabled.
• Sentry: consented technical error reports with session replay, performance tracing and default personal information disabled.

Other subprocessors:

• Polar: payments, as Merchant of Record.
• Resend: transactional and optional learning email.
• Google Firebase Cloud Messaging: optional push delivery.

If advertising measurement is enabled, the relevant advertising providers, such as Google Ads or Meta, process only data covered by your advertising consent and their published terms. A provider is not activated merely because it is named here.

We will update this policy before adding a subprocessor that processes your personal data.

8. Cookies and local storage

The Service uses essential local storage for preferences, progress before sign-in, authentication sessions, and your consent record. Product analytics storage is used only if you allow product reports. Advertising cookies or similar storage are used only if you separately allow advertising measurement. Our Google Consent Mode v2 defaults are denied for analytics_storage, ad_storage, ad_user_data, and ad_personalization, then update to reflect your choices. Withdrawing advertising consent returns the advertising signals to denied for future activity.

Review privacy choices

9. Retention

We keep your account data for as long as your account exists. Consent records and limited measurement data are retained only as long as needed for compliance, security, attribution and reporting, subject to the configured provider retention periods. If you ask us to delete your account, we delete your personal data under our control; residual copies in encrypted backups are removed according to our hosting providers' backup schedules. Data stored only in your browser is under your control and can be cleared through your browser settings.

10. Your rights

Where the GDPR or similar laws apply, you have the right to access your data, to have it rectified or erased, to receive it in a portable format, and to object to certain processing. To exercise any of these rights, email privacy@strongsquares.com; we will respond within the time the law allows. Deleting your account deletes your personal data as described in Section 9.

11. Security

We protect your data with encryption in transit (TLS), row-level security in our database so accounts can only reach their own data, and least-privilege access to our infrastructure. No system is perfectly secure, but we design for the smallest possible exposure: starting by collecting little in the first place.

12. Children

The Service is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will delete it.

12A. Trusted coaching

An adult learner may create a private, high-entropy, expiring invitation for one known family member or coach. Under-18 coaching remains unavailable until verified guardian approval exists. The invited person can see only aggregate counts for guided sessions, recorded attempts and due items. They cannot open the learner's answers, mistakes, response timings or raw learner model. There is no public directory, search, follower count, or contact from strangers.

Assignments, questions and shared positions are visible only to the linked learner and coach. A coach may keep notes explicitly marked private. Either person can remove the relationship immediately or report a safety concern. Removing the relationship ends future summary access. Account deletion removes the relationship and its stored coaching records through database cascading.

13. Complaints

If you believe we have mishandled your data, please contact us first: we want to put it right. You also have the right to lodge a complaint with a supervisory authority, in our case Persónuvernd, the Icelandic Data Protection Authority, or with the authority in your own country.

14. Changes to this policy

If we change this policy in any material way, we will post the updated version here and, where the change matters to you, notify you by email or through the Service before it takes effect.

15. Contact

Privacy questions and rights requests: privacy@strongsquares.com. General questions: support@strongsquares.com.

We're a human company: there are no support tickets or robots to answer you. That means genuinely good, personal customer service; it also means it may take us a day or two to get back to you.