Privacy Policy

Last updated: 26 July 2026

This policy explains how Strong Squares handles personal data when you use strongsquares.com: the chess training app (the "Service"). We collect very little, we do not sell it, and we say plainly below what never leaves your device. This policy forms part of our Terms of Service.

1. Who is responsible

The data controller is Strong Squares, Reykjavík, Iceland. For anything in this policy, write to privacy@strongsquares.com.

2. What we collect

• Account email. If you create an account, we store the email address you sign up with, and your authentication credentials are handled by our authentication provider (passwords are stored only in securely hashed form).
• Learning progress and settings. Your course progress, puzzle results, ratings, and app settings are synced to our database so they follow you across devices.
• Local preferences. Some preferences (for example, board and sound settings) are stored only in your browser's local storage and stay on your device.

You can explore the free portion of the Service without an account, in which case we hold no account data about you at all.

3. What we do not collect

• No payment card data. When payments launch, they will be handled by Polar as Merchant of Record. Polar processes your payment details; we never see or store your card number.
• No precise location data.
• No sale or rental of personal data, and no third-party advertising or ad tracking of any kind.

4. How we use your data

We use your data to run the Service: to authenticate you, to sync your progress, ratings and settings, to respond when you contact us or report an issue, and to send essential service emails (for example, password resets). If you consent to analytics, we also use usage and error data to understand how the Service is used and to fix problems. We do not use your data for advertising.

5. Legal bases (EEA/UK)

Where the GDPR applies, we process your data on the basis of: performance of a contract (providing the Service you signed up for) and legitimate interests (keeping the Service secure and improving it). For optional product analytics and error monitoring, we rely on your consent, which you give or decline in the cookie banner and can withdraw at any time.

6. Where your data lives

Our database and authentication are hosted on Supabase in the European Union when cloud accounts are enabled. The website itself is delivered through our hosting provider. If you consent to anonymous error reporting, a small technical report is written to first-party hosting logs. It excludes your name, email, chess moves and study history. Any transfers by our subprocessors' own subprocessors are governed by their data processing agreements and applicable safeguards.

7. Subprocessors

Current subprocessors:

• Supabase: database and authentication (EU region).
• Resend: delivery of transactional email (account confirmation, password resets, receipts).
• Website hosting provider: delivery, security logs and anonymous technical error reports, with optional reports used only after consent.
• Google: only if you choose “Continue with Google”, which uses Google as your sign-in identity provider.

Future subprocessors, as the Service grows:

• Polar: payments, as Merchant of Record, when payments launch.

We will update this policy before adding a subprocessor that processes your personal data.

8. Cookies and local storage

The Service uses essential local storage for your preferences and an authentication session so you stay signed in. Your error-reporting choice is also stored locally. Anonymous technical reports are sent only if you allow them. We do not set advertising or third-party analytics cookies.

9. Retention

We keep your account data for as long as your account exists. If you ask us to delete your account, we delete your personal data; residual copies in encrypted backups are removed according to our hosting providers' backup schedules. Data stored only in your browser is under your control and can be cleared through your browser settings.

10. Your rights

Where the GDPR or similar laws apply, you have the right to access your data, to have it rectified or erased, to receive it in a portable format, and to object to certain processing. To exercise any of these rights, email privacy@strongsquares.com; we will respond within the time the law allows. Deleting your account deletes your personal data as described in Section 9.

11. Security

We protect your data with encryption in transit (TLS), row-level security in our database so accounts can only reach their own data, and least-privilege access to our infrastructure. No system is perfectly secure, but we design for the smallest possible exposure: starting by collecting little in the first place.

12. Children

The Service is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will delete it.

12A. Trusted coaching

A learner may create a private, expiring invitation for one known family member or coach. The learner must be old enough to consent or have permission from a parent or legal guardian. The invited person can see only the learner's course progress, learner summary and guided-study history. There is no public directory, search, follower count, or contact from strangers.

Assignments, questions, shared positions and coaching notes are visible only to the linked learner and coach, except that a coach may keep notes explicitly marked private. Either person can remove the relationship immediately. Removing it ends future access to learning data. Account deletion removes the relationship and its stored coaching records through database cascading.

13. Complaints

If you believe we have mishandled your data, please contact us first: we want to put it right. You also have the right to lodge a complaint with a supervisory authority, in our case Persónuvernd, the Icelandic Data Protection Authority, or with the authority in your own country.

14. Changes to this policy

If we change this policy in any material way, we will post the updated version here and, where the change matters to you, notify you by email or through the Service before it takes effect.

15. Contact

Privacy questions and rights requests: privacy@strongsquares.com. General questions: support@strongsquares.com.

We're a human company: there are no support tickets or robots to answer you. That means genuinely good, personal customer service; it also means it may take us a day or two to get back to you.