Privacy at Arvo Chess

Playing without an account

Guest tactics, First Moves discoveries and local practice games stay in the open page’s memory. Refreshing starts a new visit. Your optional chess-piece style is stored in this browser so it can survive a refresh; clear this site’s browser data to remove that setting. It contains only a style choice, not account information or learning progress. Optional computer matches run on your device with approximate difficulty targets; they do not update a player rating or send match moves to an opponent service. Opening the site still sends ordinary web requests to our hosting provider.

Adult accounts and saved chess records

Supabase handles account email, password verification and sessions. Arvo Chess does not retain plaintext passwords in its application database or logs.

Signed-in adult tactics save account identifiers, adult-use acknowledgment, challenge commands, attempts, awards and progress. Guest progress does not transfer. When you use saved First Moves, we store the lesson version, completed discoveries, and records of successful saves. These follow the existing account lifetime, export and deletion handling. Incorrect discovery answers are not retained. First Moves otherwise lasts for the current visit. Local practice games are not saved to accounts.

Manual game imports save canonical chess moves, starting positions, results and processing permission. The normal import removes original player names, sites, dates, comments, variations and filenames before saving. Only upload games you are authorized to process.

Optional Chess.com practice reviews

Adults can request a review of their own public Chess.com profile. Arvo Chess fetches up to 50 recent eligible standard-chess games through Chess.com’s public API. Your username, permission acknowledgment, normalized chess records, analysis and practice progress are stored privately with your account. Never enter a Chess.com password.

Stockfish runs in a temporary Vercel Sandbox. Only chess positions and bounded engine instructions enter the worker; account passwords and session tokens do not. Engine-generated practice candidates have not received instructional review and cannot guarantee a rating increase.

Source snapshots expire within 24 hours. Saved reviews and their practice progress expire after 30 days. Minimal deletion markers remain for 90 days to prevent restoration from reactivating deleted reviews. Review export and deletion require your account password. This does not delete your Chess.com history or your Arvo Chess account; provider backup expiry remains under review.

Daily streaks

Signed-in adult accounts save a daily practice counter: the last qualifying UTC date and consecutive-day count. Correct saved tactics and supported personalized practice moves count; visits, guest play, First Moves and computer matches do not yet count. The counter follows the existing adult account/progress lifetime and is included in account JSON exports. Deleting a review does not erase this separate account-level counter. No additional chess history is retained for streaks.

Cookies and service logs

Sign-in uses essential session cookies. Sign out through My account on a shared device; clearing browser cookies does not delete saved account records.

Application logs record request identifiers, routes, status and timing for operation and troubleshooting. They exclude passwords, tokens and raw game content. Hosting and authentication providers may also process network information, such as IP addresses, for their services and security. Provider log access and retention still need final review.

Service providers

Vercel hosts the website and artwork. Supabase provides adult authentication and private database storage. If Google sign-in is configured and you choose it, Google and Supabase handle basic sign-in identity information; Arvo Chess does not save Google API tokens in its learning data.

• Vercel privacy notice (opens in a new tab)
• Supabase privacy notice (opens in a new tab)
• Google privacy notice (opens in a new tab)

The current app has no active advertising, third-party analytics, payments or private-game engine processing integration.

Exports, retention and deletion

Signed-in adults can request the existing JSON/PGN export after password reauthentication. Google-only accounts without a password cannot use that export flow yet.

Saved adult records currently follow the account’s lifetime. A final retention schedule, deletion timeframes and verified provider/backup expiry are not yet established. Self-service account deletion is not available in this preview.

Junior and children’s information

Account features are for adults. Junior is an appearance preview, not a child account or parental-consent system. Do not create an adult account for a child or submit children’s personal information. Child accounts require separate protections and qualified legal review before launch.

Privacy questions and requests

A dedicated privacy contact and operator details have not yet been published for this preview. A working request channel, reviewed notice and deletion process remain prerequisites for a broader account launch. Do not submit sensitive personal information while these arrangements are incomplete.