Privacy Policy

Who handles your information

Team 42 L.L.C-FZ operates chessboard.plus. We handle account, security and service-administration data as controller. For student records supplied by a coach or academy, we generally process data on its instructions; the coach or academy is responsible for its teaching purposes and privacy notice. This distinction does not remove our own legal obligations.

Operator: Team 42 L.L.C-FZ
Business address: Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
Registration: United Arab Emirates · Licence 2532588.01
Contact: hello@chessboard.plus

Information we process

Account information: coach name, verified email, sign-in identifiers, protected password credentials where used, membership details, agreement versions and email preferences. Google sign-in, when enabled and chosen, supplies an account identifier, email and name.
Student and lesson information: names entered by a coach, optional student photographs, class links and schedules, lesson boards, moves, puzzles, drawings, notes and progress. A student can participate through a class link without buying a membership or creating a coach account.
Connected chess accounts: usernames, ratings, profiles and games imported from Chess.com or Lichess when a coach connects them. Public information can become personal information when linked to a student. Authorised Lichess connections also use access tokens, which are stored encrypted.
Live communications: camera, microphone and connection information when you use those features. Camera and microphone access depends on browser permissions. Classroom history is saved; we do not provide or store recordings of live audio or video calls. Other participants may use tools outside our control, so discuss any recording with your coach.
Technical and support information: session identifiers, network addresses and connection/security information, browser and device details, and messages or bug reports you send. A bug report can include classroom context and screenshots or files you choose to attach.
Payments: subscription, transaction and billing details needed to administer a purchase when payments are enabled. The checkout identifies the payment provider and information it collects. Do not send full payment-card details to support.
Website statistics: aggregate public-page traffic and reliability totals, approximate countries, referring website domains, broad device, browser and operating-system categories, and preferred languages from ordinary request headers. Separate business totals come from our account and billing records. Website statistics do not contain visitor identifiers, IP addresses or individual browsing histories.

How and why we use information

We use information to sign you in, operate classrooms, save lessons, connect chess profiles, administer subscriptions, provide support and keep the service secure. Board-scanning images are sent to our server for local automated recognition; the scanner does not send them to an external AI service or save the original as a lesson attachment.

Where data-protection law requires a lawful basis, we rely on performance of our agreement for account and paid-service administration; legitimate interests, where permitted by applicable law, for proportionate security, fraud prevention, support and basic service statistics; legal obligations for required records and responses; and consent for optional promotional email and other activities that require it. A coach must identify an appropriate basis for student data; our contract with a coach is not automatically a lawful basis for every use of a child’s information.

We do not sell student records or use them for targeted advertising. The classroom does not include an advertising or third-party analytics SDK. We do not use private student material to train general-purpose AI models. Local chess engines and board-recognition models process inputs to provide their requested features. We do not make decisions with legal or similarly significant effects about you solely through automated processing.

Website statistics

We count requests for public pages on our own server to understand how the website is used and whether it responds reliably. We store daily and hourly traffic totals and separate breakdowns by public page, approximate country, referring website, broad device, browser, operating system and preferred language. These categories come from ordinary request headers. We do not use tracking cookies, visitor IDs, device fingerprints or individual browsing histories, and we do not combine these breakdowns to identify visitors.

For country estimates, the server briefly uses the request’s IP address with a local country database; it does not send the IP address to a geolocation service or retain it in website statistics. For referring websites, we keep only the registered domain, never the referring URL’s path, query or fragment. We do not record private classroom links, student records, private account pages, full user-agent strings or URL query strings in these statistics. Missing categories are shown as unknown. Location and device estimates can be affected by VPNs, proxies and browser privacy settings. Counts are page views, not unique people; refreshes count again and some automated requests may be included.

Public-page reliability totals describe server response times and unsuccessful public-page requests. They do not record browser interactions or classroom activity. Registration, trial and billing totals are calculated from our existing account and billing records. We keep business totals separate from browsing counts and do not attribute an account or payment to a visit or country. Hosting, connection and security logs are separate operational records and may contain network addresses as described elsewhere in this notice. We do not use Google Analytics or advertising trackers.

Your statistics preference

Page views from this browser are included.

You can exclude future public-page requests from this browser using the button above. We save only a fixed opt-out value in a preference cookie, with no unique identifier. The choice applies to this browser on this website, not automatically to other devices or browsers. Clearing cookies removes the saved choice. It does not delete past aggregate counts, which cannot be linked back to you, or stop necessary account, billing, security or service records. We also exclude requests that send Do Not Track or Global Privacy Control.

Children and student privacy

A note for students: your coach can see your name, lesson work and information they add to your profile. People in your classroom can see what you share there. Your camera and microphone are your choice. Ask your parent or coach if you are unsure about sharing something, and ask us for help if something makes you uncomfortable.

Parents and guardians can contact us or the coach to ask what information is held, request access or deletion, or raise a concern. The coach should share this notice before adding student data and explain its own practices. We do not send promotional emails to student participants.

Adult coach accounts are separate from student participation. Where a child’s use requires verifiable parental consent, that consent must be obtained before the relevant collection or participation. Creating a coach account or ticking the Terms box does not supply that consent. School authorisation is used only where the relevant law permits it; an independent coach is not automatically authorised to consent in a parent’s place. Contact us before using the service with a child if the required authorisation has not been established.

If you think information about a child was collected without the required permission, contact hello@chessboard.plus. We will investigate and take appropriate steps, which may include restricting access and deleting information. Provide only the details necessary to locate the record.

Classroom participants receive the content you share with them. Coaches and authorised academy staff can access the student and lesson records they manage. Classroom links should be treated as private invitations. We do not publish private student profiles or lessons as a public directory.

Provider or recipient	Purpose and information
Hostinger	Hosts our application and database in Frankfurt, Germany; processes the service information described above.
Cloudflare R2	Stores offsite backups of service information, with the backup bucket currently located in its Eastern Europe region.
Cloudflare, when used for TURN relay	Helps establish classroom calls and relays encrypted media or data when a direct connection is unavailable; connection metadata may include network addresses.
Resend, for email delivery	Delivers sign-in, recovery and essential billing or service messages and, when enabled, promotional emails you choose to receive; processes your email address and message content.
Google, when Google sign-in is chosen	Authenticates the account. Some connection configurations may also use Google STUN to establish a peer connection.
Lichess and Chess.com, when connected	Provide the profiles, games or authorised live-play functions you request. These services also apply their own privacy policies.
Payment provider identified at checkout	Processes payments when enabled. Only the provider actually offered at checkout receives payment information.

Authorised staff and advisers may access information as needed for support, security, accounting or legal obligations. We may disclose information when legally required, to protect people and the service, or as part of a business transfer subject to appropriate safeguards and notice. We do not give every provider all categories of information.

International processing

Our main hosting location is Frankfurt, Germany. Providers and support operations may process information in other countries, including the United States. Laws there may differ from those where you live.

Where applicable law requires safeguards for an international transfer, we use an appropriate mechanism, such as an adequacy decision or contractual safeguards. UK and EEA transfers may require the relevant standard contractual clauses and UK addendum. Contact us for information about the safeguards applicable to your data or a copy, subject to necessary confidentiality protections.

How long information is kept

Account and teaching records are kept while needed to provide the service and retain your saved work. Trial expiry or cancellation alone does not delete lessons. Request closure, export or deletion when you no longer want us to hold them.
Temporary guest classrooms are eligible for removal after their 24-hour retention period. An account with an active trial or paid membership may claim an eligible guest classroom before it is removed.
Sign-in codes expire after ten minutes. Used challenges are removed; expired challenges are cleared as part of subsequent sign-in processing. Registered-account sessions normally expire after 90 days. Temporary OAuth state has a short expiry.
We retain 730 days of aggregate traffic and reliability totals; older totals are removed the next time statistics are recorded or viewed. The account and billing records used for business totals follow their existing retention periods.
Connection diagnostics, security records and support reports are kept for their operational purpose and any applicable legal or dispute period. We assess necessity when responding to a deletion request; these records are not promised to disappear immediately when you sign out.
Agreement and preference records are kept where needed to demonstrate choices and comply with obligations. After unsubscribe, a limited suppression record prevents further promotions unless you give a fresh opt-in.
To enforce the single-trial policy, we retain a hash of the verified email address and the trial-redemption date, including after account deletion. This limited record is used for trial eligibility, not promotional email. Contact us with questions or requests about that record.
A deletion request may leave restricted copies in backups until they are replaced or removed, and records that must be retained by law. We explain material exceptions when responding.

Cookies and browser storage

We use cookies and browser storage for sign-in, security, classroom connections, recovery and settings. Website statistics do not use tracking cookies or visitor identifiers. If you opt out, a preference cookie remembers that choice. Storage includes:

Storage	Purpose	Duration
cbp_statistics	Stores the fixed value “off” when you choose to exclude this browser from website statistics; contains no unique identifier.	Up to one year; cleared if you reset this preference or clear cookies.
cbp_session	Coach authentication.	Normally up to 90 days for registered accounts or 24 hours for guests; cleared at logout.
cbp_guest_claim	Associate a temporary guest classroom with its browser.	Up to 24 hours.
cbp_google_oauth	Protect an in-progress OAuth sign-in.	Up to ten minutes; cleared when sign-in completes.
cbp_google_signup	Securely complete a new account after Google sign-in.	Up to ten minutes; cleared when signup completes.
Administrator session cookie	Separate authentication for site administrators.	Session expiry or logout.
Local storage	Display and media preferences, classroom recovery and reconnect information.	Until replaced, cleared by the app or removed from your browser; some entries have their own expiry.
Session storage	In-progress sign-in details, codes’ challenge identifiers and classroom state.	Until cleared by the app or the browser session ends.
IndexedDB	Classroom snapshots and pending actions for recovery after a connection interruption.	Until released, replaced or cleared by the app or your browser.

You can clear browser storage or block cookies in your browser settings, but sign-in and classroom recovery may stop working. We do not add advertising or website-tracking cookies.

Email choices

Promotional news, tips and offers are optional. An unchecked checkbox lets adult account holders choose them separately from Terms acceptance. We keep a record of the choice and the wording shown. Existing accounts are not automatically subscribed, and signing in again does not restore an opt-in you withdrew.

Change your choice in My account or use the unsubscribe link in a promotional email. Unsubscribing is free, requires no sign-in, and stops future promotional sends once processed. Our unsubscribe flow updates the preference immediately. Essential sign-in, billing, security and service messages continue where necessary; they are kept separate from promotions.

Your information and rights

Contact hello@chessboard.plus to request access, a copy, correction or deletion of your information, or to object to or restrict a use. You can also withdraw optional consent. We may need proportionate information to verify your identity or authority. Do not send a password, payment-card details or a child’s identity document in an initial email.

Depending on the law and circumstances, rights include portability, an explanation of our processing, and review or appeal of a refused request. We aim to respond within one month and meet any shorter applicable deadline. If an extension or exception applies, we will explain it. You will not be penalised for making a legitimate privacy request. Withdrawal of consent does not retrospectively invalidate earlier lawful processing.

For records controlled by a coach or academy, you may contact that organisation directly. If you contact us, we will assist and refer the request as appropriate. You may complain to the relevant data-protection authority; UK users can contact the Information Commissioner’s Office at ico.org.uk. You can contact your local regulator without first complaining to us.

Security and updates

We use access controls, protected connections, limited access and other safeguards appropriate to the service. No online service can promise absolute security. Protect your account, keep classroom links private and tell us promptly if you suspect misuse.

We update this notice when our practices or obligations change. Material changes are communicated through the service or by email, and new consent is requested where required.

Privacy and safety enquiries: hello@chessboard.plus.