Privacy policy

Chessalto is operated by Vetrarbrautin ehf., Iceland, the controller of the personal data described in this policy. "Chessalto", "we", and "us" refer to Vetrarbrautin ehf.

For privacy questions or requests, email vetrarbrautin@vetrarbrautin.is.

We collect the following information when you use Chessalto:

• Account details. Your account ID, name, email address, profile image, and sign-in method. If you use Google, Google provides the basic profile and email details needed to create or find your account.
• Training records. Your timezone, preferences, Alto rating, placement results, puzzle attempts, answers, hints, solve times, review schedule, streaks, course progress, and opening practice progress.
• Games and analysis. PGN files you submit, public Chess.com or Lichess usernames you connect, imported game history and metadata, sync status, and saved engine analysis results.
• Support messages. Your email address and anything you send us when you ask for support or contact us.
• Technical data. Our hosting, authentication, database, and security providers may process IP address, browser, device, request, and diagnostic data when they deliver the service.

We use personal data to:

• create and secure your account;
• run training sessions and adapt reviews to your progress;
• import and analyse games you ask us to process;
• save your settings and keep the service working;
• measure reliability and understand which product features work;
• answer support requests and send service notices; and
• prevent abuse and comply with legal obligations.

Under EEA data protection law, we rely on performance of our contract for the core service, legitimate interests for security and limited product measurement, consent where we ask for it, and legal obligations where they apply. You can withdraw consent at any time without affecting earlier processing.

Clerk uses cookies that are needed to sign you in and keep your session secure. Chessalto also uses local storage for device preferences and some on-device training records.

Chessalto uses PostHog (hosted in the EU) and Vercel Analytics for product and traffic measurement. Neither sets a cookie or writes to local storage until you choose "Accept" in the cookie banner; with "Essential only", Vercel Analytics does not load and PostHog keeps nothing in your browser between page loads. Your choice is stored for one year in the chessalto-consent cookie, which is itself essential, and you can change it at any time from "Cookie preferences" in the footer or in Settings.

If PostHog is enabled, Chessalto records page views and selected events such as signing up, completing placement, or finishing a training queue. PostHog respects Do Not Track and is identified only with your Clerk account ID. Autocapture, surveys, and session recording are disabled.

With "Accept", Sentry can record a sample of browser sessions and sessions where an error occurs to help us reproduce problems. Text and input values are masked, media is blocked, and request and response bodies are not recorded. Choosing "Essential only" stops recording and discards any pending recording segment.

We use these providers to run Chessalto:

• Paddle processes web checkout, billing details, payments, tax, and invoices as merchant of record. Chessalto does not store your full card number or security code.
• RevenueCat processes an opaque account identifier and subscription records to keep paid access consistent across devices. We store subscription status, provider, product, renewal dates, and a management link in Convex.
• Clerk for authentication and account management.
• Convex for application data and server functions.
• Vercelfor web hosting and traffic analytics.
• PostHog for optional product analytics.
• Google, when you choose Google sign-in, and Chess.com or Lichess when you connect a public username or request a game import.
• Sentry for error reporting, performance tracing, and, with your consent, session recordings. Reports may include diagnostic information and your account ID so we can investigate failures. We do not attach your name or email to these reports.

We may also disclose information when the law requires it, to protect the service or a person from harm, or as part of a sale or reorganisation of Chessalto. We do not sell personal data.

Chessalto operates from Iceland, which is part of the EEA. Some providers may process data in other countries. When personal data leaves the EEA, we rely on the provider's legal safeguards, such as an adequacy decision, standard contractual clauses, or another approved transfer mechanism.

We keep account and training data while your account is active and for as long as we need it to provide Chessalto. You can delete your account in Settings. That removes your Clerk account and starts deletion of the user, training, game, analysis, and connection records stored by Chessalto.

Limited copies may remain for a short period in backups, security logs, or provider systems under their retention schedules. We may keep data longer where the law requires it or to resolve a dispute.

Depending on where you live, you may ask to access, correct, delete, restrict, or receive a portable copy of your personal data. You may also object to some processing and withdraw consent.

Email vetrarbrautin@vetrarbrautin.is to make a request. We may need to confirm your identity first. If you are in Iceland or the EEA, you can also complain to your local data protection authority, including Persónuvernd in Iceland.

A child who cannot lawfully consent to data processing on their own may use Chessalto only with permission and supervision from a parent or guardian. Contact us if you believe a child's data was provided without the required permission.

We use access controls, encrypted connections, and service providers with security measures designed to protect personal data. No online service can guarantee absolute security.

We may update this policy when Chessalto or the law changes. We will change the effective date and provide any notice the law requires.