Privacy Policy

Effective date: 24 June 2026 · Last updated: 24 June 2026

This Privacy Policy explains how Chess Anatomy ("Chess Anatomy", "we", "us", or "our"), a service operated by Edgeway Software, collects, uses, shares, and protects personal data when you use our website at chess-anatomy.com and related services (the "Service"). We are the data controller for the personal data described below.

If you have questions about this policy or your data, contact us at support@edgewaysoft.com.

1. Information we collect

Information you provide

Account data: username, email address, and a securely hashed password (we never store your password in plain text).
Optional profile data: your Chess.com username, if you choose to provide it for game import.
Payment data: if you subscribe to a paid plan, your payment is processed by Stripe. We do not receive or store your full card number. We retain a Stripe customer identifier and your subscription status.
Support messages: the email address and message content you send us through the contact form.

Information generated through use

Chess and training data: games, moves, board positions, blunder history, study/blunder-deck progress, performance history, and your in-app playing and tactics ratings.
AI usage records: counts, timestamps, and token/cost metadata for AI coaching, game-review, and report requests, used to enforce plan quotas.
Activity logs: records of key actions (e.g. sign-up, login, subscription changes) for security and product analytics.
Technical data: your IP address, used transiently for security and rate limiting, and standard server logs.

2. How we use your information

To provide, operate, and maintain the Service and your account.
To deliver AI coaching, game reviews, and habit reports you request.
To process subscriptions, billing, renewals, and cancellations.
To enforce plan limits and prevent abuse, fraud, and automated attacks.
To send transactional emails (email verification, password reset, billing notices).
To respond to your support requests.
To comply with legal obligations and enforce our Terms of Service.

3. Legal bases for processing (EEA/UK users)

Performance of a contract — to provide the Service and process your subscription.
Legitimate interests — to secure the Service, prevent abuse, and improve the product.
Consent — where required, e.g. optional features; you may withdraw consent at any time.
Legal obligation — to meet accounting, tax, and other legal requirements.

4. How we share your information

We do not sell your personal data. We share data only with service providers ("subprocessors") that help us run the Service, under contractual confidentiality and data-protection obligations:

Provider	Purpose	Data shared
Stripe	Payment processing & subscription management	Email, billing details you enter with Stripe, subscription metadata
OpenRouter / DeepSeek	AI coaching, game review, and report generation	The chess positions, moves, and game context needed to produce the analysis you request
Amazon Web Services (AWS)	Hosting, database storage, and transactional email (SES / WorkMail)	All data above, stored and transmitted securely
Modal	Cloud GPU compute used to train your personality clone	The Chess.com username and clone name you supply, and the public games fetched for training
Lichess & Chess.com	Opening explorer and optional game import	Opening positions queried; your public Chess.com username when importing

Community clones: when a clone you train finishes successfully, it is listed in the in-app Community Clones browser, where other users can see your Chess Anatomy username, the clone's name, and its estimated rating, and can play against it. Super Clones are private and are never listed. Delete the clone (or your account) to remove the listing.

We may also disclose data if required by law, to protect our rights or users' safety, or in connection with a merger, acquisition, or sale of assets (with notice where required).

AI processing note: when you use an AI feature, the relevant game or position data is sent to our AI provider to generate your result. Please do not include sensitive personal information in free-text sent to AI features.

5. International transfers

Our infrastructure and providers are primarily located in the United States. Where we transfer personal data out of the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses.

6. Data retention

We retain your personal data for as long as your account is active. When you delete your account, your account record and all associated data (game history, training data, AI usage, activity logs) are permanently deleted from our primary database, except where we must retain limited records to meet legal, tax, or fraud-prevention obligations. Backups are rotated and purged on a regular cycle.

7. Your rights

Depending on where you live (including under the GDPR and CCPA/CPRA), you have rights to access, correct, delete, port, restrict, or object to the processing of your personal data, and to lodge a complaint with a supervisory authority. You can exercise the core rights directly in the app:

Access & portability: use Settings → GDPR & Privacy → Download Data to export everything we hold about you as a JSON file.
Deletion: use Settings → GDPR & Privacy → Delete Account to permanently erase your account and data.
For any other request, email support@edgewaysoft.com. We will not discriminate against you for exercising your rights.

8. Cookies & local storage

We use your browser's local storage to keep you signed in (an authentication token) and to remember your settings and progress. These are essential to the Service's functioning. We do not currently use third-party advertising or cross-site tracking cookies. If this changes, we will update this policy and obtain consent where required.

9. Security

We protect your data with measures including TLS encryption in transit, bcrypt password hashing, scoped authentication tokens, rate limiting, and least-privilege access. No method of transmission or storage is 100% secure, but we work to protect your data and review our practices regularly.

10. Children's privacy

The Service is not directed to children under 13 (or under 16 in the EEA), and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. Material changes will be posted here with an updated effective date and, where appropriate, notified by email.

12. Contact us

Edgeway Software — Chess Anatomy
Email: support@edgewaysoft.com
Postal address: Edgeway Software, 160 Greentree Dr, Suite 101, Dover, DE 19904, USA