CHESS ASSISTANT FOR CHESS.COM — STOCKFISH 19
PRIVACY POLICY
Last updated: 21 September 2026

SUMMARY
Chess Assistant analyses chess positions with the Stockfish 19 engine that is bundled inside the
extension. Those calculations run on your own computer. Chess Assistant is built specifically for
Chess.com: that is the only site it reads positions from. We do not collect your browsing history, we
include no advertising or analytics software, and we never sell data.

WHAT THE EXTENSION PROCESSES

1. Chess positions - processed locally only
   The board position is read from the page you have open and evaluated by the bundled engine inside the
   extension. Positions are never uploaded to us or to any third party.

2. Account data - email address and password
   Creating an account or signing in sends your email address and password once, over HTTPS, to
   Supabase Auth (our authentication provider). The extension never stores your password: on a
   successful sign-in the password field is cleared. Supabase keeps the account so that your free-move
   counter and your subscription can be tied to it.

3. Session data - stored on your device
   After signing in, the extension keeps the Supabase access token, refresh token, your user id and
   your email address in chrome.storage.local so that you stay signed in between browser restarts.
   Signing out deletes that data from your device.

4. Subscription data
   If you subscribe to Pro, our backend stores the subscription state against your account (plan,
   status, current period end and the Stripe customer and subscription identifiers). Payments are
   handled by Stripe: card details are entered on Stripe's own checkout page and are never seen,
   transmitted or stored by the extension or by our backend.

NETWORK CONNECTIONS
Engine analysis runs locally. The extension contacts its backend only for:
  * account sign-in, sign-out, session refresh and email confirmation (Supabase Auth);
  * reading your own subscription row and claiming a free assistant move (Supabase database);
  * starting Stripe Checkout or the Stripe billing portal (our backend creates the session, then you
    are taken to Stripe's own page).
Those requests go to our Supabase project over HTTPS. The extension requests no other hosts.

WHAT WE DO NOT DO
  * No keylogging: the extension installs no keyboard listeners.
  * We never store your password.
  * No browsing-history collection, no tracking and no cookie access.
  * No advertising, analytics or tracking SDKs.
  * No selling or renting of personal data.
  * Chess.com is the only supported site; the extension runs nowhere else.

DATA SHARING
  * Supabase - authentication, database and server functions (EU region).
  * Stripe - payment processing for Pro subscriptions.
We share nothing else with anyone, except where the law requires it.

RETENTION AND DELETION
Account data and subscription state are kept while your account exists. Signing out removes the copy
stored on your device immediately. To delete your account and the data held against it, contact us at
gratzmvm@gmail.com and we will remove it.

CHILDREN
The extension is not directed at children under 13.

CHANGES
We update this page when our practices change and revise the date above.

CONTACT
gratzmvm@gmail.com