Privacy policy

The website — chessmasti.com

What we store

• Account: email, a bcrypt hash of your password (we never see the plaintext), and a Google account ID if you sign in with Google. Account data lives in Google Firestore.
• Saved games and preferences: PGNs you save, coaching-tone preference, playing style, study goals, favorite openings, and board/piece-set choices. Tied to your account in Firestore.
• Saved chats: when you choose to save a coaching chat, its chat record, related game reference, and user and assistant message content are stored with your account in Firestore so you can reopen the conversation.
• Session cookie (cm_session): a signed JWT in an httpOnly cookie. Used only to keep you signed in.

What we send to third parties

• Anthropic Claude and OpenAI: Anthropic normally processes AI coaching requests. OpenAI may process the same request if Anthropic fails or if OpenAI is the configured provider. The request can include the position (FEN), relevant PGN, coaching query and chat messages, ratings, Chess.com or Lichess usernames, the coach personality you have selected, and the coaching preferences saved on your profile — coaching tone, playing style, study goals, and favorite openings — all used to personalize the coaching.
• The Maia-2 microservice receives the current position (FEN) and the two ratings (yours and the bot's) when you play against the Twin Bot opponent, so it can return a humanlike move. It receives nothing else.
• Public Lichess and Chess.com APIs are queried from our server when you scout an opponent, import a game, or ask the coach about a named opponent — we fetch their publicly listed game history (the same data anyone can see on those sites). We never use private or authenticated endpoints unless you opt in via OAuth.
• Lichess OAuth is used only if you choose to connect your Lichess account to play live games through us.
• Resend sends the password-reset email when you request one.
• Google Firebase Analytics and Vercel Analytics collect page-view and usage information through browser analytics components — but only after you accept analytics cookies; until then they are not loaded at all. Chess Masti does not add game PGNs or coaching-chat content to those analytics events.
• Sentry may receive sanitized operational errors from the website in your browser and from Chess Masti's servers, together with technical context such as a stack trace, request route, browser type, and hardware metadata. Chess Masti does not intentionally send AI prompts, coaching-chat messages, AI responses, FENs, PGNs, account identifiers, or raw provider error bodies to Sentry. It is used only for diagnosing failures.

Opponents and other players you look up

Scout works on people who do not have a Chess Masti account and have not agreed to anything. When you scout a Chess.com or Lichess username — and also when we read your opponent's name out of a PGN you analyse, without you asking for a scout — our server fetches that player's publicly listed recent games and computes a profile from them: their opening repertoire, apparent strengths by phase of the game, frequent opponents, and behavioural estimates such as how often they lose on time, how long their games run, and how they do straight after a loss. Their username also reaches Anthropic or OpenAI, both as part of the PGN and when our validator checks what the coach said about them.

These profiles are inferences drawn from public game records, not facts about the person, and they can be wrong. If you save a scout report it is stored with your account and given a share link that anyone holding the URL can open without signing in. If you are the player who was scouted and want a saved report taken down, email aayanhetamsaria4@gmail.com.

Where data lives

• On our servers (Google Firestore) via the Firebase Admin SDK: account, saved games, saved chats and their messages, and preferences. Server-side only — your browser never connects to Firestore directly.
• On your device (IndexedDB): puzzle progress and spaced-repetition state. Stored locally in your browser and never sent to us.
• On Supabase: the internal feedback portal stores feedback submitted by people on the intern allowlist. When an authorized intern flags a coaching response, that submission includes the flagged response, chat history, the intern's account identifiers, their explanation and suggested response, and any available FEN or PGN. Separately, consent-controlled analytics endpoints can store page-view and consent-accepted event names, the page's route path, account or anonymous identifiers, session and request IDs, a salted IP hash when configured, browser and referrer information, and app version. Dedicated puzzle and analysis-session analytics can also store puzzle details, moves and outcomes, FEN or PGN, timestamps, and counts of queried moves or chat turns. Consent-controlled referee monitoring stores only aggregate validator counts, timing totals, request and contract IDs, provider and model names, and prompt, contract, and application version labels. It does not store referee excerpts, AI content, FENs, PGNs, or user or anonymous identifiers.

AI-call content and operational statistics

Automatic full AI-conversation capture is disabled in the application, including when TRACKING_ENABLED is true. Chess Masti does not write AI system prompts, coaching-chat messages, AI response text, provider error text, account or anonymous identifiers, FENs, or PGNs to Supabase through AI-call tracking.

For operational monitoring, each running server process keeps temporary aggregate AI statistics in memory: call counts, provider and model names, token totals, prompt-cache totals, elapsed-time totals, timestamps, and fallback counts and status codes. These statistics reset when the server process restarts and are not written to Supabase. They do not contain prompts, messages, responses, user identifiers, FENs, or PGNs.

Tracking controls

Chess Masti's custom browser-event tracking endpoints check the analytics choice stored in the cm_consent cookie and honor the browser's Global Privacy Control signal. The consent-controlled event, puzzle-attempt, and analysis-session analytics described above are also disabled unless the server'sTRACKING_ENABLED configuration is on. Google Firebase Analytics, the GA4 tag, and Vercel Analytics honor the same choice: none of them load unless cm_consent is "accepted" and your browser is not sending the Global Privacy Control signal.

What we do not do

• We do not sell your data. There is no advertising business model.
• We use and disclose PGNs and chats only as described in this policy.
• We do not run Stockfish on our servers — engine analysis happens in your browser as WebAssembly. Positions you analyse stay on your machine for engine evaluation; they only leave it when you choose to ask the AI coach about them.

Children

Chess Masti is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe Chess Masti collected personal information from a child under 13, email us at aayanhetamsaria4@gmail.com to request deletion.

Deleting your data

Email aayanhetamsaria4@gmail.com and we'll delete your account and saved games within seven days.

The Chrome extension — Analyze with Chess Masti

What the extension does

It adds an orange "♟ Analyze with Chess Masti" button to game pages on lichess.org and chess.com. When you click it, the extension reads the PGN of the game you are looking at and opens chessmasti.com/analysis in a new tab with that PGN in the URL. That's it.

What it accesses

• The DOM of pages on lichess.org and chess.com. Per Chrome's extension model the content script has read access to every page on those two domains while the extension is installed. In practice it does nothing on pages that aren't a game-like URL — the button only appears, and the PGN is only read, on paths such as /game/, /analysis/,/play/, /live/, and /daily/, and on the Lichess game-ID URLs.
• The public Lichess game-export endpoint (https://lichess.org/game/export/<id>) — fetched only when you click the button on a Lichess game, to get a clean PGN. No authentication, no cookies.

What it stores

Nothing. The extension has no storage permission, no background script, and no remote server of its own.

What it transmits

The PGN of the game you click on, sent only to chessmasti.com as a URL parameter when the new tab opens. Equivalent to copy-pasting the PGN into chessmasti.com yourself. Nothing is sent anywhere else.

What it does not do

• It does not collect personal information, contact information, financial information, authentication data, or location.
• It does not track your browsing across sites.
• It does not run on any site other than lichess.org and chess.com.
• It does not modify the content of pages it runs on, beyond adding the single button.
• It does not use the data it accesses for any purpose other than opening chessmasti.com with your game pre-loaded.

Contact

Questions, deletion requests, or anything else: aayanhetamsaria4@gmail.com.