Privacy policy
This draft describes the data the RookMentor code actually collects and the services that code talks to. It is not a finished policy. Places that need a fact Daniel has not confirmed are marked [TODO: Daniel confirm].
Who this is about
RookMentor is a chess improvement site. [TODO: Daniel confirm] the legal entity that operates it, its address, and the contact email for privacy requests. Until that is filled in, this draft has no effective date: [TODO: Daniel confirm] the effective date.
Data the product handles
Public chess games
You type a chess.com or Lichess username. The server reads that player’s public profile, ratings, and recent games (moves, results, clocks, and openings) from the public APIs. Reports are built from that read. The code does not ask for your chess password, and it does not write a copy of the games into the account database.
Account and email
If you ask for a sign-in link or a weekly report, we store your email. The sign-up path also stores the chess username and platform (chess.com or Lichess) you sent with it. A signed-in session is a cookie. We do not use a password.
Training data
Drills, scan summaries, weekly plans, the training path, streaks, and the last scan are saved in your browser. If you are signed in, those same items can sync to our database. A scan summary stores counts and averages, not the full game.
Coach questions
When you ask for a lesson, a follow-up, or a weekly plan, the request includes an approximate rating and material from your games: board positions, the move you played, a better move, how long you spent, and the text of your question or leak summary. Those routes send that to the model provider and return the reply. They do not insert it into the database themselves.
Payments
Pro checkout sends your account email to Stripe and stores a Stripe customer id plus whether Pro is active. Card details are entered on Stripe’s page, not on RookMentor.
Technical data
Rate limiting stores a bucket key that includes the client IP address. Analytics events include page views and product actions. Some of those events include a chess username and platform. After sign-in, analytics can be tied to your email.
Processors
Only services the code actually calls are listed here.
PostHog — analytics
The browser sends page views, page leaves, and custom events (for example, that a fingerprint was requested, with username and platform). Click autocapture is turned off. The analytics id is stored in local storage. Signed-in users are identified by email. Session replay is not switched on in our code, and it is also not switched off: the library’s default leaves recording available, and it starts only if the PostHog project enables it. Exception capture is the same: our code never sets it, and the library turns it on only when that project enables it remotely. [TODO: Daniel confirm] whether the PostHog project has session replay or error tracking enabled.
Stripe — payments
Subscription checkout, the billing portal, and webhooks that record whether Pro is active. Stripe receives the account email and processes the payment.
Vercel — hosting
The site and its API routes run on Vercel, including the scheduled job that sends weekly report emails. [TODO: Daniel confirm] which hosting logs are kept and for how long.
Neon Postgres — database
Stores account email, sign-in tokens, sessions, the Pro flag and Stripe customer id, synced training data, subscriber email with chess username and platform, and rate-limit buckets that include IP addresses.
Resend — email
Sends the magic-link sign-in email and the weekly report. The weekly message includes the chess username, platform, a short ratings line, how the week went, and the top leak title and fix.
Anthropic — coach text
Lessons, follow-up answers, and weekly plans are written by Anthropic’s API. A lesson sends up to five moments from your games: the position, the move you played, the move the analysis preferred, the move number, color, phase, evaluations, time spent, a mistake label, and an approximate rating. A follow-up sends the position, your question, your rating, and either the move you played and a better move, or context that can include an evaluation and a suggested move. A plan sends your rating, daily minutes, leak titles and evidence, and an optional short scan summary.
chess.com and Lichess — public games
Read-only calls to the public chess.com Published-Data API and the public Lichess API. We send a username and receive public games. We do not log in to those accounts.
YouTube — lesson videos
A theory topic is looked up on YouTube’s public search page. If a video is found, the page can show a thumbnail and, after you press play, an embed from youtube-nocookie.com. The lookup sends the search phrase, not your email or username.
How long we keep it
[TODO: Daniel confirm] retention periods for accounts, subscriber emails, synced training data, rate-limit rows, analytics, and hosting logs. The code itself deletes a used sign-in token by marking it used, keeps a session for 90 days unless you log out, and sometimes deletes rate-limit rows older than a day. Those code details are not a retention policy.
Your requests
[TODO: Daniel confirm] the data-subject rights process: which rights apply, how to ask for access, correction, or deletion, how identity is checked, and how long a reply takes. There is an unsubscribe link on the weekly email. There is no separate privacy request form in the product yet. Contact email: [TODO: Daniel confirm].