Privacy policy

• Account: your email address and a password. The password is stored only as a hash, which cannot be turned back into the password.
• Age check: the date of birth you enter at sign-up is used once, to check that you are 13 or older, and is not stored. We keep only the fact that the check passed and when.
• Chess: the games you import or play, your conversations with Leo, puzzle progress, finished lessons, and settings, so they follow you between devices.
• Usage and billing: how many replies and photos you used, the computing cost of each, your credit balance, and the lessons you booked. Card payments are handled by Stripe; we store a Stripe customer reference, never your card number.
• Technical: the usual server logs our hosting provider keeps for a short time (IP address, browser type, time of request) to keep the service running and safe.

To run the app: syncing your data, generating Leo's replies, and keeping your progress. To bill fairly: metering replies and charging credit. To keep the service safe: rate limits and abuse prevention. To help you when you write to us. That is all. We do not sell personal information, and we do not show ads.

• Supabase hosts our database and sign-in.
• Vercel hosts the website and its server code.
• Anthropic runs the AI model behind Leo. When you ask Leo something, we send the message, the position, your recent moves, and the engine's analysis so it can answer. Anthropic processes this under its commercial API terms.
• Stripe processes payments and keeps the payment records the law requires.
• chess.com and Lichess receive a request only when you import a game from chess.com or open the opening database, which asks Lichess for statistics about a position.

Each of these companies acts on our instructions to provide the service; none of them may use your data for their own marketing.

We use a cookie to keep you signed in, and a cookie that remembers when a sign-up was refused for being under 13 so the form cannot simply be retried with a different date. Your browser also keeps a copy of your games and settings locally, and your light or dark theme choice. There are no advertising or tracking cookies.

Leo is for players 13 and older. We do not knowingly keep an account for anyone younger. If you believe a child under 13 has an account, email info@leochess.com and we will delete it and its data. Leo is built to be safe for younger players anyway: it talks about chess only and never asks for personal details.

We keep your data while your account exists. To delete your account, email info@leochess.com from the address on the account and we remove your account, games, conversations, progress, and usage records from our database. Stripe keeps payment records for as long as financial regulations require. Server logs are kept for a short, fixed period by the hosting provider and then discarded.

You can see and export your games from the app at any time, change your password from the login page, and ask us for a copy or a correction of the information we hold. Depending on where you live you may have further rights under laws such as the GDPR or the CCPA; email us and we will honor them.

Data travels encrypted between your browser and our servers. Each account can only read its own rows in the database, money is only ever moved by server-side code, and passwords are never stored in a readable form. No system is perfect; if we learn of a breach that affects you, we will tell you.

If this policy changes in a way that matters, we post the new version here with its date and email account holders. Questions: info@leochess.com. The terms of service cover payments, refunds, and fair use.