Privacy at Rookward

Playing without an account

Guest tactics, First Moves discoveries and local practice games stay in the open page’s memory. Refreshing starts a new visit. Your optional chess-piece style is stored in this browser so it can survive a refresh; clear this site’s browser data to remove that setting. It contains only a style choice, not account information or learning progress. Optional computer matches run on your device with approximate difficulty targets; they do not update a player rating or send match moves to an opponent service. Opening the site still sends ordinary web requests to our hosting provider.

PGN and opening study on this browser

Files uploaded or pasted in Chess study are parsed in this browser. Unsaved practice ends when you close or refresh the page. Choosing “Save variation on this browser” keeps its normalized moves, current practice position, hints and completion history. Optional tactical saving keeps submitted moves, hints and results; position bookmarks keep FEN positions without player names. Saving replays keeps one normalized PGN collection and its replay cursor. These browser records remain until you remove them or clear this site’s data. They are not linked to an account, sent to Supabase or synced between devices. Chess study provides export and removal controls for these records. Signing out or deleting an account does not remove this separate browser data. Avoid saving on shared devices.

Adult accounts and saved chess records

Supabase handles account email, password verification and sessions. Rookward does not retain plaintext passwords in its application database or logs.

Signed-in adult tactics save account identifiers, adult-use acknowledgment, challenge commands, attempts, awards and progress. Guest progress does not transfer. When you use saved First Moves, we store the lesson version, completed discoveries, and records of successful saves. These follow the existing account lifetime, export and deletion handling. Incorrect discovery answers are not retained. First Moves otherwise lasts for the current visit. Local practice games are not saved to accounts.

Manual game imports save canonical chess moves, starting positions, results and processing permission. The normal import removes original player names, sites, dates, comments, variations and filenames before saving. Only upload games you are authorized to process.

Optional Chess.com practice reviews

Where the review service is available, adults can request a review of their own public Chess.com profile. Rookward fetches up to 50 recent eligible standard-chess games through Chess.com’s public API. Your username, permission acknowledgment, normalized chess records, analysis and practice progress are stored privately with your account. Never enter a Chess.com password.

When engine-based reviews are enabled, only chess positions and bounded review instructions enter isolated processing in a temporary Vercel Sandbox; account passwords and session tokens do not. Suggestions cannot guarantee a rating increase. PGN and opening study run in your browser without an engine or review service.

Source snapshots expire within 24 hours. Saved reviews and their practice progress expire after 30 days. Minimal deletion markers remain for 90 days to prevent restoration from reactivating deleted reviews. Review export and deletion require your account password. This does not delete your Chess.com history or your Rookward account; provider backup expiry remains under review.

Daily streaks

Signed-in adult accounts save a daily practice counter: the last qualifying UTC date and consecutive-day count. Correct saved tactics and supported personalized practice moves count; visits, guest play, First Moves and computer matches do not yet count. The counter follows the existing adult account/progress lifetime and is included in account JSON exports. Deleting a review does not erase this separate account-level counter. No additional chess history is retained for streaks.

Offline public exercises

You can optionally download public lessons, exercise code and artwork for offline use from Chess study. The download stores public pages and application files in browser Cache Storage; it excludes account APIs, authentication pages and private game pages. Use “Remove offline exercise downloads” to remove those files. Saved browser study records have their own export and removal controls. Guest lesson progress remains visit-only.

Cookies and service logs

Sign-in uses essential session cookies. Sign out through My account on a shared device; clearing browser cookies does not delete saved account records.

Application logs record request identifiers, routes, status and timing for operation and troubleshooting. They exclude passwords, tokens and raw game content. Hosting and authentication providers may also process network information, such as IP addresses, for their services and security. Provider log access and retention still need final review.

Service providers

Vercel hosts the website and artwork. Supabase provides adult authentication and private database storage. If Google sign-in is configured and you choose it, Google and Supabase handle basic sign-in identity information; Rookward does not save Google API tokens in its learning data.

• Vercel privacy notice (opens in a new tab)
• Supabase privacy notice (opens in a new tab)
• Google privacy notice (opens in a new tab)

The current app has no active advertising, third-party analytics, payments or private-game engine processing integration.

Exports, retention and deletion

Signed-in adults can request the existing JSON/PGN export after password reauthentication. Google-only accounts without a password cannot use that export flow yet.

Saved adult records currently follow the account’s lifetime. A final retention schedule, deletion timeframes and verified provider/backup expiry are not yet established. Self-service account deletion is not available in this preview.

Junior and children’s information

Account features are for adults. Junior is an appearance preview, not a child account or parental-consent system. Do not create an adult account for a child or submit children’s personal information. Child accounts require separate protections and qualified legal review before launch.

Privacy questions and requests

A dedicated privacy contact and operator details have not yet been published for this preview. A working request channel, reviewed notice and deletion process remain prerequisites for a broader account launch. Do not submit sensitive personal information while these arrangements are incomplete.