Privacy Policy

Overview

This policy describes what OpeningMatrix collects when you visit our website or use our application, and what we do with that information. It applies to everyone — guests, free accounts, and paid subscribers — and it overrides anything to the contrary elsewhere on the site.

We treat your data with the minimum collection and no third-party tracking that the features we offer can still work. We do not sell your data, we do not serve ads based on your behaviour, and we do not profile you beyond what is needed to run the service.

This service is operated by OpeningMatrix. We are not a registered company, so there is no company registration number or registered office address to quote here. The identifiable operator of this service is the OpeningMatrix team, reachable at [email protected], and the data we hold lives with the providers listed in this section.

What we collect

Information you give us

• Email address. Used to identify your account, send verification codes and password-reset links, and send receipts for paid plans. This is collected by our authentication provider (see Third parties) — we never see or store your password.
• Display name and handle. Your display name appears on your public profile and on leaderboard entries. Your handle is the unique identifier other users see. These are public if you choose to list your profile (see Your choices).
• Chess platform usernames. When you link a Chess.com or Lichess account on your profile page, we store only the username you provide — we never request or receive your password on either site.
• PGN text for game review. When you paste a game into the review or Blunder Override tools, that PGN is sent to our servers so Stockfish can analyse it. The PGN itself is not written to your account and is discarded once the analysis has been returned to you.

Information generated by use

• Opening progress. Which courses you have started, which lines you have completed, which variations you have mastered, and your Practice and Time trial scores. These are stored against your account and shown only to you.
• Puzzle history. Which puzzles you have solved, which themes you keep missing, and your solving rating. The rating is separate from any Chess.com or Lichess rating and updates only from your puzzle attempts.
• Endgame drill results. Which endgame patterns you can convert and which you still miss, tracked per endgame with the same per-line progress as the openings.
• Repertoire courses. The lines you build in the Repertoire builder, including branches and edits you make. Private courses are never shown to anyone unless you publish them.
• Daily usage counters. Counts of stat checkups and Blunder Override sweeps you have run today, used to enforce the free-tier daily limits (one stat checkup per day). Signed-in accounts have no daily limit on game reviews; guest review usage is counted to enforce the guest allowance.

Information collected automatically

• Session cookie. One essential cookie keeps you signed in while you use the site. It contains only a session identifier — no personal data is stored in the cookie itself.
• Local storage in your browser. Your selected theme (light or dark), and any practice progress you make while signed out (stored only locally so it is lost if you switch devices or clear your browser data).
• Session storage. Temporary UI state, such as whether you have dismissed a tour or alert, stored only for the duration of the tab session.

We do not use analytics cookies, advertising cookies, or any third-party tracking scripts. There is no Google Analytics, no Plausible, no PostHog, no Hotjar, no Clarity, and no Facebook or DoubleClick integration on this site.

How we use your information

• Run your account. Authenticate you, save your progress, enforce plan limits, and keep your preferences across visits.
• Generate your games and stats. Fetch public game data from Chess.com and Lichess using the usernames you provide, and cache it only long enough to produce your dashboard. Nothing is posted back.
• Analyse your games. Run Stockfish analysis in your browser so the review can surface the positions you did not know. Game text is discarded once the analysis has been returned. We also look up the opening your game followed against a public opening book, and store a short verdict on your account (for example, the move where you left theory) so the Book insight can be shown again. That verdict is removed with your account.
• Send essential email. Verification codes, password-reset links, and receipts for paid subscriptions.
• Improve the service. Aggregate, anonymised data about how the trainer is used (e.g. completion rates, common drop-off points) helps us decide what to build next. Individual records are never included in these aggregates.

Third parties we work with

We do not sell or rent your data. The only providers that process data on our behalf are:

• Google Firebase — Authentication (sign-up, email verification, password reset) and the Realtime Database (storing your account data, progress, and preferences). We hold the data at your chosen Firebase project; Google is our processor under a data-processing agreement.
• Stripe — Payment processing for paid plans. You enter your card details directly on Stripe's checkout page; OpeningMatrix never sees or stores your card number. Stripe is a separate controller for payment data under its own privacy policy.
• Email provider — Transactional email for verification codes and receipts. We share only what is needed to deliver the message (recipient address, send timestamp, and delivery status) with the provider that sends it on our behalf.
• Hosting provider — Our application server and database are hosted with an EU-region infrastructure provider. Your account data is stored with them under our instructions.

Chess.com and Lichess are not third-party data processors for this service. Their public APIs are queried directly by our servers on your behalf, and usernames are the only account-linked data we store.

Your rights

Depending on where you live, you may have the right to know what we hold about you, to correct it, to erase it, and to data-portability. You can erase your account yourself at any time: go to Account, open the Delete account card at the bottom, confirm with your password, and everything attached to your account is removed immediately — permanently, with no recovery window. For anything else, or if you would prefer us to do it, email [email protected]. We respond to all requests within 30 days, and we will not charge you or refuse you service for making one in good faith.

• Access. Ask what personal data we hold and we will tell you within a reasonable time.
• Correction. We can fix any field on your account, but changing your email address must be done from the address currently on the account (because that email is the proof of ownership).
• Deletion. You can delete your account yourself from the Account page at any time. This is final and cannot be undone: your profile, your @handle, your saved usernames, your progress and puzzle data, your leaderboard entries, and any opening courses you created (including ones you published to the Community library) are all removed. If an active paid plan is attached, it is cancelled as part of the deletion, so you are not billed again. Any unused portion of the current period is not refunded — cancel the plan from the Account page beforehand if you would like to keep the remaining time.
• Restrict processing. Ask us to stop using your data (for example, while a dispute is resolved).

How long we keep data

Account data, progress, and preferences

Retained for as long as your account is active. When you delete your account, these are removed from our live systems straight away, and any remaining backup copies are overwritten within 30 days.

Uploaded PGN for game review

Held only in memory long enough to complete the analysis, then discarded. The opening verdict derived from it is stored on your account and removed when you delete the account.

Email verification attempts

Code hashes and attempt counters are deleted immediately after the code is consumed or expires (whichever comes first).

Audit logs for paid accounts

Stripe subscription events and payment metadata are kept for as long as required by law (typically 7 years for tax purposes) and then deleted.

Your choices

• Public profile. Your handle, display name, published courses, and leaderboard position are visible to everyone. You can un-list your profile in your account settings to hide this information. Your email address is never public.
• Cookies. The session cookie is strictly necessary and cannot be disabled without breaking sign-in. You can refuse or clear it at any time, but that will sign you out.
• Theme storage. Your choice of light or dark theme is kept in local storage in your browser. Clearing your browser data resets it.

Children and the EU age threshold

We do not knowingly collect personal data from children. If you are below the age at which you can form a legally binding agreement in your country — in the EU and UK that is 16, in the US that is 13 — you must not use this service or submit personal data without a parent or guardian agreeing on your behalf.

International transfers

Your data is processed in the European Union and stored on servers in the EU (via DigitalOcean and Firebase's europe-west1 region). If you are accessing the service from outside the EU, your data will be transferred to and processed in the EU. We rely on the adequacy decisions and standard contractual clauses as required.

Changes to this policy

We may update this policy. If we make material changes, we will post a notice on our blog and update the "Last updated" date at the top. For changes that significantly affect your rights, we will email you at the address on your account.