Privacy Policy

Anonymous analysis never leaves your device

When you analyze a game without signing in, the entire pipeline runs locally: Stockfish executes as WebAssembly in your browser, and the resulting report, drills, and review schedule are stored only in your browser's local storage. Zero upload: your PGN, moves, and evaluations are not sent to our servers during anonymous analysis.

What we do process on our servers

• Username imports:if you import games by Chess.com or Lichess username, our server proxies that platform's public API to fetch the public games you asked for. We don't keep a copy beyond serving your request.
• Accounts (optional): if you sign in, we store your email and the games and training progress you choose to save.
• Waitlist: if you join the Supercoach waitlist, we store your email only to contact you about Supercoach availability.

Age: buckets, not birth dates

Before any account data is collected we ask for a birth year and run a neutral, self-declared eligibility check. This is not identity or age verification, and it cannot prove that a submitted year is accurate. We store an age bucket(for example "adult" or "under consent age"), never your birth date. If you are under the digital-consent age in your region, we do not collect account data at all — the local analysis tools stay available without an account, and we never nudge anyone to misstate their age.

Authentication and account email providers

Supabase handles account authentication, including password hashes, Google identities, verification and recovery tokens, and sessions. Amazon SES delivers verification, password-recovery, reauthentication, and password-security emails generated by Supabase. These providers process the email address and technical delivery data needed to provide those account services. We do not use authentication emails for marketing.

Deletion and export

• You can delete a single game, your training data, or your whole account. Single-game and training-data deletion removes that content from active views and standard APIs immediately.
• You can export your data before deleting anything.
• If any part of a deletion fails, we show you the true state — a pending item is reported as pending and retried, never as done.
• Requesting account deletion pauses account access immediately and starts a seven-day cancellation window. Your server-side learning data remains unavailable but is retained during that window. If you do not cancel, permanent cleanup begins after the displayed deadline and may continue in the background.
• We request cancellation of automatic subscription renewal when you schedule account deletion. Cancelling account deletion later does not automatically restart a subscription.
• A device that is offline may still hold a previously downloaded local copy until it reconnects or its browser site data is cleared. BlunderLoop blocks server access immediately and clears recognized account caches when an online device learns about the request.
• Payment records that a merchant of record must retain for tax, fraud, refund, or dispute obligations are kept only for the required period and disconnected from your BlunderLoop profile where possible. Backup copies expire under the infrastructure provider's normal retention cycle rather than being synchronously rewritten.
• Local, anonymous data can be cleared at any time from your browser's site-data settings.

What we don't do

• We don't sell your data or share it with advertisers.
• We don't run third-party ad trackers.
• We don't make your training results public unless you explicitly opt in; minors are never listed publicly.

Questions

BlunderLoop is open source — you can verify these claims in the code. License and source information is on the Licenses page.