Privacy policy
Last updated: November 13, 2026
chess-report is run by Luiz Spinelli, an individual, who is responsible for the data described here. Contact: contato@spinelli.dev.br.
Short version: there is no account, no cookies, and no analytics. The free part runs in your browser; our hosting provider logs the page addresses you open, which include the username you search. We only keep data in our database when you start a purchase, and we delete it after 24 hours (orders that were not paid) or 30 days.
The free part
- Your browser fetches the games directly from Chess.com’s public API. The request doesn’t go through our server. Chess.com’s own privacy policy applies to it.
- Your browser also loads the player’s profile photo straight from Chess.com, without telling Chess.com which page it was on. We don’t receive or store the photo.
- The numbers, the findings, and the chess engine (Stockfish) run in your browser. The games are not sent to us for this analysis. Engine results are kept in your browser (IndexedDB) until you clear its data, so the same games are not analyzed twice.
- The username and period you search are part of the page address. Our hosting provider (AWS) receives them in its access logs, along with your IP address and the usual request data, to serve the pages.
When you buy a report
- Your browser sends us the order: the Chess.com username you searched, the statistics shown on the site, the moves and clock times of up to 100 of that player’s games (without opponents’ usernames), the report language, and your time zone. We store it in our database.
- We send the order to Anthropic, whose AI model (Claude) writes the report. We store the report with the order so you can reopen it.
- We store a keyed hash of your IP address (HMAC-SHA256 with a secret key), used to limit how many orders one address can start. We don’t store the IP address itself.
- We also store technical data about the writing (the AI model used, the token counts, and the cost) and when the payment was confirmed.
- Creem, our merchant of record, handles the payment and collects your email and card details. We don’t store your email or card details.
- While the report page is open, your browser keeps a note of the order in its session storage, so reloading the page doesn’t start the report again. The browser deletes it when you close the tab.
What we keep, where, and for how long
| Data | Where | How long | Who processes it |
|---|---|---|---|
| The games you search | Your browser’s memory | Until you leave or reload the page | Only your browser |
| Engine results (Stockfish) | Your browser (IndexedDB) | Until you clear your browser data | Only your browser |
| The search: username and period, in the page address | Hosting access logs (AWS) | As set by AWS for its hosting logs | AWS |
| The order: username, statistics, moves and clock times, language, time zone | Our database (Neon) | Not paid: deleted after 24 hours, once Creem confirms there was no payment (a payment still processing waits, up to 30 days). Paid: 30 days | Our server; Anthropic, to write the report |
| The report and data about writing it: AI model, token counts, cost, payment time | Our database (Neon) | 30 days | Our server |
| Keyed hash of your IP address | Our database (Neon) | Same as the order | Our server |
| Email and card details | Creem | Creem’s policy | Creem |
| Server logs, with the order ID but without order or report content | AWS CloudWatch | 30 days | AWS |
| Support emails | Our mailbox | As long as needed to handle your request | Us |
A cleanup runs every hour and deletes orders and reports once they pass these limits. Each company in the table processes data under its own terms: AWS (hosting, server, and logs), Neon (database), Anthropic (writing the report), and Creem (payment).
Deleting your data sooner
Email contato@spinelli.dev.br with the link to your report or your Creem receipt and we will delete the order and the report.
Changes
We may update this policy. The date at the top shows the last change.