1. In short
C4Chess is a chess coaching academy and most of our learners are children. That single fact shapes everything below, so here is the summary before the detail.
We collect what we need to teach: an account, an age band, what you do on the platform, and — for enrolled students — attendance, homework, coach feedback and progress. We ask for an age band rather than a date of birth, because that is less data about a child and it answers every question we need answered.
We use Google Analytics 4 to measure how the site is used. It loads only if you accept optional cookies, we do not send it your name, email or account ID, and you can switch it off at any time in the portal under Settings → Account → Analytics cookies. Separately, our hosting provider Cloudflare counts page visits on every page for everyone, without asking first: it stores nothing on your device, gives you no identifier and does not recognise you from one visit to the next. Section 9 says exactly what it sees. There is no advertising on C4Chess.
We do not sell personal data. We do not build advertising profiles of children. We do not record live classes. We do not use students' work or games to train artificial-intelligence models.
Ask C4, our chess chat, answers from our own data and software, not from an outside AI service. We keep a log of the questions typed into it, without names, to see what it cannot answer yet; we save members' conversations so they can reopen them, visible only to them; and for adult members only, it can keep a chess profile that they can see, change or delete. Section 4 has the detail.
Scout, our opponent-preparation tool, looks up the public chess record of a player a member names — their public online games, or for a FIDE ID their broadcast tournament games and published FIDE ratings — and keeps a copy so reports load quickly. The person looked up is often not a C4Chess user. Sections 3, 4 and 16 say what is kept, and anyone can ask us to remove their games.
Our primary database, authentication system and stored learning records are hosted in Mumbai, India. Some limited data is processed internationally by the service providers described in sections 13 and 15. To ask a question, exercise a right, or complain: privacy@c4chess.com.
2. Who we are and how to reach us
C4Chess Education Private Limited is the data fiduciary — the organisation that decides why and how your personal data is processed — for everything described in this policy. It is a private limited company incorporated in India under Corporate Identity Number U85410WB2025PTC280318, with its registered office at 4th Floor FL-4C, 83 S.P. Mukherjee Road, Kalighat, Kolkata - 700026, West Bengal, India.
Our Grievance Officer under section 13(3) of the Digital Personal Data Protection Act, 2023 is Surya Tribedy. For any privacy question, to exercise a right, or to raise a grievance, write to privacy@c4chess.com, or by post to the Grievance Officer at the registered office above. For anything else, support@c4chess.com.
If you are a parent or guardian writing about your child, say so and tell us the child's account email; section 10 explains how we handle those requests.
3. Who this policy covers
Visitors to our public pages, including anyone reading ChessDaily or browsing without an account.
Guest users who play or solve puzzles without registering. A guest is given a random token stored in their own browser so their game can work; that token is not linked to a name or an email address.
Registered users, whether or not they are enrolled for coaching.
Enrolled students, and the parents and guardians linked to a student's account.
Coaches and staff, in respect of their use of the platform. Employment records are handled separately and are outside this policy.
Chess players whose public games or published ratings a member looks up in Scout, who may not use C4Chess at all. What we hold about them, and how they can have it removed, is in sections 4 and 16.
4. What personal data we collect
Account and identity: email address, password (stored only as a cryptographic hash, never in readable form), a public user ID you choose, first and last name where you give them, an avatar image if you upload one, country, time zone, a short profile bio if you write one, and preferred language.
Age information: an age band — under 13, 13 to 15, 16 or 17, or 18 and over — together with the date you declared it. A full date of birth is optional; you can add it in your profile and remove it again at any time. Enrolled students may be asked for a date of birth separately where an age-group class or a tournament entry needs it.
Consent records: which version of the Terms, Privacy Policy and Cookie Policy you accepted and when, whether the account was set up with guardian consent, and your answer to the cookie banner.
Sign-in provider data: if you sign in with Google, the basic identifiers Google shares with us, which is your email address and basic profile information. We do not receive your Google password.
Learning and coaching data, for enrolled students: batch and schedule, attendance, homework assignments and submissions, assessments, coach feedback and notes, progress reports and certificates, and feedback a parent gives about coaching.
Gameplay and practice data: games you play and their moves, opponents, ratings and rating history, puzzle attempts and results, opening repertoire and course progress, missions and XP, and analysis produced from your games.
Ask C4 chat: (a) a question log — the text of each question typed into the chat, with email addresses and long numbers such as phone numbers removed before it is saved, which topic the chat matched, whether it could answer, and the time. A pasted game or position is recorded only as "a game was pasted", never its content. For a member the entry is linked to the account so that it is deleted with it; for a guest it is linked to nothing. (b) Chat history, for members only — your conversations with the chat and the game on its board, saved so you can reopen them. (c) A chess profile, for adult members only — chess facts you choose to tell the chat or enter in its profile form, such as your rating, favourite openings, playing style, goals and how much time you have to practise. It holds no age, and no profile is ever kept for anyone under 18.
Scout: (a) when a member scouts a player, the player's publicly available games — from Chess.com or Lichess by the username the member enters, or, for a FIDE ID, from Lichess's broadcasts of over-the-board tournaments — together with that player's published FIDE profile (name, federation, title and ratings) and FIDE rating history, including how many rated games they played in each period. These are kept in a shared cache so that preparation reports load quickly, and are used only to build those reports. The player looked up may be anyone, including a junior; a person who finds their games in Scout can ask us to remove them by writing to privacy@c4chess.com. (b) PGN files a member uploads, stored privately against that member's account and used only for that member's own reports. (c) My Scout Profile — a member's own repertoire and playing-style summary, built from the sources the member chooses (their accounts, a FIDE ID, their PGN files), stored for that member only so that Comparative Scout can compare it with an opponent, and deletable by the member at any time.
C4 Coins: your coin balance and a record of every coin earned or spent — which activity earned it or which item it bought, and when — together with your daily-chest claims and the Shop items you hold.
Classes booked with coins: the booking form — the student's age, level, any chess ratings you choose to give (FIDE, national or over-the-board, USCF, or another system), the days and times that suit you with your time zone, and any note for the coach — and the request's progress (waiting, scheduled, completed or cancelled).
Communications: messages you send through the platform, notifications, support tickets, reports you file about another user, demo-class and enquiry forms, and email we exchange with you.
Live classes: the fact and timing of joining and leaving a session, and the display name shown to other participants. We do not record the audio or video (see section 12).
Payment records: the fact and amount of a payment, the enrolment it relates to, and any proof of payment you upload. We do not collect or hold card numbers, bank credentials or UPI credentials — there is no payment gateway in the platform.
Contact details for reminders: an email address and, where you give one, a phone number used for class reminders.
Technical data: IP address, device and browser information, and pages and features used. Where you have accepted optional cookies this is also seen by Google Analytics, in the limited form described in section 9. Page visits and page-load timings are also counted by Cloudflare Web Analytics on every page, whether or not you accept, as described in section 9.
What we deliberately do not collect: we do not ask for a government identity document, an Aadhaar number, a school address, a home address, precise location, biometric data, or any special-category data about health, religion, caste or community. Do not send us these; if you do, we will delete them.
5. Why we use it, and on what legal basis — category by category
This is the table regulators and reviewers look for: for each category of personal data, what we use it for and what makes that lawful. Under the Digital Personal Data Protection Act, 2023 the lawful bases available to us are consent (section 6) and certain legitimate uses (section 7); where a person is a child, consent must come from a verifiable parent or guardian (section 9). Where the GDPR applies to a user in the EU or UK, the corresponding basis is given in brackets.
Account and identity data — to create and secure your account, sign you in, let others recognise you in games and classes, and contact you about the service. Basis: performance of the agreement with you or your guardian, and consent given at sign-up (GDPR equivalent: contract).
Age band and date of declaration — to decide which terms apply, whether guardian consent is needed, and to pitch material at the right level. Basis: consent, and compliance with our obligations towards children under the DPDP Act (GDPR equivalent: legal obligation and contract).
Consent and acceptance records — to show what a user or guardian was shown and agreed to, and when. Basis: compliance with a legal obligation, and our legitimate interest in being able to demonstrate consent (GDPR equivalent: legal obligation, legitimate interests).
Learning and coaching data — to deliver classes, set and mark homework, record attendance, write feedback and progress reports, issue certificates, and let a linked parent see how their child is doing. Basis: performance of the coaching agreement with the guardian or adult student (GDPR equivalent: contract).
Gameplay and practice data — to run games and puzzles, match you with suitable opponents and material, calculate ratings, produce analysis, and show your own progress back to you. Basis: performance of the agreement (GDPR equivalent: contract).
Ask C4 question log — to see which questions the chat could not answer, so our team can teach it, and to understand which topics people ask about. Staff with administrator access review the questions without names or account identifiers shown. Basis: our legitimate interest in improving the service (GDPR equivalent: legitimate interests).
Ask C4 chat history — to let a member reopen a conversation. It is visible only to that member; no staff account on the platform can open it. Basis: performance of the agreement (GDPR equivalent: contract).
Ask C4 chess profile — to tailor training plans, opening answers and game reviews to an adult member. Basis: the member's consent, given by telling the chat or filling in the profile form, and withdrawable at any time by deleting the profile (GDPR equivalent: consent).
Scout data about a scouted player — to build the preparation report the member asked for, and to make the next report on the same player fast. The games and ratings are already public, and nothing is published about the player beyond the requesting member's report. Basis: our legitimate interest, and the member's, in preparing for a game against a named opponent (GDPR equivalent: legitimate interests).
Scout uploads and My Scout Profile — to build the member's own reports and comparisons. Basis: performance of the agreement (GDPR equivalent: contract).
C4 Coins records — to keep your balance accurate, apply the daily limits, show you what you earned and spent, and detect coins obtained by cheating or by exploiting a fault. Coin activity is not sent to Google Analytics. Basis: performance of the agreement (GDPR equivalent: contract).
Class booking details — to schedule a class bought with coins and choose a suitable coach. They are seen by the administrators who schedule the class and by the coach assigned to it, and by no one else. Basis: performance of the coaching agreement; where the student is a child, on the strength of the guardian's consent given for the account (GDPR equivalent: contract).
Communications — to deliver messages and notifications, answer support requests, investigate reports, and keep the community safe. Basis: performance of the agreement, and our legitimate interest in a safe platform, which for a service used by children we treat as a duty rather than a preference (GDPR equivalent: contract, legitimate interests).
Live-class attendance events — to record who attended which class, for attendance reporting to guardians and for our own records. Basis: performance of the coaching agreement (GDPR equivalent: contract).
Payment records and proof of payment — to verify that a fee has been paid, activate enrolment, keep accounts, and meet tax and company-law obligations. Basis: performance of the agreement and compliance with a legal obligation (GDPR equivalent: contract, legal obligation).
Contact details for class reminders — to remind a student or guardian that a class is due. Reminders currently go by email only. The platform can also send them over WhatsApp, but that is switched off, and it would be used only where a phone number has been given for that purpose. Basis: performance of the agreement; for WhatsApp, were it switched on, your consent, which you could withdraw by telling us to stop (GDPR equivalent: contract, consent).
Technical and security data — to keep the service working, detect and investigate abuse, fair-play violations and security incidents, and diagnose faults. Basis: our legitimate interest in the security and integrity of a platform used by children, and compliance with law (GDPR equivalent: legitimate interests, legal obligation).
Analytics data — to understand which pages and features are used so we know what to build and fix. Basis: your consent, given through the cookie banner and withdrawable at any time (GDPR equivalent: consent).
Cloudflare Web Analytics — to count visits to each page and measure how quickly pages load, so we can find slow or broken pages. It does not depend on the cookie banner, because it stores nothing on your device and identifies no one; it does involve your IP address and the page you are on reaching Cloudflare, which happens anyway when Cloudflare serves the page. We have not asked for consent for this, and we would rather say so than imply we have. Whether consent-free aggregate measurement of this kind fits within the Act is a question for our legal advisers, and if their answer is that it needs consent, we will ask for it (GDPR equivalent: legitimate interests).
Safety and abuse records — to act on reports, moderate content, restrict accounts, and where necessary report a matter concerning a child to the authorities. Basis: compliance with a legal obligation and the protection of vital interests, particularly of a child (GDPR equivalent: legal obligation, vital interests, legitimate interests).
6. What we do not do with your data
We do not sell personal data, and we do not share it for anyone else's marketing.
We do not build behavioural profiles of users for advertising, and we do not track anyone across other websites.
We do not use a student's homework, games, messages, coach feedback or questions typed into Ask C4 to train artificial-intelligence models, ours or anyone else's. If that ever changed for the Ask C4 question log, we would say so here first and ask for consent where the law requires it.
We do not publish a student's games, rating or progress outside the platform, and we do not make a user's friend list visible to anyone but the user.
We do not make decisions about a student purely by automated means that produce a legal or similarly significant effect on them. Automated tools suggest material and produce analysis; a coach makes the judgements that matter.
7. Cookies and similar technologies
We use a small number of strictly necessary storage items to keep you signed in and to remember your settings, and — only if you accept them — optional items for analytics. Nothing is stored for advertising, because there is none.
Nothing optional loads before you accept it. The analytics tag is injected by our own code only after consent is recorded; it is not present in the page beforehand.
One measurement script is not covered by that sentence, because it is not optional storage at all: Cloudflare Web Analytics, which our hosting provider adds to every page. It sets no cookie and writes nothing to your browser's storage, so there is nothing for the banner to switch on or off. Section 9 describes it.
You can change your answer at any time, in the portal under Settings → Account, towards the end of that section, under "Analytics cookies". Turning analytics off stops reporting immediately, in the same page view, without a reload or a sign-out.
The full list of what we store, what each item is for, and how long it lasts is in our Cookie Policy at /legal/cookies.
8. A note on where we are being precise
This policy names the specific services we use rather than saying "trusted partners", because a general statement would not let you check anything. Where something is not live yet, we say so rather than describing it in the present tense.
As at the last-updated date: Google Analytics 4 is live and consent-gated. Cloudflare Web Analytics is live on every page and is not consent-gated. There is no advertising: C4Chess does not use Google AdSense or any other advertising service, and no advertisement is placed anywhere on the platform. Sign-in with Apple is built but switched off. Reminders over WhatsApp are built but switched off, so no reminder is being sent over WhatsApp and no phone number is reaching Meta today. Class reminders currently go by email.
Also as at the last-updated date: Ask C4 is live. Its answers come from C4Chess's own chess engine, opening book, puzzle bank and game library, all running in your browser or on our own database; nothing you type into it is sent to an outside AI service or any other third party.
One thing we used to do and have stopped: the typefaces on this site were previously fetched from Google Fonts as each page loaded, which told Google the address of every visitor to every page, before anyone had consented to anything. They are now served from our own domain.
What that does and does not buy you, stated carefully. Ordinary C4Chess pages do not load Google Analytics before you accept optional cookies, and load no advertising resources at all. They do load Cloudflare's measurement script before you answer, for the reasons in section 9. But certain features you choose to use may contact Google when you activate them — playing a video in the video library, which is embedded through YouTube's privacy-enhanced player, or signing in with Google. Those are user-initiated, and the section below lists them.
9. Analytics — Google Analytics 4 and Cloudflare Web Analytics
We use Google Analytics 4, property G-V8S30EV4MN, operated by Google, to understand how the site is used in aggregate.
It loads only if you accept optional cookies. Until you do, nothing is sent to Google Analytics at all — the tag is not on the page. If you decline, or later switch it off, nothing is sent from that moment.
What it receives: the pages you view, a small set of named events (for example that a game was started, a lesson was opened, or an article was read), a randomly generated analytics identifier, your approximate location derived from your IP address, and basic device and browser information.
What it does not receive: your name, your email address, your account ID, whether you are a student, your messages, your homework, your games, or the text of anything you search for. Where an event relates to something you searched for, we send only the length of the query, never the query. Where an event relates to an article, lesson or video, we send its title but not your identity.
Google's three advertising signals — advertising storage, advertising user data and advertising personalisation — are denied for everyone and never granted, whatever your age and whatever you answer, because there is no advertising on C4Chess. Analytics data is therefore not used to build an advertising profile of anyone. What Analytics receives never includes your name, email or account ID. Analytics is also suppressed entirely on pages that could carry a sign-in or password-reset token in the address, so no credential can reach Google in a URL.
To withdraw: portal → Settings → Account → Analytics cookies. Google publishes its own terms and privacy information for Analytics, and offers a browser add-on that opts you out of Google Analytics across all sites.
We also use Cloudflare Web Analytics, provided by Cloudflare, which hosts this website. It works differently from Google Analytics, and the difference is why it is not behind the cookie banner. It runs on every page, signed in or not, from the moment the page loads, for every visitor including children.
What it measures: that a page was viewed, which page (its address on our site), the site you came from, your country, your type of device, browser and operating system, and how long the page took to load. Cloudflare derives the country from your IP address as it serves the page. The script reports back to our own domain, not to a separate analytics address.
What it does not do: it sets no cookie, writes nothing to your browser's storage, and gives your browser no identifier, so it cannot recognise you from one page to the next or one visit to the next. Cloudflare states that it does not fingerprint visitors by IP address, browser details or anything else, and does not track individuals across the websites it serves. We send it nothing about you: no name, email, account ID or event of any kind. What we see is totals, such as how many times a page was viewed today, never a person.
You cannot switch it off from the cookie banner or Settings, because there is nothing stored for those controls to remove. A browser or extension that blocks scripts from static.cloudflareinsights.com stops it, and nothing on C4Chess depends on it.
10. No advertising
C4Chess shows no advertising. No page carries an advertisement, we do not use Google AdSense or any other advertising service, no advertising cookie is set, and nothing about you or your child is shared with an advertiser.
That applies to everyone, whatever age band you declared and whatever you answered to the cookie banner. If it ever changes, this section will describe exactly what would apply before any advertisement is shown, and where the change needs consent we will ask for it rather than assume it.
11. Children and young people — the longest section here, on purpose
Most services write one line about children because they never ask anyone's age and prefer not to know. We are not in that position. C4Chess enrols children into age-graded classes, links parent accounts to child accounts, and asks every user for an age band. We have actual knowledge that children use this service, and a one-line children's section would be inadequate to the point of dishonesty. So this section is the longest one in the policy.
WHO IS A CHILD. Under section 2(f) of the Digital Personal Data Protection Act, 2023, a child is anyone who has not completed 18 years. That is the line we use throughout, and it is a higher bar than the 13-year line many international services use.
PARENTAL CONSENT. Personal data of a child is processed on the basis of the consent of a parent or legal guardian, as section 9(1) of the Act requires. Every account whose declared band is under 18 — including under 13 — is created with that consent recorded as outstanding, and a guardian must consent to these documents and to the child's use. The account is not closed while that is outstanding. When we link a parent account to a child account, we verify the link with a one-time code sent to the parent rather than accepting a claimed relationship, because a parent view exposes the child's progress, attendance and feedback.
IF YOU ARE UNDER 18, DO NOT DO THIS ALONE. Users are hereby requested to read this Privacy Policy, our Terms & Conditions and our Cookie Policy before agreeing to them, and a user under 18 is advised to seek their parent's or guardian's guidance before proceeding any further — including before ticking the three boxes at the check-in.
HOW WE ASK, AND WHAT WE RECORD. Signing up has a compulsory second step. Before the portal opens, we ask for an age band — under 13, 13 to 15, 16 or 17, or 18 and over — and we ask you to acknowledge each of these three documents separately rather than as one bundle. What is stored is the band, the date you declared it, and one row per document naming which document, which version of it, and when. That is what makes it possible to reconstruct, later, exactly what a particular person was shown on a particular day.
AND WHAT WE DO WHEN AN ANSWER AGES. A date of birth stays true; an age band does not. So a band is never stored on its own — it is stored with the date it was given, and a person's status is worked out from the pair. Someone who told us they were 13 to 15 is certainly still a child for the next two years and certainly an adult after five, and in between we ask again rather than guess. Where there is no usable answer, the person is treated as a child. On a platform used mostly by children, not knowing is not the same as being told they are an adult, and we do not let it resolve that way.
VERIFYING THAT CONSENT. The Act requires consent to be verifiable. What we have today is: a recorded acknowledgement per document, tied to a version and a timestamp; an age band recorded with its declaration date; a parent-child link verified by a one-time code before any parent view is granted; and, for enrolled students, direct contact with the paying guardian during enrolment. For a child who signed up on their own, the guardian's consent stays recorded as outstanding until a guardian gives it. The rules prescribing a verification mechanism under the Act were still awaited when this policy was written; we will adopt what they require, update this policy, and seek fresh consent where the change calls for it.
WHAT WE COLLECT ABOUT A CHILD. The same categories set out in section 4, and no more: account and contact details, an age band rather than a date of birth, learning and coaching records, gameplay and practice records, messages within the platform, and attendance. We do not ask a child for a home address, a school name, a phone number, a government identity document, or a photograph beyond an optional avatar. We do not require a child to disclose more than is needed to take part, and no feature is gated behind giving us extra personal data about a child.
ASK C4 AND CHILDREN. A child can use Ask C4, our chess chat. The questions a child types are kept in the question log described in section 4, with email addresses and phone numbers removed, and staff review them without names. A child member's conversations are saved so the child can reopen them, and only the child can see them. The chess profile that Ask C4 can keep for adults is never kept for anyone under 18, or for anyone whose age we cannot place: the chat does not ask a child about their chess, and our database refuses to store a profile for an account that is not recorded as 18 or over. A guest using Ask C4 has no history and no profile.
NO TARGETED ADVERTISING TO A CHILD, NO CROSS-SITE TRACKING OF A CHILD, NO PROFILES. Section 9(3) of the Act prohibits tracking, behavioural monitoring and targeted advertising directed at children. C4Chess shows no advertising to anyone, so no child is shown an advertisement of any kind, targeted or otherwise. We do not follow a child across other websites, we do not build advertising profiles of children, and we do not sell or share a child's data for anyone else's marketing.
ANALYTICS, STATED PRECISELY, BECAUSE THIS IS THE HARD CASE. Where you have accepted optional cookies, Google Analytics 4 runs. We report it here rather than filing it under a general reassurance, because it is the one thing on this platform that sits closest to the section 9(3) line and we would rather you judged it than took our word. What it does: it assigns your browser a randomly generated identifier that persists between visits, and it records the pages you view and a set of named events describing what was used — a puzzle attempted, a lesson opened, homework submitted. What we do not send it: your name, your email address, your account ID, whether you are a student, your messages, your homework, your games, or the text of anything you search for. Every advertising signal is denied for everyone, so this cannot feed an advertising profile. It is switched off entirely for anyone who declines.
We are not going to tell you that this is beyond argument. A persistent identifier plus a sequence of activity is not the same thing as a headcount, whatever it is called, and whether consented analytics inside a portal used by children falls within "tracking or behavioural monitoring" in section 9(3) is not a question we should decide in our own favour in our own privacy policy. It is one for our legal advisers and ultimately for the Data Protection Board. We are separately reviewing whether analytics should run on signed-in pages at all, as against public pages only, with first-party aggregate counting behind the sign-in. If that review moves the line, we will move with it and say so here. In the meantime the control is yours: Settings → Account → Analytics cookies, and declining costs you nothing on this platform.
CLOUDFLARE WEB ANALYTICS, FOR A CHILD. This one runs for children too, on every page, without asking, and we want you to know that rather than find it. It is not the same as the case above: it gives a child's browser no identifier, stores nothing on the device, and does not connect one page view to the next, so it records that a page was viewed, not who viewed it or what that person went on to do. That is why we believe it is a headcount and not tracking or behavioural monitoring. But it does involve a child's IP address and the page reaching Cloudflare, it is done without consent, and we are not going to decide in our own favour whether that is acceptable under section 9(3); it is with our legal advisers alongside the question about Google Analytics, and section 9 sets out exactly what it measures.
NO HARM. Section 9(2) of the Act prohibits processing that is likely to cause any detrimental effect on the wellbeing of a child. This is why classes are not recorded, why a child's friend list is never shown to anyone else, why messaging is confined to the platform and moderated, why grooming and any attempt to move a child to a private off-platform channel are absolute grounds for removal, and why we treat a safety report about a child as an escalation rather than a ticket.
WHAT A CHILD'S DATA IS NEVER USED FOR. It is never sold. It is never shared for anyone else's marketing. It is never used to train an artificial-intelligence model. It is never used to advertise to the child. It is never published outside the platform.
HOW A GUARDIAN EXERCISES RIGHTS FOR A CHILD. A parent or legal guardian may, on the child's behalf: ask what personal data we hold about the child and why; ask for a copy; ask us to correct or complete it; ask us to erase it; ask us to stop a particular use; withdraw consent; and complain. Write to privacy@c4chess.com from the email address on the account or the linked parent account, tell us the child's account email, and say what you want. If we cannot tell that the request comes from the guardian, we will ask for enough to establish that, and no more — we will not ask you to send an identity document.
OUR RESPONSE. We acknowledge within 48 hours and respond within 30 days. There is no charge. If we cannot do what you have asked — for example where we must keep a financial record to comply with tax law — we will tell you exactly which part we cannot do and why.
WITHDRAWING CONSENT. A guardian may withdraw consent at any time, and it is as easy to withdraw as it was to give. Because a child's data is processed on the basis of that consent, withdrawing it means we can no longer lawfully provide the service to that child, and the account will be closed and the data deleted or anonymised on the schedule in section 16. We will explain that consequence and confirm before we act, never afterwards.
IF A CHILD UNDER 13 HAS REGISTERED WITHOUT A GUARDIAN. Tell us at privacy@c4chess.com and we will suspend the account and delete the data unless a guardian confirms consent. We would rather hear about it than not.
IF YOU ARE A YOUNG PERSON READING THIS. You have rights too, and you can write to us at privacy@c4chess.com yourself. If we need to involve your parent or guardian before we act, we will tell you that we are doing it. If someone on C4Chess makes you uncomfortable, or asks to talk to you somewhere else, use the report button or tell a coach. You will not be in trouble.
12. Live online classes
Live classes run over infrastructure provided by LiveKit. While you are connected, your audio, video and any screen you share pass through that infrastructure to the other participants in your class in real time.
We do not record classes. The platform has no recording function and stores no video or audio of a session. What is stored from a class is the fact and timing of joining and leaving, and any notes a coach writes afterwards.
Participants are not permitted to record either. This rule exists because these rooms contain children.
Some meetings can be joined by a guest through a link and a code, with the host admitting them. A guest's display name is visible to the other participants for the duration of the session.
13. Who we share personal data with
We do not sell personal data. We share it only with the providers that make the service work, and only with what they need, under contracts requiring them to protect it and to use it only on our instructions.
Supabase — the database, sign-in, file storage and server functions behind the platform. Effectively all of the data described in section 4 is stored here. Hosted in the ap-south-1 (Mumbai) region.
Cloudflare — hosting and content delivery for the website, and Cloudflare Web Analytics, which counts page views and page-load times on every page as described in section 9. Receives request metadata such as IP address, browser information and the page requested in the course of serving pages, and the page-view reports from its measurement script. It sets no cookie and no identifier for analytics.
LiveKit — real-time audio and video for live classes. Receives the media stream while a class is in progress and a participant identity and display name. No recording.
Resend — delivery of transactional and notification email, such as welcome messages, class reminders, one-time codes, and staff notifications. Receives the recipient's email address, name, and the content of the message.
Meta Platforms (WhatsApp Business Cloud API) — class reminders by WhatsApp. Built, but switched off: no reminder is being sent this way and no phone number is reaching Meta as at the last-updated date. If it is switched on, it would receive the phone number and the reminder details, and only where a number has been given for that purpose.
Google — Analytics as described in section 9, only after you accept optional cookies; sign-in with Google if you choose to use it; the YouTube privacy-enhanced player for the video library, which sets no cookie until you press play. We do not use Google AdSense or any other advertising service. Note what is not on that list: the typefaces used across the site are served from our own domain rather than from Google Fonts, so an ordinary page load no longer fetches anything from Google to render itself. The YouTube player and Google sign-in are different — they contact Google when you use them, and the privacy-enhanced player changes what is stored and personalised rather than preventing the request.
Apple — sign-in with Apple is built into the platform but is currently switched off. If it is enabled, Apple will receive the fact of a sign-in and will share the identifiers you permit.
Translation providers — where you read the portal in a language other than English, the text being translated is sent to a translation service. By default that is MyMemory; a self-hosted service is used where one is configured, and an AI provider only if that option is deliberately switched on. What is sent is stored content — articles, lesson and opening text, and these legal documents — and each distinct string is translated once and then cached, so it is not re-sent for every reader. Your own messages, homework submissions and personal details are not sent for translation.
Anthropic — used to generate ChessDaily articles from public chess news, which involves no user data. The optional in-app coaching explanations feature can also use it; it is switched off by default, and when it is switched on it is sent a summary of a game (result, opening, moves, accuracy figures, key moments and the opponent's username) and any question you type, but not your name, your email or your account ID.
Chess.com and Lichess — where you ask us to prepare for an opponent or analyse a player, we fetch that player's publicly available games from those services using the username you enter — or, for a FIDE ID, their games from Lichess's broadcasts of over-the-board events and their FIDE profile from Lichess's copy of the FIDE rating list. Nothing about you is sent beyond the request itself.
FIDE — where you scout a player by FIDE ID, we read that player's rating history from FIDE's rating website. Nothing about you is sent beyond the request itself.
Content delivery networks — chess piece artwork and country flag images are loaded from public CDNs, which receive your IP address and browser information as part of serving the image.
Ask C4 shares nothing with anyone outside C4Chess. Its read-aloud button uses the voices built into your own device or browser; some browsers offer voices that are an online service of the browser's maker, and if you choose one of those in Settings → Accessibility, the text being read is processed by that browser maker under its own terms, not by us.
Others, where necessary: professional advisers under a duty of confidence; a purchaser or successor if the business is transferred, with your rights preserved; law-enforcement, a court, or a regulator where we are legally required to disclose or where it is necessary to protect a person, particularly a child, from harm.
14. Artificial intelligence on the platform
ChessDaily articles are generated by an AI model from public chess news and tournament data, and are passed through an automated child-safety and accuracy review before publication, with anything that does not clear the review held for a human. No user data is involved in producing them.
Translation of stored content into other portal languages may use an automated translation service. Machine translations are reading aids; the English text of these legal documents is the version that governs.
Game analysis, ratings, puzzle selection and mission recommendations are produced by our own software running on our own infrastructure. They are calculations, not AI models trained on your data.
Ask C4, the chess chat, is not an AI language model. It answers from rules and lessons our team wrote, our own chess engine, our opening book, our puzzle bank and our master-game library. Nothing typed into it is sent to an AI provider.
An AI-assisted coaching explanation feature exists and is switched off by default. It is never enabled without a deliberate decision, and section 13 sets out exactly what it would send.
We do not use your personal data, your games, your homework or your messages to train any AI model.
15. Where your data is stored, and international transfers
The database, files and sign-in system that hold the substance of your personal data are hosted in India, in the ap-south-1 (Mumbai) region.
Some of the providers listed in section 13 operate globally, so certain data is processed outside India: website hosting and content delivery, live-class media routing, email delivery, analytics and translation, along with the image CDNs that serve chess piece artwork and flags to your browser.
Where personal data leaves India, we rely on the transfer being permitted under section 16 of the Digital Personal Data Protection Act, 2023, and on contractual protections with the provider — including, where the provider offers them, standard contractual clauses and a data processing agreement restricting use to our instructions.
We do not transfer personal data to any country that the Central Government has restricted.
16. How long we keep personal data
We keep personal data only as long as the purpose it was collected for requires, and then delete it or reduce it so that it no longer identifies you. The periods below are our policy rather than a description of an automated schedule, and we say that plainly: building the jobs that enforce them is work in progress.
Active accounts — for as long as the account is open.
After an account is closed or consent is withdrawn — deletion from the active user-facing database begins immediately when you close the account yourself from Settings, and within 90 days where we close it for you. One of two things results. Usually the profile is deleted outright, and everything attached to it goes with it: your games, ratings and rating history, experience points, friendships, notifications, analysis, homework and any reports you filed. Where a record must legitimately survive — a payment, a support ticket, a certificate, an attendance row — the profile cannot simply be removed, so it is instead reduced to a shell: name, email address, phone number, avatar, bio and date of birth are destroyed and the public identifier is replaced with a meaningless one. Your sign-in is deleted either way, so nobody can sign in as you again.
Two honest qualifications on that. First, residual copies may remain temporarily in encrypted backups, security logs or a service provider's systems until they are overwritten or expire under the applicable retention schedule; "deleted immediately" describes the live system you use, not every copy in existence. Second, a shell record that still points at a payment or an attendance row is pseudonymised rather than anonymous — it no longer names you, but it has not been severed from a record that relates to you, and we would rather say so than claim a standard we cannot meet.
Inactive accounts — where an account has not been signed into for 3 years, we will notify the account holder and, absent a response, close and delete it.
Learning and coaching records for an enrolled student — for the duration of enrolment and 3 years afterwards, so that a former student or their guardian can obtain a progress record, a certificate reissue, or a reference.
Payment and accounting records — 8 years from the end of the relevant financial year, as required of an Indian company by the Companies Act, 2013 and tax law. These records are kept even after an account is deleted, and are reduced to what the law requires.
Consent and acceptance records — for as long as the account exists and 3 years afterwards, because they are the evidence of what was agreed.
Safety reports, moderation records and abuse investigations — 3 years, or longer where a matter has been reported to an authority or is the subject of proceedings.
Security and access logs — 12 months.
Support correspondence — 2 years from the ticket being closed.
Class attendance events — for the duration of enrolment and 3 years afterwards, alongside the coaching records they belong to.
Guest data — a guest's browser token and locally stored progress live only in that browser and are removed when the browser's storage is cleared.
Analytics data — retained by Google for the period set on the Analytics property, which we keep at the shortest option available.
Scout cache of public games and ratings — kept so later reports on the same player are fast; a report is rebuilt from fresh data after 7 days. We do not yet delete cached public games on a schedule, and say so; a scouted player can ask us to remove theirs at any time.
Scout uploads and My Scout Profile — until the member replaces or deletes them, or closes the account, which deletes both.
C4 Coins balance, coin history, daily-chest claims and Shop items — for as long as the account is open; they are deleted with the account and do not expire before then.
Class booking requests — for as long as the account is open, and deleted with it. Once a class is scheduled, its batch, schedule and attendance are kept as learning and coaching records, as above.
Ask C4 question log — up to 2 years, and a member's entries are deleted with the account. Guest entries carry no identity.
Ask C4 chat history — until the member deletes a conversation or all of them from the chat's History panel, or closes the account.
Ask C4 chess profile — until the member changes or deletes it from "My chess profile" in the chat, or closes the account.
You can ask us to erase your data sooner. Section 17 explains how, and what we cannot delete.
17. Your rights, and how to exercise them
Under the Digital Personal Data Protection Act, 2023 you have the right to obtain a summary of the personal data we hold about you and how it is processed, and the identities of those we have shared it with; the right to have inaccurate or incomplete data corrected, completed or updated; the right to have your data erased where we no longer need it for the purpose it was collected for or where you withdraw consent; the right to withdraw consent at any time, as easily as you gave it; the right to nominate another person to exercise these rights if you die or become incapacitated; and the right to a grievance procedure, described in section 18.
A parent or legal guardian exercises these rights on behalf of a child, as set out in section 11.
You can erase your account yourself, without asking us. Portal → Settings → Account, at the bottom, under "Close your account". You confirm by typing a phrase and by proving it is you — your password, or a code emailed to you if you sign in with Google — and the account is then destroyed straight away rather than queued for someone to action. A right you have to request is a right somebody can be slow about; this one you exercise directly.
Some Ask C4 data you can manage yourself, at any time and without asking us: delete one saved conversation or all of them from the History panel in the chat, and see, correct or delete your chess profile from "My chess profile" in the chat.
Four kinds of account cannot use that button, and are routed to us instead. A staff account, because it is an employment record. An enrolled student whose fees are paid, because closing mid-enrolment has billing and safeguarding consequences that need a person. A child, because a child's own click is not a valid erasure request — a linked parent or guardian has to make it. And an account whose age we cannot currently place on either side of 18, for the same reason: we cannot rule out that it belongs to a child. In each case write to privacy@c4chess.com and we will deal with it.
To exercise any other right, write to privacy@c4chess.com from the address on your account, saying what you want. There is no fee. We acknowledge within 48 hours and respond within 30 days. We will ask only for what we need to be sure it is really you, and we will not ask you to send an identity document.
What we may not be able to delete: records we are legally required to keep, principally payment and accounting records for 8 years; records needed to establish, exercise or defend a legal claim; and safety and moderation records where deleting them would put another user at risk. We will tell you specifically which of these applies and delete everything else.
Where deleting a child's account is requested, we delete the child's personal data and reduce any retained financial record to what the law requires, with the child's identifying details removed where that is possible.
Withdrawing consent does not make anything we did beforehand unlawful, but it stops the processing that depended on it from that point.
If you are in the EU or UK, you may additionally have rights of access, rectification, erasure, restriction, objection and portability under the GDPR, and a right to complain to your local supervisory authority. Write to the same address.
18. Grievances, and how to escalate
If you are unhappy with how we have handled your personal data, or with our response to a request, contact our Grievance Officer, Surya Tribedy, at privacy@c4chess.com, or by post at C4Chess Education Private Limited, 4th Floor FL-4C, 83 S.P. Mukherjee Road, Kalighat, Kolkata - 700026, West Bengal, India. Please describe the problem, the account it concerns, and what you would like us to do. We acknowledge within 48 hours and respond within 30 days.
Before approaching the Data Protection Board of India under the Digital Personal Data Protection Act, 2023, a Data Principal is required to exhaust the grievance-redressal opportunity provided by C4Chess. This does not restrict any other remedy that may independently be available under applicable law. So please raise it with us first — not as a courtesy, but because the Act asks you to — and if you remain dissatisfied afterwards, you may complain to the Board.
Complaints about the service rather than about data can go to support@c4chess.com, and consumers retain the right to approach a Consumer Disputes Redressal Commission under the Consumer Protection Act, 2019.
19. Security
Passwords are stored only as cryptographic hashes. Traffic is encrypted in transit. Access to data in our database is restricted by row-level security rules so that a user can reach their own records and a member of staff can reach only what their role requires.
The storage buckets holding certificates, portal content, student profile files and student avatars are private: their objects are not served from public URLs and are opened through short-lived signed links instead. Sensitive staff actions, including administrative access to and deletion of member accounts, are written to an audit record.
Analytics is suppressed on pages whose address could carry a sign-in or password-reset token, so a credential cannot leak to a third party in a URL.
We update third-party libraries and review our access rules periodically, and we treat a reported security issue as a priority. We are describing a practice here, not a guarantee that every dependency is on its newest release at any given moment.
No system is perfectly secure. If a breach occurs that affects your personal data, we will notify you and the Data Protection Board of India as the Digital Personal Data Protection Act, 2023 requires.
Please help: use a password you do not use elsewhere, do not share your account, and tell us at support@c4chess.com if something looks wrong.
20. Users outside India
C4Chess is operated from India and is aimed at families in India, but the platform is reachable elsewhere. If you use it from outside India, your personal data will be processed in India and in the other locations described in section 15.
Where a law of your own country gives you rights that this policy does not describe, those rights are not taken away by this policy. Write to privacy@c4chess.com and we will deal with your request under the law that applies to you.
21. Changes to this policy
We may update this Privacy Policy. Each version carries a version identifier and a last-updated date, and we record which version you accepted and when.
Where a change is material — a new category of data, a new purpose, a new recipient, or anything affecting children — we will give notice in the portal or by email before it takes effect, and seek fresh consent where consent is the basis for the change.
The current version is always at /legal/privacy. Questions: privacy@c4chess.com.