Privacy Policy — Corallium Chess
Effective: 31 August 2026
Provider: Corallium Tech (Registration No. SPA/2026/6433)
Contact: arunghayatsports@gmail.com · +6011-6286 8874
Corallium Chess is a tool for parents, not for children. Its user is an adult sitting beside their child during practice, trying to understand what is happening on the board. The child does not register, does not sign in, and does not use this app.
This policy covers the data we collect when you use Corallium Chess at www.corallium.my/chess/app or through the Corallium Chess Android app (my.corallium.chess).
1. What we do NOT collect
This comes first because it is what matters most to a parent.
- No child's name. The app has no field for a name, age, school or rating. Companion Mode keeps no per-student record of any kind.
- No chess games are sent to us. Every game you follow and save for Review is stored in your browser's local storage on that device alone. It is never uploaded.
- No chess analysis leaves your device. The Stockfish engine runs entirely inside your browser. Board positions are not sent anywhere to be analysed.
- No telemetry, no third-party analytics, no advertising trackers. The app loads no analytics scripts and shows no advertising.
- No photos, files, location, contacts, microphone or camera. The only permission the Android app requests is internet access.
- No in-app purchases on Android. That app sells nothing and processes no payment.
2. What we do collect
| Data | When | Why |
|---|---|---|
| E-mail address | When you register an account | Identifies your account and ties the subscription to it rather than to one phone |
| Password | At registration | Stored as a hash by Supabase. We never see your password |
| App preferences | When you change language or other settings | So the same settings appear when you sign in on another device |
| Subscription record | When a trial starts and each time a payment is processed | Determines whether your account has access |
| Payment records | When you pay | Accounting records and dispute support |
We do not sell your data, and we do not share it with third parties for their own marketing.
3. Errors and technical support
When the app hits an error, the details are recorded on your device only — the last 20 entries, in your browser's local storage. Nothing is sent automatically.
If you tap "Report a problem", the app prepares a draft e-mail containing those errors plus your browser build, screen size and device language. You see the full contents before sending, and you are the one who sends it. The draft contains no account e-mail address, no game data and no chess positions.
4. Who processes data on our behalf
| Party | Role | What it sees |
|---|---|---|
| Supabase | Database and account authentication | E-mail, password hash, app preferences, subscription records |
| Vercel | Website and application hosting | Ordinary request logs including IP address |
| Cloudflare Turnstile | Blocks bots on the sign-up, sign-in and password reset forms | Browser signals and IP address during that check only |
| jsDelivr | Delivery network for the fonts the interface uses | Your IP address while the fonts download. It is not a tracker and sets no cookie for us |
| Billplz | FPX payments for subscriptions bought through the website | Name, e-mail and amount for that bill |
The Android app sells nothing, so no payment processor is involved there. Subscriptions are bought through the website, and the app only reads their status to decide whether the Board opens.
Some of these parties run servers outside Malaysia, so your data may be stored or processed abroad.
5. How long we keep data
- Account and settings — for as long as your account exists.
- Payment records — retained after account deletion, because tax and accounting law requires it.
- Data on your device (saved games, error log, settings) — stays until you clear site data in your browser, or uninstall the app.
6. Your rights
- See the data we hold about you.
- Correct anything inaccurate.
- Delete your account — see the *Delete Account* page for how, and what it means.
- Withdraw consent by stopping use of the service and deleting your account.
E-mail arunghayatsports@gmail.com from your account address. We reply within 14 working days.
7. Security
All traffic between your device and our servers is encrypted over HTTPS. Access to account data is enforced at the database level so that one account cannot read another account's rows.
No system is perfectly secure. If a data breach affects you, we will notify you at your account e-mail address.
8. Children
Corallium Chess is intended for adults aged 18 and over. We do not knowingly collect personal data from children, and the app provides no place to enter information about your child.
9. Changes to this policy
If we change this policy in a way that reduces your protection, we will tell you at your account e-mail address before it takes effect. The effective date above always reflects the current version.