Privacy Policy — Corallium Chess
Effective: [FILL DATE]
Operated by: [FILL ENTITY NAME], SSM No. [FILL], [FILL ADDRESS]
Contact: arunghayatsports@gmail.com · +6011-6286 8874
In short
Corallium Chess is built so that most of your child's data never leaves your phone. Chess games, reviews and coach records are stored only in your device's browser.
What we keep on our servers is only what an account and billing require: your email address, subscription status, and payment records.
1. What we collect
1.1 On our servers
| Data | Why | Where |
|---|---|---|
| Email address | Identifies your account and links your subscription | Supabase |
| Password (hashed) | Sign-in | Supabase Auth |
| Subscription status and dates | Determines whether access is active | Supabase |
| FPX payment records | Payment confirmation and accounting | Supabase + Billplz |
| App preferences | So language and level settings follow you across devices | Supabase |
1.2 On your device only
Never sent to us:
- Chess games you enter or paste
- Review history and recurring themes
- Coach records: name, fees, and rating points you enter yourself
- Your child's colour and strength settings
- Your acknowledgement of the "practice sessions only" notice
Clearing your browser data deletes all of this permanently. We hold no copy.
1.3 What we do not collect
We do not collect your child's name, age, school, photograph, location, or MCF or FIDE registration number. The app never asks for any of these.
2. Data about children
The account holder is an adult parent or guardian. Children do not register accounts and do not sign in.
The games you review are your child's games, but they stay in your browser. We do not see them, store them, or use them for any purpose.
If you paste a PGN from Lichess or Chess.com it may contain your child's online username. It still stays on your device.
3. Third parties
| Party | Role | What they see |
|---|---|---|
| Supabase | Database and authentication | Email, hashed password, subscription status, settings |
| Billplz | FPX payment processor | Name, email, amount, bank reference |
| Vercel | Website hosting | Standard server logs: IP address, request time, browser type |
| jsDelivr | Serves font files | Your IP address when fonts load |
The Stockfish engine runs entirely in your browser. No chess position is ever sent to a server for analysis.
We use no Google Analytics, no advertising pixels, and no third-party tracking. We do not sell data to anyone, and no advertiser has access to anything.
4. How long we keep it
| Data | Period |
|---|---|
| Account and email | Until you ask us to delete it |
| Subscription and payment records | Seven years, as accounting records require |
| App preferences | Until the account is deleted |
| Data on your device | Until you delete it yourself |
5. Your rights under PDPA 2010
You have the right to access, correct, withdraw consent and request deletion, and limit processing of your personal data.
Send requests to arunghayatsports@gmail.com. We will respond within 21 days.
To delete on-device data, clear site storage for www.corallium.my in your browser settings, or use the "Clear history" buttons in the app.
6. Security
Passwords are never stored in plain text. All connections use HTTPS. Payments are handled entirely by Billplz — we never see or store your card or banking details.
We will notify you by email within 72 hours of any data breach affecting your information.
7. Cookies and browser storage
We use no tracking cookies. We use browser local storage to keep your sign-in session and the data listed in Section 1.2. This is required for the app to work.
8. Changes to this policy
If we change this policy in a way that affects your rights, we will email you at least 14 days before it takes effect.
9. Complaints
If you are unhappy with how we handle your data, contact us first at arunghayatsports@gmail.com. You also have the right to complain to the Personal Data Protection Department (JPDP), Malaysia.