Cookie Policy

1. Overview

Short version: TrueElo uses no advertising or cross-site tracking cookies. Sign-in uses Lichess, Google or email, with the account session persisted in your browser. Your saved chess work is kept privately under your own account. Anonymous visit counts store nothing on your device; full analytics sets a first-party identifier only, and in Europe only after you allow it.

2. What Are Cookies?

Cookies are small text files stored on your device by websites you visit. They are commonly used for:

• Tracking users across websites (advertising)
• Session management (login state)
• Remembering preferences
• Analytics and usage metrics

Cookies are automatically sent to the server with every request, which enables tracking and identification.

3. Why TrueElo Minimizes Cookies

TrueElo is designed to minimize cookie usage:

• Browser-based session storage: Firebase keeps your account session in browser storage; an optional Lichess token lives in local storage
• No ad network: We don't serve third-party ads or use analytics for cross-site ad targeting; we do measure which campaigns bring visitors to TrueElo
• No cross-site tracking: No third-party tracking or profiling cookies
• Your data is yours: Your repertoire, drill progress, and settings are kept under your own account, not readable by other players

4. Storage Instead of Cookies

TrueElo uses browser storage for sign-in, preferences, caches, and analytics identifiers:

• We do not use these identifiers for advertising or cross-site tracking
• Your sign-in token is never stored on our servers — each time it is sent, it is used for that request and dropped
• Your saved lines, drill progress, Leaks reports and settings are kept under your account, not readable by other players, and cached on each device you sign in to
• You can export or delete your saved account data. Deleting saved data does not delete analytics or recordings; deleting your account deletes those linked to it.

5. What We Store, and Where

Kept in this browser, and never stored on our servers:

• Account session: Firebase credentials keep you signed into the same saved account; signing out clears them from this browser.
• Lichess connection: An optional Lichess token, removed on sign-out, supplies protected opening data and can accompany Lichess report requests. TrueElo uses provider proof for the request and does not store that proof on its own backend.
• Sign-in return state: Google and Lichess keep temporary one-use flow state in this tab's session storage. Email keeps the requested address, purpose and return path in local storage so another tab can finish. A new device may ask for the address again. These records are validated for expiry before use.
• Game statistics: How often each move won, drew and lost in public games, fetched directly from Lichess and cached against the position on this device
• Engine results: The analysis your browser computed in the analyzer and drills, cached so it does not have to compute it twice
• Leaks report in progress: Which report this browser is following while TrueElo's servers read it, so coming back shows it; removed once this browser sees it end
• Earlier reports being removed: A marker that this browser asked for the reports made before Leaks was rebuilt to be removed, so an interrupted removal finishes on your next visit; cleared when it is done
• Short questions: Which of our short questions you answered or skipped on this device, and the day one was last asked, so none is asked twice and no more than one a day; an answer you have started is kept only until the tab closes
• Drill streak: Your run of consecutive days. This one is per-device and does not follow your account
• Analytics choice: Whether this browser allowed full analytics, chose “Not now” (with the time, so it is asked again after four months), or is excluded
• Theme: A copy of your light or dark choice, so the page can paint correctly before you sign in. The choice itself is a preference and follows your account (section 6).

Kept under your account, and cached on each device you sign in to:

• Settings: Your preferences
• Saved lines and drill progress: The work you choose to save
• Leaks reports and practice: Your reports and the positions they gave you to practise, which TrueElo's servers write when they read your games

Kept under your account on TrueElo's servers only, never sent to your devices: the engine's evaluations of your positions and the Lichess games a report read, without the opponents' names.

See our Privacy Policy for more information.

6. Authentication and Analytics Storage

Lichess and Google use provider redirects with PKCE; email uses a sign-in link delivered by Firebase. Firebase persists the admitted TrueElo account session. Google and Lichess may set cookies on their own sites during those redirects, under their respective privacy policies. The optional Lichess token is kept in this browser's local storage and removed when you sign out.

Anonymous visit counts store nothing on your device. PostHog keeps their random identifier in the page's memory, so each page load gets a new one, and reads basic device facts in the browser, such as screen size, language and the user-agent string, to send them.

Full analytics stores a first-party identifier in local storage to connect page visits, including visits without an interaction, and duration, campaign attribution, product events, performance measurements, and session recordings. Recordings begin after interaction. Signing in links earlier browser activity to your TrueElo account ID, which does not contain your chess username or email. In Europe it starts only after you press “Allow analytics”; elsewhere it is on unless you change it. The Privacy Policy explains what each tier contains and what recordings show.

7. Third-Party Services

TrueElo connects to third-party services for functionality:

• Lichess for authentication (OAuth2) and game statistics
• Google for optional identity sign-in, and Firebase for email sign-in links
• Firebase for your own saved data, sign-in, and account access
• PostHog for product analytics, session recordings, and error diagnostics
• Formspree for the contact form
• Lemon Squeezy for checkout and for managing a Plus plan. Those pages open in a new tab and set Lemon Squeezy's own cookies under its policy.

We do not embed advertising networks or social media widgets that use tracking cookies.

8. Clearing This Browser

You can clear TrueElo's browser storage at any time:

Note: This clears this browser only. Your saved lines, drill progress, Leaks reports and settings are kept under your account, so signing in again brings them back. Clearing site storage also clears this browser's analytics choice, so a European browser is asked again; it does not delete analytics already sent. To delete saved account content, use “Delete everything” in Settings.

9. Analytics Choice

Authentication storage lets you access your account. Analytics storage connects usage events and recordings. These serve different purposes. Full analytics in Europe rests on your consent; visit counts, and full analytics elsewhere, rest on our legitimate interest in seeing how the product is used and where it fails. The choice is per browser.

10. What You Can Control

We do not use advertising or cross-site tracking cookies. To allow full analytics, keep only anonymous visit counts (“Not now”), or exclude this browser from analytics, session recordings and error reporting, use “Analytics choice” at the foot of every page or the control on the Privacy Policy page. Exclusion stops future collection in this browser and removes what PostHog stored here; it does not delete events already sent to PostHog. Deleting your account deletes the events, recordings and answers linked to it.

11. Contact

For questions about this Cookie Policy, use the contact us.