Beta policy · Updated October 18, 2026

Privacy Policy

This policy describes the Chessskins website, subscription service, and Chrome extension, operated by SNS INNOVATIONS S.R.L. For privacy questions, contact support@chessskins.com.

Accounts and saved preferences

Firebase Authentication handles email/password and Google sign-in. We use your account ID, email, verification status, and optional display name to operate your account. Firestore stores your favorites, saved loadouts, billing references and access status. Passwords are managed by Firebase; Chessskins application records do not contain your password.

Email/password accounts must verify their email within 48 hours of registration. Scheduled cleanup deletes accounts still unverified after that deadline, after rechecking Firebase. Accounts with billing activity are excluded from that cleanup. Verification delivery is limited to five requests per hour with at least a minute between requests.

Community creations

Draft artwork and uploads are private to their creator. Publishing makes the title, artist credit, source, license notice, collection, and previews public. Reports and moderation actions are available to administrators. Unpublishing or account deletion withdraws discovery and new asset delivery. Immutable revision records and files are retained privately for recovery and attribution review until a reviewed cleanup; previously downloaded public files cannot be recalled. Raw uploads are removed after processing, with abandoned quarantine files eligible for cleanup after 24 hours.

Payments and introductory trials

Stripe collects and processes payment details. We store Stripe customer and subscription IDs, subscription status, trial or paid-period expiry, and checkout-consent records. We never store raw card numbers or security codes.

To enforce one introductory trial per Chessskins account and email, we retain keyed hashes of the account ID and normalized email. We also retain a keyed hash of the card fingerprint supplied by Stripe or, when you use Link, the Link account email supplied by Stripe, plus a trial attempt identifier and claim date. Raw Link account emails and card fingerprints are not saved in these eligibility records. These records help prevent repeated trials and are not used for advertising, cross-site tracking, or blanket IP bans.

Eligibility hashes and minimal deletion tombstones are retained for the lifetime of the introductory-trial program, including after account deletion; they are removed when that program is permanently retired. Checkout operation and consent records are retained while needed to reconcile billing, and are deleted or stripped of account and payment references during account deletion. Stripe may retain its transaction records under its own policies and applicable requirements. Reuse checks have limitations: wallets, replacement cards and regional differences can produce different identifiers. Stripe does not provide the underlying card fingerprint for Link, so we cannot recognize the same card used through different Link accounts.

If you redeem a promotion, we record the code, accepted discount terms, and any associated campaign or creator identifier with the billing attempt and Stripe subscription. This records which offer you chose; opening a promotion link alone does not redeem an offer. Keyed account hashes and minimal redemption evidence prevent repeated use of the same code or campaign, including after account deletion. These records remain for the lifetime of the promotion program and are removed when it is permanently retired. Promotion request limits are temporary and are deleted with your account. We do not share your account or billing details with creators through this promotion system.

Discord linking

Joining the public Discord is free. If you choose to connect Discord, we obtain your Discord user ID and username through Discord authorization. We do not use matching email addresses as proof of ownership or payment. We keep the link and role-sync status to grant or remove subscriber-channel access according to backend entitlement, including eligible trials. OAuth tokens are used temporarily to identify you and are not saved.

Disconnecting or deleting your Chessskins account removes subscriber access and deletes the link after role removal succeeds. Failed role updates remain queued until they can be retried. You are not removed from the public server.

The extension and browser storage

The extension uses Chrome local storage for your active loadout and a bounded cache of authorized images, animated boards, piece animation frames and sound-pack audio. The unlimitedStorage permission accommodates those media files; the cache is limited to the current loadout and its access deadline. Temporary sign-in pairing state uses Chrome session storage, and Firebase persists authentication separately in extension IndexedDB. It accesses Chess.com pages to replace board, piece and sound themes. It does not provide engine assistance or collect a browsing-history feed. The website uses browser storage for draft loadouts and navigation, and a short-lived, HttpOnly cookie protects Discord authorization.

Access is checked by the server. Previously authorized offline access lasts only until the earlier of the entitlement expiry or the configured offline window, which defaults to 24 hours. Signing out clears account-specific extension access and caches.

Service providers and controls

Firebase/Google supplies authentication, application storage and hosting; Stripe supplies payment processing; Discord supplies the optional community connection. Requests to these providers are subject to their own policies. Service logs may include request and operational error information; credentials and raw payment details must not be logged. Chessskins does not sell account data or use these records for targeted advertising.

Administration and service analytics

Authorized administrators can review account creation and sign-in dates, subscription records, favorites, and saved loadouts to operate the service. Website measurements include visits to grouped page areas and estimated foreground time after recent interaction. Optional extension activity reporting requires an explicit choice in the extension before collection begins. You can decline and keep using boards, pieces and sounds, or change your choice in the extension later. Declining or withdrawing permission clears the pending reporting queue and stops new optional reports; it does not remove reports already received. Account deletion removes linked reports as described below.

Optional reporting helps us understand how players use Chessskins and prioritize performance improvements and future updates. If you allow extension reporting, the extension sends account-linked estimates of time when a supported board is visible and focused, you recently interacted with it, and a custom board, pieces, or sound pack is applied. It also reports completed sync outcomes and bounded durations. Your choice explicitly permits authorized administrators to inspect these individual reported times, categories and outcomes for support and improvements to Chessskins. Internal aggregate reports summarize participating clients. Category durations can overlap. Leaving a tab open or syncing in the background does not earn active time. These estimates do not measure games played, moves, opponents, or chess playtime. No raw page URLs, game IDs, chess positions, keystroke contents, pointer coordinates, or browsing-history feed are collected.

Usage is sampled locally and normally batched every two minutes, with bounded flushes when focus or visibility changes. Random session identifiers are hashed by the service; website identifiers live in memory and renew after 30 minutes of inactivity or a change of account. The extension keeps a bounded account-specific upload queue, which is cleared on sign-out or account change. We keep broad website referrer categories, not referrer URLs or fingerprinting data. Signed-in observations are associated with your account; earlier anonymous observations are not retroactively linked. Offline limits, blocked requests and outdated clients reduce coverage, and historical requests are not converted into usage time.

Separate service diagnostics capture authenticated bootstrap responses, coarse origin channels and server latency buckets. Optional client reports include extension versions, sync triggers, terminal outcomes and bounded durations. These distinguish service traffic from active use; they do not prove a game was played or a download was rendered. Essential authentication, entitlement and service requests continue when optional reporting is declined, and the server can retain operational request counts and logs. Successful asset, loadout, favorite and checkout responses are counted separately. Do Not Track and Global Privacy Control override optional reporting when present in the browser or request. Activity records become eligible for scheduled deletion after 90 days; account deletion removes linked activity. Rate limiting uses an hourly rotating hash of the connecting IP address or the authenticated extension account, eligible for removal after two hours. Admin pages are excluded from website tracking.

Chrome Web Store Limited Use

Chessskins uses information received through Chrome APIs to provide and improve its disclosed board, piece and sound customization features, including their operation, security, performance and reliability, in accordance with the Chrome Web Store User Data Policy and its Limited Use requirements. We do not sell this information, use it for personalized advertising or credit decisions, or transfer it to advertising platforms or data brokers. Transfers are limited to the service providers described in this policy where needed for the disclosed features, legal requirements, or protection against fraud and abuse. Human review of optional account-linked extension reports requires the explicit permission described above. Other access is limited to necessary security or legal purposes, user-authorized support, or aggregate and anonymized internal reporting.

During testing, registration may be limited to an administrator-managed email allowlist. Administrative changes are recorded with the administrator’s account ID, email, action, affected setting, and time. Allowlist changes can include the affected email. Audit records contain no secret values and are retained for security review while the service operates.

After signup, you can optionally tell us how you heard about Chessskins and what brought you here. We save your answers, or that you skipped the question, with your account ID and signup date. Only authorized administrators can review them. These records help us understand where new players find Chessskins, stay separate from automatic visit tracking, and are deleted with your account.

Use Account settings to change your profile, manage sign-in methods, disconnect Discord, cancel renewal, or request account deletion. Deletion immediately stops subscription access and renewal, then removes the profile, loadouts and linked-account data once external cleanup succeeds. Limited anti-abuse records described above remain. For privacy questions, use Support; do not post passwords or payment information in public Discord.