Privacy policy

Last updated 29 July 2026

Chess Pretraining is a small research project run by Brendan Long. This page says exactly what it stores and what happens to it. It is short because the data footprint is small: there are no ads, no analytics, and no third-party trackers.

What we collect

• An anonymous user record, created the moment you first load the page: an internal id, when it was made, how many trials you've answered, your rating, and the state of the calibration staircase. You aren't asked for a name and none is guessable.
• One row per trial you answer: which position you saw, which move you picked, whether it was correct, how long you took, when you answered, and your rating before and after. This is the research record, and it is recorded whether or not you ever make an account.
• Account details, if you make an account: the username you choose, a hash of your password (never the password itself), and an email address only if you supply one. Email is optional and unverified; its only purpose is resetting a forgotten password.
• A session cookie: one opaque token, HttpOnly, good for a year. The server stores only a hash of it. That cookie is the whole of how the site knows who you are.
• Your Lichess username and rating history, if and when you choose to link a Lichess account. That feature isn't built yet; this page will be updated before it ships, and linking will always be optional.

Settings like replay speed live in your browser's local storage and are never sent to the server. The server writes ordinary request logs, which include IP addresses, and the signup rate limiter holds a count per IP address in memory for up to an hour (until the process restarts, in the worst case) — neither is written to the database or tied to your responses.

What it's for

Two things: running Chess Pretraining for you, and the research it exists for. The point of the project is to measure whether dense labeled practice improves chess perception, and how fast — so your responses will be analyzed in aggregate, and results based on that analysis may be published.

Sharing with other researchers

We may share response data with other researchers or publish it as a dataset. What that data contains:

• A random per-user id — unrelated to your username.
• Your answers: the item, your choice, whether it was correct, timing, and rating snapshots.
• If you have linked Lichess, your rating as a band rather than a number — 200-point bands, with everything above 2200 collapsed into a single top band.

It never contains usernames, email addresses, IP addresses, or password hashes. We do not sell or rent data to anyone, for research or otherwise.

Where the data lives

The app runs on Fly.io, storing a single SQLite database on a volume there, with encrypted backups replicated to Amazon S3 and DNS served by Amazon Route 53. Both the app and its backups are hosted in the United States; which region is an operational choice we may change. Fly.io and Amazon Web Services are the only companies that hold the database, and they hold it as infrastructure providers — they do not get it for their own use.

Cookies

One cookie, the session token described above. No advertising or analytics cookies, because there is no advertising or analytics. If you clear it while playing as a guest, that guest record becomes unreachable for good — there is no other way to find it, which is the same property that keeps anyone else from finding it either. It also means we can't delete it on request: nobody, including you, can point at which record it was. Make an account if you want that option.

Keeping and deleting data

Guest records that answered nothing and went idle are swept automatically. Everything else is kept while the project runs.

If you have an account you can delete it yourself: Settings → Account → Delete account, confirmed with your password. That erases the account, the email on it, its sessions, and every response it ever gave — out of the research data too, not just out of your view. Being signed in is how you prove the account is yours, which is why the button is the main route: the optional email is never verified, so for most accounts there is no address a request could come from.

If you can't reach that button, email self@brendanlong.com from the address on the account and we'll do it by hand. If the account has no email, say so and we'll agree on a way for you to show it's yours — an account nobody can prove they own is also an account anyone could ask us to delete.

Three honest caveats either way. Deleted rows persist in encrypted backups for up to 30 days before those expire. Anonymized data already shared with other researchers or included in published analysis can't be pulled back — though it never contained anything identifying you. And each position keeps a running count of how often it has been answered and how often correctly, which is how the app knows how hard it is; those counters aren't reversible and aren't tied to anyone, so they keep their totals after your rows are gone.

Children

This isn't intended for children under 13, and accounts shouldn't be created by them.

Changes

If what we collect or do with it changes, this page changes, with a new date at the top. The page is versioned in the project repository, so its history is public.

Contact

Questions, deletion requests, or anything else: self@brendanlong.com.