Privacy Policy

Who we are

Square64 is a chess coaching operations product. For this draft, the service is operated by Oleh Rula, an individual based in Poland.

Contact for privacy requests: rulaoleh@gmail.com.

This document is a pilot draft intended to describe current practices honestly (including for Google OAuth branding). It may change before a paid launch. It is not legal advice. We plan to have counsel review terms and privacy before charging customers.

Who this policy covers

Our contracting users are coaches who create accounts and use the dashboard.

When a coach adds students or parent contacts, schedules lessons, assigns homework, or sends messages, we also process personal data about those people. Students and parents do not hold Square64 accounts in the current product version; coaches are responsible for how they collect and use that information.

What we collect

Coach account data from Google Sign-In, such as name, email address, and profile identifiers needed to authenticate and operate the account.

Roster and coaching data coaches enter or generate in the product, including student names and contact details, parent or guardian contacts where provided, lesson and schedule information, payment instructions or status coaches record, puzzle homework and related progress, sparring or Lichess-related settings, and public coach profile fields (for example bio, rates, availability, and slug).

Technical and operational data needed to run and secure the service (for example server logs, session cookies, request metadata, and error diagnostics).

Google user data

We use Google OAuth so coaches can sign in and sync coaching lessons with Google Calendar (including related Meet scheduling where the product supports it). The scopes we request are OpenID, email, profile, and https://www.googleapis.com/auth/calendar.events (view and edit events on the coach’s calendars). We do not request full Google Calendar management access.

We use Google user data only to provide and improve these coaching features: authenticating the coach; listing calendar events for conflict detection and availability; creating, updating, and deleting lesson and sparring events; attaching Google Meet where the product supports it; and keeping calendar connection status accurate. We do not sell Google user data. We do not use Google user data for advertising. We do not transfer Google user data to third parties except as subprocessors needed to host and operate the service, or as required by law.

Our use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Data protection and security

We use security procedures to protect the confidentiality of personal data and Google user data we process.

Data in transit between browsers, our servers, and Google APIs is protected with HTTPS/TLS encryption.

Google OAuth refresh tokens are encrypted at rest in our database (AES-256-GCM) before storage. Access to systems that hold account and Google credential data is limited to what is needed to operate and secure the service.

No method of electronic transmission or storage is completely secure. If we become aware of a security incident that affects your personal data, we will take appropriate steps and notify affected users where required by law.

Why we process data

We process coach account and product data to provide the Square64 service the coach asks for, to secure the platform, and to communicate about the service (for example transactional emails).

For student and parent data that coaches store, coaches decide what to enter and how to use it in their coaching relationship. We process that data to host and deliver the features coaches use (roster, calendar, homework links, notifications, and messages). Coaches are responsible for having a lawful basis to collect and use that information, including where minors are involved.

Email

We send transactional emails through our email provider (for example lesson or payment reminders and homework-related notices) when coaches enable those features or when the product sends service messages.

Coaches may also send direct messages to student or parent email addresses from the roster tools. Those messages are initiated by the coach; we transmit them on the coach’s behalf using our email infrastructure.

Minors

Chess coaching often involves students who are minors. We may process minors’ personal data when coaches add it to their roster or related features.

We process that data on behalf of coaches for the coaching tools described above. Coaches must have parental or guardian authority (or another lawful basis) before adding a minor’s information or contacting a minor or parent through the product. We do not claim COPPA certification or any similar special certification.

Subprocessors

We use the following categories of service providers to operate Square64:

Vercel - hosting the web application.

Railway - hosting the API and PostgreSQL database.

Google - authentication and Google Calendar integration.

Resend - sending email.

Sentry - error monitoring and performance diagnostics.

Lichess - optional OAuth connection for sparring-related features coaches enable.

These providers process data only as needed to provide their services to us.

Retention and deletion

We retain account and coaching data while the coach’s account remains active and as needed to operate the service, resolve disputes, or meet legal obligations.

Self-serve account deletion is not available yet. To request deletion or a copy of your coach account data, email rulaoleh@gmail.com. We will respond within a reasonable time. Student or parent data requests may need to go through the coach who controls that roster, depending on the request.

International transfers

We primarily target coaches in the European Union. Some subprocessors may process data in other countries (including outside the EU). Where that happens, we rely on appropriate safeguards offered by those providers (such as standard contractual clauses) where applicable.

Your rights

Depending on applicable law (including the GDPR for individuals in the EU/EEA), you may have rights to access, correct, delete, or restrict processing of your personal data, and to lodge a complaint with a supervisory authority.

Coaches can update much of their profile and roster data in the product. For other requests, contact rulaoleh@gmail.com.

Changes

We may update this Privacy Policy as the product evolves. Material changes will be reflected on this page with an updated version id and effective date. Continued use of the service after changes take effect means you acknowledge the updated policy.

Version: privacy-v3. Effective date: 2026-08-13.