Privacy Policy

The data controller or responsible operator is [full legal name], [registered address]. Privacy contact: [privacy contact email]. This notice applies to the Trạng Cờ website and browser extension at [official domain and store listing].

The exact information depends on the feature used and the released configuration. The current product flow is intended to process a captured board image on the user's device. When the user requests engine analysis, the extension sends the board position in FEN format and selected analysis settings to the Engine API. It does not need to upload the screenshot pixels for that analysis request.

The service may also process:

Do not publish this list until it has been checked against the production extension, API, authentication, analytics, and payment configuration.

• Sign-in identifiers and account profile details returned by the selected identity provider, currently Google sign-in where enabled.
• Account, credit, entitlement, and request records needed to provide features and prevent abuse.
• Technical and security information such as request time, application version, and error details, if collected by the deployed API.
• Payment or transaction status through a payment provider only if paid access is enabled. The provider and the exact fields received by Trạng Cờ must be confirmed before checkout is offered.
• Essential preference cookies for language and appearance. [Confirm whether analytics or other optional cookies are enabled in each deployment.]

The operator may use the information above to provide requested analysis, maintain accounts and entitlements, secure the service, troubleshoot failures, and meet legal obligations. [The operator must identify and document the applicable legal basis for each purpose before publication.]

Position data and analysis settings are sent to the Engine API when the user requests analysis. Google may process sign-in data when Google authentication is used. A payment provider may process payment details if paid access is later enabled. [List the actual provider entities, locations, and contracts before publication.] Do not enter payment-card details on this landing page.

[Confirm hosting locations, access controls, encryption, logs, backups, and retention periods for account, position, usage, and transaction records.] The operator should retain each category only for a documented purpose and period, then delete or anonymize it as appropriate. The screenshot-local-processing statement above must be checked against the shipping extension and API before release.

[Identify whether data is transferred outside the user's country, the destination countries, and safeguards that apply.] Do not treat this section as complete until the hosting, authentication, analytics, engine, and payment providers have been checked.

Users may be able to access, correct, delete, or request information about personal data, subject to applicable law. The process, response channel, identity checks, and any applicable deadlines must be confirmed at [privacy contact email or request page]. Account deletion must also explain how legally required transaction records are handled.

The operator must set and publish the intended age requirements at [minimum age / guardian process]. Trạng Cờ may be used while viewing third-party sites; those sites have their own privacy terms and are not controlled by this notice.

The final notice should state how material changes are announced and the effective date. Questions or privacy requests: [privacy contact email]. Operator: [full legal name and address].