Blundr Privacy Policy

Last updated: August 31, 2026

This Privacy Policy explains how Blundr collects, uses, discloses, and protects personal information when you use blundr.io, a Blundr application, or another Blundr service (the “Service”). The data controller or business responsible for the Service is the Blundr operator identified in the Legal Notice linked from the Service footer.

Contact: privacy@blundr.io.

1. Information we collect

Account and identity information

We may collect your email address, authentication identifiers, account ID, account status, age-eligibility confirmation, and information needed to secure and administer your account.

Onboarding and profile information

We may collect information you choose or are asked to provide for training personalization, such as rating band, training priorities, pace, starter repertoire, preferred training mode, goals, and account settings.

Chess training and progress information

We process information generated by your use of Blundr, such as opening and repertoire selections, chess positions and moves, training attempts, correct and incorrect responses, Daily Blundr activity, Review Queue activity, mastery and progress information, streaks, daily rings, rewards, usage history, and training recommendations.

Subscription and transaction information

If you start a Pro trial or paid subscription, we receive billing-related information such as your selected plan, subscription status, trial dates, renewal dates, cancellation status, transaction identifiers, billing country, tax information where required, and limited payment-method metadata such as card brand and last four digits. Our payment processor handles full payment-card numbers and security codes; Blundr does not need to store them.

Device, log, and security information

We may collect IP address, browser or app type, device and operating-system information, timestamps, session identifiers, referral information, pages or features accessed, request and error logs, security events, and similar technical information needed to operate and protect the Service.

Communications

If you contact us, participate in research or feedback, or report a problem, we collect the information you provide and information necessary to respond.

Optional third-party or imported chess information

If Blundr offers and you choose to use an import or connection feature, we may process chess games, usernames, account identifiers, or other information you direct the relevant service to provide. We use that information only for the purposes described at the time of connection and in this Policy.

2. How we use information and our legal bases

We use personal information to:

• provide, personalize, and maintain your account and chess-training experience;
• operate Train, Daily Blundr, Review, Repertoire, Progress, rewards, and related features;
• remember preferences and synchronize your account across sessions and devices;
• process subscriptions, trials, renewals, cancellations, refunds, taxes, and account entitlements;
• authenticate users, prevent fraud, enforce security, investigate abuse, and protect users and the Service;
• provide customer support and transactional communications;
• diagnose errors, measure reliability, and improve product performance;
• understand product usage and improve Blundr using aggregated, de-identified, or appropriately protected analytics;
• comply with legal obligations and establish, exercise, or defend legal claims.

Where laws such as the GDPR or UK GDPR require a legal basis, we rely as appropriate on performance of our contract with you, compliance with legal obligations, our legitimate interests in operating and securing the Service and improving it in ways users reasonably expect, and consent where consent is legally required, including for certain non-essential cookies, analytics technologies, or marketing communications.

We do not condition access to the core Service on consent to personal-data processing that is not necessary to provide that Service where applicable law prohibits doing so.

3. Personalized training and automated processing

Blundr uses your chess activity and preferences to select, prioritize, and present training content and progress information. These automated training decisions are educational personalization. They do not make decisions that produce legal effects or similarly significant effects about you.

4. Cookies and similar technologies

We use cookies, local storage, and similar technologies as described in the Cookie Policy. Technologies strictly necessary for authentication, security, fraud prevention, session management, billing handoff, and core functionality may be used without optional consent where the law permits.

Where consent is required for analytics or other non-essential technologies, those technologies will remain disabled until you choose to allow them. You may later change your choice through Privacy or Cookie Settings.

5. How we disclose information

We disclose personal information only as reasonably necessary to operate the Service, as described below.

Service providers

We use providers that perform services for us, including hosting, database and authentication infrastructure, payment processing, email delivery, security, diagnostics, customer support, and chess computation. These providers may process personal information only for the services they provide to us and subject to applicable contractual and legal safeguards.

Current core infrastructure may include Supabase for database/authentication infrastructure, Vercel for hosting and delivery, and Stripe for payment processing when billing is enabled. Providers may change as the Service evolves.

Legal, safety, and security disclosures

We may disclose information if reasonably necessary to comply with law or valid legal process, protect rights and safety, investigate fraud or security incidents, enforce our agreements, or protect the integrity of the Service. We assess requests for user data and disclose only what we reasonably believe we are legally required or permitted to disclose.

Corporate transactions

If Blundr is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of the business, information may be transferred as part of that transaction, subject to applicable law and appropriate notice.

At your direction

We may disclose information when you direct us to do so, such as when you connect a third-party chess service or intentionally export or share information.

6. No sale or behavioral-advertising sharing

Blundr does not sell personal information for money. At launch, Blundr does not share personal information for cross-context behavioral advertising and does not use personal information for targeted advertising based on activity across unrelated businesses or services.

If that practice changes, we will update this Policy and provide any notices and opt-out controls required by law before the new practice begins.

7. International data transfers

Blundr and its service providers may process information in the United States and other countries. Where data-protection law requires a transfer mechanism, we use legally recognized safeguards such as adequacy decisions, standard contractual clauses, the UK International Data Transfer Addendum or other lawful transfer mechanisms, together with supplementary safeguards where appropriate.

8. Data retention

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide your account, preserve training progress at your direction, satisfy tax and accounting requirements, maintain security records, resolve disputes, and comply with law.

When you delete your account, we begin deletion or de-identification of account and training data from active systems promptly. Most data that is not legally required to be retained is targeted for deletion or de-identification within 30 days. Limited encrypted backups may retain deleted information for up to an additional 90 days before normal rotation, unless a longer period is required to address security, fraud, legal, or disaster-recovery needs.

Billing, tax, transaction, fraud-prevention, and legal records may be retained for the period required by applicable law or reasonably necessary to establish, exercise, or defend legal claims. Support records and security logs are retained only for a period reasonably necessary for those purposes.

Aggregated or de-identified information that can no longer reasonably identify you may be retained for product, research, statistical, and security purposes.

9. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including access controls, encryption in transit, account authentication, database authorization controls, logging, environment separation, and security testing. No system can guarantee absolute security.

If a personal-data breach occurs, we will investigate it and provide notifications to affected individuals and regulators when required by law.

10. Your privacy rights

Depending on where you live, you may have rights to request access to personal information, receive a copy, correct inaccurate information, delete information, restrict or object to certain processing, withdraw consent, and receive certain information in a portable format. You may also have the right to complain to a data-protection authority.

Where applicable U.S. state privacy law provides rights to know/access, correct, delete, obtain a portable copy, opt out of sale or sharing, opt out of targeted advertising, or limit certain uses of sensitive personal information, you may exercise those rights without discrimination. Blundr does not currently sell or share personal information for cross-context behavioral advertising or use it for targeted advertising, so there is no such activity to opt out of at launch.

To exercise a privacy right, use available Privacy controls in Settings or email privacy@blundr.io. We may need to verify your identity before completing certain requests. Authorized agents may submit requests where applicable law permits. If we deny a request, you may appeal where applicable law provides an appeal right by replying to our decision or emailing privacy@blundr.io with “Privacy Appeal” in the subject line.

You may withdraw optional cookie or analytics consent at any time through Cookie or Privacy Settings. Withdrawal does not affect processing that was lawful before withdrawal.

11. EEA, EU, and UK representatives

If Blundr is required by the EU GDPR or UK GDPR to appoint a local representative because the Operator is not established in the relevant territory, the current representative’s name and contact details will be published in the Legal Notice and this section will link to that notice. You may contact either the representative or Blundr regarding privacy matters.

12. Children and younger users

Blundr’s standard launch Service is not directed to children under 16, and users under 16 may not create an account through the standard launch flow. We do not knowingly collect personal information through that flow from a person under 16. If we learn that we have done so, we will take appropriate steps to delete the information and close or restrict the account.

A user who is 16 or older but below the legal age of majority where they live must have any parent or guardian agreement required by applicable law. Paid subscriptions must be entered into by a person with legal authority to make the purchase and use the payment method.

13. Marketing communications

We may send service messages necessary to operate your account, such as authentication, security, billing, trial, renewal, cancellation, and important product notices. These are not optional marketing messages.

We send promotional email only where permitted by law. Where consent is required, we request it separately. You may unsubscribe from promotional messages at any time using the unsubscribe link or by contacting us. Unsubscribing from marketing does not stop necessary account or transaction messages.

14. Changes to this Policy

We may update this Policy to reflect changes in law, technology, providers, or the Service. We will provide notice of material changes when required by law and request consent where a change requires consent. The “Last updated” date identifies the current version.

15. Contact

Privacy questions and requests: privacy@blundr.io

General support: support@blundr.io

Data controller/operator identity and postal address: see the Legal Notice linked from the Service footer.