CaissaDraft for review — TODO: resolve the items below before publication.
Responsible party and contact
This policy covers the Caissa.Fun public website and the handling of authentication data and games supplied by users to the Caissa service.
TODO: identify the party responsible for processing and confirm the applicable identification and contact details.
Privacy contact: contato@caissa.fun.
Authentication data
Caissa uses Firebase Authentication for email, Google, Microsoft and Facebook login. Depending on the method selected and information supplied by the provider, authentication may involve a user identifier, email address, name, profile picture, linked provider identifiers and technical session information. These data identify the account, authenticate access and maintain the session.
Social login takes place with the selected provider. Do not send provider passwords to Caissa in support messages.
TODO: verify the fields actually received and stored, the permissions requested from Facebook and other providers, technical logs and security uses.
Games and analysis
Game data supplied by users may include PGN files, moves, positions, results, player names or usernames and other metadata in the submitted material. They are used to analyze games and provide exercises, statistics and guidance. Only submit data you are authorized to provide, and avoid unnecessary personal information about other people.
TODO: confirm which analyses and derived data are stored, their account association, visibility, recipients and any use to improve models or services. This draft does not authorize those additional uses.
External services and local storage
Firebase Authentication handles authentication; Google, Microsoft and Facebook participate when you choose their login option. The public website loads fonts from Google Fonts and links to Google Forms. Loading fonts or visiting these forms involves communication with those services. The website saves your language preference in browser local storage (localStorage).
TODO: validate the data received by each service, the processors actually used by the application, processing locations, international transfers, cookies and session technologies. Confirm any other integrations without assuming their use.
Purposes, retention and security
The purposes described here are to provide account access and deliver the requested analysis and training. Storage periods and safeguards must reflect actual operations.
TODO: define and validate legal bases for each purpose, retention criteria and periods, backup handling, preservation obligations and security measures. This draft establishes no retention period or absolute security guarantee.
Your rights and deletion
You may request information about your data, correction and deletion, in accordance with applicable rights. See the data deletion procedure. Requests are handled manually; this page does not delete accounts.
TODO: validate support channel operations, identity verification, applicable response periods, handling of other rights and rules for minors.
Updates
Changes to this policy should be published on this page and reflect actual changes in data handling.
TODO: approve the final version, provide an effective date and define how material changes will be communicated.