Privacy Policy

1. Who is responsible for your data

Rukh (rukh.cc) is operated by Paul M Kallarackal, an individual based in India. He decides why and how your personal data is used (the "data fiduciary" under India's Digital Personal Data Protection Act, 2023, and the "controller" under the GDPR and UK GDPR). Contact: support@rukh.cc (opens in a new tab).

This policy covers the rukh.cc website, the free preview, the waitlist, support email and the paid coach. It is written to meet India's DPDP Act, the GDPR and UK GDPR for visitors in Europe and the UK, and the California Consumer Privacy Act (CCPA/CPRA) for visitors in California.

2. What we collect, and why

Waitlist. Your email address, the page you signed up from, the time you signed up, your place in line, and the chess.com username if you gave one. We use it to email you when trials open and to see which pages bring people in. We do not sell it and we do not add you to other lists.

Free preview. The chess.com username you type. We fetch that player's public games from chess.com's public API for roughly the last six months and analyse them with the Stockfish engine on our servers. We keep the finished report in a temporary cache for about 24 hours and the downloaded game data for about 30 minutes. Nothing is saved to a profile.

Abuse limits. To stop the preview being overloaded, we count requests per IP address in a short-lived store. These counters expire after about an hour. Your approximate country is read from a header added by our host so the pricing page can default to rupees for visitors in India. It is not stored.

Website analytics. We use PostHog, set up without cookies or browser storage, to count visits and see which pages and buttons work: page views, when you leave a page, button clicks such as joining the waitlist, errors, and which feature flags are on. It sees your approximate location from your IP address, your browser and device type, and the page you came from. We never send your email address to it. Because it is cookieless, it cannot recognise you from one day to the next. See the Cookie Policy.

Paid coach (when it opens). Your account email, the chess.com games Rukh follows, the analysis it produces, your lessons and practice, and your conversations with the coach. We store transcripts of conversations. If you use voice, we send the audio to our AI provider to be understood and answered, and we do not store the audio. We use this data to give you the coaching you asked for and to improve the coach for you. It is private to your account.

Payments. When you subscribe, Dodo Payments collects your name, email, billing country and address, and payment details (card or UPI). We do not see your full card number or UPI details. We receive and keep only a customer ID, subscription ID, plan, currency, status and billing dates, so that we know whether your subscription is active.

Messages to us. If you email support@rukh.cc (opens in a new tab), we keep the conversation, your email address and what you tell us, so we can help you.

What we do not collect. We do not ask for your chess.com password, we do not run advertising trackers, and we do not buy data about you.

3. Why we may use it (legal bases)

Under the GDPR and UK GDPR, our bases are:

• Contract, to provide the paid coach, take payment and support you;
• Consent, for the waitlist and for any marketing email, which you can withdraw at any time;
• Legitimate interests, to keep the Service secure, prevent abuse, run the free preview and understand how the site is used. We weigh these against your rights and keep analytics minimal;
• Legal obligation, for example tax and accounting records.

Under India's DPDP Act we process your data with your consent, or for the limited "legitimate uses" the Act allows, such as to provide a service you asked for, to meet a legal duty, or to prevent fraud and abuse. You can withdraw consent as easily as you gave it.

4. Who else handles your data

We use service providers (processors) to run Rukh. Each handles data only to provide its service to us. The full list, with what each one does and where, is on the subprocessors page. They are:

• Dodo Payments, our merchant of record, for payments, invoices, tax and refunds. It sells to you directly and is responsible for the payment data it collects under its own privacy policy;
• PostHog, for cookieless website analytics and feature flags;
• Amazon Web Services (DynamoDB), which stores the waitlist;
• Vercel and Cloudflare, which host the website and the coach's servers and database;
• OpenAI, our AI model provider, which receives the chess positions and conversation text needed to write the coach's replies, and the audio if you use voice. We send only what is needed for the reply and not your email address. Under OpenAI's API terms, data sent through the API is not used to train its models unless the customer opts in, and we have not opted in;
• Upstash, for the temporary preview cache and request counters, when enabled;
• An email provider (Amazon SES is planned), to send waitlist, trial and billing emails, when enabled.

chess.com is where we read your public games from. It is a data source, not a provider acting for us.

We do not sell your personal data and we do not share it for cross-context behavioural advertising, as those terms are used in the CCPA. We may disclose data if the law requires, to protect our rights, or to a successor if Rukh is ever transferred, in which case we will tell you.

5. International transfers

We are in India and our providers run servers in several countries, including the United States and the EU. If you are in the EEA or UK, your data is therefore transferred outside your region. Where required we rely on safeguards such as the standard contractual clauses and the UK addendum that our providers offer, or on the provider's participation in the EU-US Data Privacy Framework. Under the DPDP Act, transfers outside India are allowed except to countries the Indian government restricts.

6. How long we keep it

• Waitlist emails: until you ask us to remove you, or a reasonable time (up to 12 months) after trials open if you never join.
• Preview data: hours, as described above.
• Analytics: only as long as needed to understand how the site is used. We review it regularly.
• Paid coach data: while your account is open. If you delete your account we delete it within 30 days, apart from backups that expire soon after.
• Billing records: the billing details we keep are kept for as long as tax and accounting law in India requires. Dodo keeps its own records.
• Support email: up to 3 years after the last message, unless you ask us to delete it sooner and we have no reason to keep it.

7. Your rights and how to use them

Depending on where you live, you can ask us to:

• show you the personal data we hold about you and how it is used (access, including a copy you can take with you);
• correct or complete it;
• delete it (erasure);
• restrict or stop some uses, or object to processing based on legitimate interests (GDPR);
• withdraw your consent at any time (GDPR and DPDP Act);
• nominate someone to exercise your rights if you die or cannot act (DPDP Act);
• know what we collect, to delete it, to correct it, to opt out of its sale or sharing (we do neither), and not to be treated worse for using these rights (CCPA).

To use a right, email support@rukh.cc (opens in a new tab) from the address we hold and say what you want. We may ask you to confirm who you are. We reply within 30 days, and sooner when we can. Using your rights is free unless a request is clearly excessive. For a deletion request, we cancel any active subscription first so you are not billed again. Waitlist and preview data we cannot link to you (for example anonymous analytics) cannot be looked up.

You can also complain to a data protection authority: the Data Protection Board of India, the authority in your EU country, or the UK Information Commissioner's Office. We would like the chance to fix it first.

8. Grievance Officer

For complaints about how your data is handled, or about the Service, the Grievance Officer is Paul M Kallarackal, India. Email support@rukh.cc (opens in a new tab) with "Grievance" in the subject. We acknowledge a complaint within 72 hours and aim to resolve it within 30 days.

9. Security

We use encrypted connections, access limits and separate storage for each user's coaching data. Our waitlist storage uses credentials that can only add to the list. No system is perfectly safe. If a breach affects your data, we will tell you and the authorities as the law requires.

10. Children

Rukh is for people aged 13 or over. Under India's DPDP Act anyone under 18 is a child, so a young player under 18 may use the paid coach only with a verifiable parent or guardian's consent, and a parent or guardian must set up the subscription. We do not track children, monitor their behaviour or show them targeted advertising. We do not knowingly collect data from children under 13. If you think a child has given us data without consent, email support@rukh.cc (opens in a new tab) and we will delete it.

11. Cookies

The website sets no cookies for analytics or advertising, so there is no cookie banner. Details are in the Cookie Policy.

12. Changes to this policy

We may update this policy. We will change the date at the top and email subscribers about material changes before they apply.

13. Contact

Privacy questions and requests: support@rukh.cc (opens in a new tab). See also the Terms of Service, refund policy, Cookie Policy and subprocessors.