Privacy Policy

Effective August 16, 2026

1. Who we are

Learn Xiangqi is operated by SproutVest, LLC, a Washington limited liability company doing business as Learn Xiangqi ("Learn Xiangqi", "we", "us", "our"). This policy explains how we handle personal information on learnxiangqi.com and its related services.

2. Information we collect

Information you give us

Email address

Collected only if you create an account. It identifies your account, allows you to sign in, and lets us send password-reset messages.

Password

Stored only as a salted PBKDF2 hash. We never store, log, or have access to your password in readable form, and we cannot recover it for you — we can only help you reset it.

Skill level and play record

Your selected AI difficulty (初级 / 中级 / 高级) and a small tally per difficulty: games played, won, lost, and how many moves the coach flagged as blunders. If you are signed in, this is stored on our servers so it follows you to your other devices.

Questions you type into the coach

If you use the optional "Analyze" panel, anything you type into it is sent with your board position to Anthropic. See section 3.

Information collected automatically

On-device storage

If you play without an account, your difficulty setting and play record are stored only in your browser (localStorage) and are not sent to our servers at all. Clearing your browser data removes them. Games in progress are never sent anywhere on their own.

Session cookie

When signed in, we set one strictly necessary cookie, named xq_session. It is HttpOnly, Secure, and cryptographically signed, is not readable by scripts, lasts 30 days, and is used solely to keep you signed in. Signing out clears it, and changing your password makes every existing session token invalid.

Analytics

We use Google Analytics 4 to understand how people find and use the site — pages viewed, approximate location (country or region, which Google derives from your IP address and does not store in Analytics), device and browser type, and referring site. Google Analytics sets its own cookies in your browser to recognise a returning visit. Within Analytics we have not enabled Google Signals, advertising features, or ad personalisation, so your Analytics data is not used to build advertising profiles. Our advertising is separate and is described in section 6. You can opt out for every site that uses Google Analytics with Google's browser opt-out add-on, or by turning on your browser's tracking protection.

Cloudflare Web Analytics

Our host, Cloudflare, adds a small script (beacon.min.js) to every page we serve, which reports back to Cloudflare Web Analytics. It sets no cookies, stores nothing on your device, and uses no fingerprint or identifier that could follow you to another site. What it reports is the address of the page, the page that referred you, your browser and device type, the country Cloudflare works out at its network edge, and how long the page took to load. Unlike Google Analytics, it is not covered by our cookie banner: our host inserts it into the page before any of our own code runs, so it loads whichever answer you gave. Blocking static.cloudflareinsights.com — with your browser's tracking protection or an extension — stops it.

Advertising cookies

Google AdSense may set cookies in your browser to serve adverts, limit how often you see the same one, and detect fraudulent clicks. These are set only after you answer our cookie banner, and only the non-personalised kind unless you agree to personalisation. Section 6 explains this in full, including how to change your mind.

Product events

Alongside page views, we send Google Analytics four counters so we can see whether the site actually teaches anyone: a game against the computer started (with the difficulty), a game finished (with the difficulty, whether it was a win, loss, or draw, and how many moves the coach flagged as blunders), an account was created, and the Analyze panel was used. These carry no identifier we could tie back to you, and they never include your email address, your board position, your moves, or anything you type into the coach.

Server logs

Our hosting provider processes standard request data, including IP address and user agent, to deliver the service and protect it from abuse.

3. Claude analysis (what leaves your device)

The game itself — the rules engine, the AI opponent, and the coaching feed that narrates your moves — runs entirely in your browser. Your position and your moves are never transmitted while you play. The only trace a game leaves is the anonymous started and finished counter described under "Product events" above, and, if you are signed in, the tally of games played and won in your own profile.

The "Analyze" panel is different, and is the one place where game data leaves your device. Only when you press "Analyze", we send the following to Anthropic, PBC for processing by the Claude API:

• a text rendering of the current board position;
• the list of moves played so far in the current game;
• whose turn it is; and
• any question you typed into the panel.

We do not send your email address, account identifier, or IP address to Anthropic with that request. Anthropic processes the request to generate the advice you see and handles it under its own terms; through our commercial API access, Anthropic does not use the content of these requests to train its models. Anthropic's privacy policy is available at anthropic.com/legal/privacy.

Analysis requires an account and is subject to a daily limit per account, which we count so we can keep the feature available and affordable. If you never press "Analyze", nothing is ever sent to Anthropic.

4. How we use information

• To provide the service: your account, your difficulty setting, and your play record across devices.
• To generate coaching analysis when you request it.
• To send transactional email you request, such as password resets. We do not send marketing email.
• To keep the service secure, prevent abuse, enforce usage limits, and diagnose faults.
• To measure how the site is used, in aggregate, so we can improve it.

Where the UK GDPR or EU GDPR applies, our legal bases are performance of a contract (running your account and producing the analysis you ask for), legitimate interests (security, abuse prevention, fault diagnosis, and measuring use of the site), and consent where required.

5. Service providers

We do not sell personal information for money. If you agree to personalised advertising, the advertising cookies described in section 6 may amount to "sharing" for cross-context behavioral advertising as California law defines it; section 6 explains what that involves and how to refuse or withdraw it. We rely on a small number of processors:

We may also disclose information if required by law, or to protect the rights, safety, or property of our users or ourselves.

6. Advertising

Learn Xiangqi is free, and adverts are what pay for it. We use Google AdSense, operated by Google LLC, to select and deliver them.

Where adverts appear. On our written guides, and on the screens you see after a game or a puzzle has finished. Never while a board is in play. That is a deliberate limit rather than a description of today's layout: the game, the computer opponent, and the coach that narrates your moves run entirely in your browser and carry no advertising at all.

Whether they are personalised is your choice. The cookie banner asks once, and until you answer it we show no adverts and set no advertising cookies. If you agree, Google may use cookies and similar identifiers to show adverts based on your interests, including from your visits to other sites. If you decline, you still see adverts — they are simply untargeted, chosen from the page you are reading rather than from anything about you. Declining costs you nothing else, and it is not a way to remove adverts.

You can change your mind at any time using cookie settings, which reopens the banner. We also honour browser signals that refuse tracking on your behalf, such as Global Privacy Control and Do Not Track — where we see one, we treat it as a refusal and never ask again.

We do not personalise adverts for anyone we know to be under 16, whatever they may have agreed to. See section 9.

Google's own explanation of how it uses information from sites that use its services is at policies.google.com/technologies/partner-sites, and you can control the adverts Google shows you at myadcenter.google.com.

7. Data retention

We keep your account, skill level, and play record until you ask us to delete them. When you request deletion, we remove your account and associated data within 30 days, except where we must retain something to comply with a legal obligation. Data stored only on your device is under your control and can be cleared at any time by clearing your browser data.

Two things expire on their own. A password-reset link is valid for one hour and can be used once; we store only a SHA-256 hash of it, never the link we emailed you, and the record is spent as soon as it is used. The daily analysis counter keeps one row per account per day, holding nothing but a date and a number.

8. Your choices and rights

You can play, choose a difficulty, and keep a play record without ever creating an account. To access, correct, or delete account data, email us at [email protected]. To change what you agreed to about cookies and advertising, open cookie settings — it reopens the banner, and your new answer replaces the old one immediately. Cookie settings do not reach Cloudflare Web Analytics, which our host adds to the page rather than we do; section 2 says what it collects and how to block it.

Depending on where you live, you may have rights to access, correct, delete, or receive a portable copy of your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of California may request disclosure of the categories of personal information collected and its deletion; we never sell personal information, and where you have agreed to personalised advertising you may opt out of the "sharing" described in section 5 at any time through cookie settings. We will not discriminate against you for exercising any right. Residents of the UK or EEA may also lodge a complaint with their local supervisory authority. We respond to verified requests within the time required by applicable law.

9. Children

Learn Xiangqi is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact us and we will delete it.

We do not knowingly show personalised adverts to anyone under 16, whatever they may have agreed to on the cookie banner. We do not ask your age and have no way to infer it, so in practice this applies when someone tells us — the promise is about what we knowingly do, not a claim to know who you are. Anyone in that position still sees adverts; they are untargeted.

10. Security

All traffic is served over HTTPS. Passwords are stored only as salted PBKDF2 hashes, session cookies are HttpOnly and signed, and changing your password invalidates existing sessions. No system can be guaranteed perfectly secure, but we aim to hold only what the service actually needs.

11. International transfers

We are based in the United States and our providers process data in the United States and other countries. If you access the service from outside the United States, you understand that your information will be processed there.

12. Changes to this policy

We may update this policy from time to time. We will change the effective date above and, for material changes affecting your rights, take reasonable steps to notify account holders.

13. Contact

Questions or requests about privacy: [email protected]