Privacy

When you open the Play page, your browser keeps a few things in this site's storage. They never leave it except as described below:

• A random player key, which is your player: the only way back to your name and rating.
• A session token from our server, so you don't sign in on every visit. It lasts 30 days; signed in to an account, an hour, renewed while you play.
• Whether you're signed in to an account, and your player's name, for the top of the page.
• A game against the computer in progress, so a reload doesn't lose it.
• Your sound setting.

We set one cookie, and only if you sign in to an account: our game server's sign-in cookie, which keeps you signed in. It's strictly necessary for that, so there's no banner asking. Cloudflare, which protects the site from attacks and abuse, may set a strictly necessary cookie that tells people from bots.

• Your player: the name you chose (or "Knight" and a number), a one-way hash of your player key (the key itself never reaches us), your rating with its record of wins, losses and draws, and when the player was created and last seen.
• Your games against other players: who played, the moves, the result, the rating changes and when.
• Your account, if you create one: your email address, a one-way hash of your password (the password itself is never stored), whether the email is confirmed, and your sign-ins: when each started and ends, and the browser's own description of itself, without your IP address.
• Moderation notes, if a player is renamed or banned for breaking the rules.

Games against the computer stay in your browser. At the Hard level, the moves so far go to our server for the computer's reply, and aren't kept.

Logs. The server logs each request without your IP address: what was asked for, when, the result, and your player's id. Your IP address is used in memory to stop one network flooding the server, and isn't stored. Our host keeps logs for up to 30 days.

We use Umami, which we run ourselves, to count visits and a few things players do: starting a game (and against whom: a quick match, a friend or the computer, with its level), how games end, inviting a friend, watching a game. It records the page, the site you came from, your country and city (worked out from your IP address, which it doesn't store), your language, and your browser, system, screen size and type of device. It sets no cookies and never receives your player, your name, your games or invite codes. If your browser sends Do Not Track, nothing is counted.

The first time your browser makes a player, and when you create an account, sign in or ask for a new password, Cloudflare Turnstile may check that you're a person. It looks at signals from your browser and connection (such as your IP address) to keep automated sign-ups out, and uses them for nothing else. See Cloudflare's Turnstile privacy addendum.

• Railway hosts the website, the game server, the database and the visit counter.
• Cloudflare runs the domain's DNS, protects the site and provides Turnstile.
• Resend sends the account emails: the link to confirm your address and the link to choose a new password.

Nothing is sold or shared for advertising, and there are no ads.

Your name and rating in your games, in the list of live games (quick-match games only; games with a friend's code stay private) and, once you've played a rated game, on the leaderboard. A report you send us includes the reported player's id.

Your player and games stay while the site runs, so your rating and history are there when you come back, until you ask us to delete them; so does your account. An account whose email is never confirmed is deleted after 7 days, and a sign-in ends when you sign out or after a week without a visit. Logs go after 30 days at most; the visit counts are kept in aggregate.

With an account, delete it yourself on your account page, here or in the app: your email, password, sign-ins and name go, and your games stay in your opponents' histories as "Deleted player". Without an account, or if you'd rather ask, email [email protected] with your player name, from your account's email if you have one, and we do the same. Without an account, clearing this site's data in your browser also forgets your key: you start again as a new player.

Chess960 needs no personal details to play, so anyone can; only an account, which is optional, needs an email address. If you're a parent and want your child's player deleted, email us and we will.

If this changes, we'll update this page and the date at the top.