Privacy policy

• From your sign-in provider. Signing in with Discord, GitHub or Facebook gives us your name, email address, avatar image and the account identifier that provider uses for you, along with the tokens it issues so your session works. We never see your password for that provider.
• What you enter yourself. A username, and optionally a country, a short status, a location, a flair and a profile picture.
• How you play. Every finished game — the moves, clocks, time control, result and both ratings before and after — plus a rating for each time control, your friends list, anyone you have blocked, and a count of how many signed-in members have viewed your profile.
• Reports. If you report another player, or are reported, we store the report, the reason and who filed it, so moderators can act on it.
• Membership. If you buy a membership, Stripe handles the payment. We store only the customer and subscription identifiers Stripe gives us, and the status of that subscription. Card details never reach our servers.
• Technical. Our servers keep ordinary request logs, and the game server holds a short-lived token so you can drop back into a game after a refresh.

To run your account and seat you in games, which is the agreement you enter by signing up. To keep ratings, leaderboards and game archives, which is the service itself. To act on reports and keep the site usable, which is our legitimate interest in moderating it. And to meet the accounting obligations that come with taking payment.

• Always on: a cookie holding your sign-in session, one that protects forms against cross-site submission, one remembering your language, and a token that returns you to a game in progress. Without these you cannot sign in or stay in a game.
• Your cookie answer itself is stored in your browser rather than on your account — so answering on your laptop does not answer for your phone. You can change or withdraw it at any time from the privacy settings.
• There is an analytics switch, and nothing is collected through it today. If that ever changes it will stay off until you turn it on.

Only the services needed to run the site, each acting on our instructions:

• Discord, GitHub and Facebook — only to sign you in. What they receive is governed by their own policies.
• Stripe — payments and subscriptions, if you buy a membership.
• UploadThing — storage for profile pictures you upload.
• Our hosting provider, which runs the servers and the database.

We do not sell personal data, we do not share it for advertising, and we do not pass it to anyone else unless the law requires it.

Your account and its data are kept while the account exists. Ask us to delete it and we will remove your account, your profile and your personal details. Finished games are the exception: a game has two players and a rating history behind it, so games remain, with your username replaced. Backups and server logs age out on their own within a short period.

Because the site is run from Romania and serves the EU, the GDPR applies. You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, and ask for it in a portable form. Write to us and we will answer within a month.

If you are not satisfied, you can complain to the Romanian supervisory authority, the ANSPDCP (dataprotection.ro), or to the authority where you live.

The site is not intended for children under 16. If you believe a child has an account here, tell us and we will remove it.

If this policy changes, the date at the top changes with it. Changes that materially affect you will be announced on the site rather than made quietly.

For anything on this page, including any of the rights above, write to:

The rules for using the site — fair play, membership, and how accounts are suspended — are a separate document: