Your game, not your profile
Play with or without an account
Chesspoly is a strategy game with optional accounts and online play. You can play as a guest without giving us your name or email address. If you create an account, we process the account and authentication information described below. We do not ask for contacts, precise location, or payment details. This policy covers the Chesspoly iOS app and website (the “Service”).
Who is responsible
Chesspoly is responsible for the information described in this policy. Questions and privacy requests can be sent to [email protected] .
Information we process
On your device
The app stores preferences such as onboarding completion, sound and haptic settings, and an anonymous guest identifier and signed token after you first choose online play. Local game state and computer-opponent decisions stay on your device. The website stores a similar anonymous identifier in an essential session cookie so that online rooms and reconnects work.
Anonymous online identity
Online play uses a randomly generated guest identifier and signed authentication token. They let the Service restore your colour after a reconnect, enforce turns, and associate your actions with the correct seat. They are not based on your name or email address.
Optional accounts and authentication
An account contains a fixed public handle, a normalised email address, confirmation status, and authentication records. Passwords are stored only as bcrypt hashes, and session, confirmation, and reset tokens are stored as hashes. If you use Sign in with Apple, we store Apple’s immutable account identifier, the provider email when supplied, verification times, and an encrypted refresh credential. We never receive your Apple ID password.
Public profiles
A public profile shows the account’s handle, aggregate completed-online-game statistics, and completed game history and replays. Email addresses, provider identifiers, device and guest identity lists, and active games are not public. Active games are shown only to the account owner.
Online games and replays
We store room codes, player seats, game positions, accepted actions, results, and timing information so that online games can operate, reconnect safely, and produce account history and statistics. Active games may be available to spectators. Completed games and replays are public through contextual game and profile links and are retained as described below.
Room chat
If you use game chat, we store the message, its time, the room code, your anonymous guest or account-linked player identity, and whether you participated as White, Black, or a spectator. Other visitors see a public handle, seat label, or room-specific guest label—not the underlying identity. Do not include personal or sensitive information in chat messages.
Connection and security information
Our server and infrastructure providers may process standard connection information, including IP address, request time, and technical delivery or error details. We use this information to deliver the Service, apply short-term rate limits, investigate faults, and protect Chesspoly from abuse.
Why we use this information
- Provide private rooms, quick matching, spectators, replays, and room chat.
- Restore seats and games after a reconnect or temporary server restart.
- Apply the rules, enforce turn ownership, and preserve game integrity.
- Prevent spam, rate-limit abusive activity, and respond to safety reports.
- Diagnose reliability or security problems and comply with legal obligations.
Depending on where you live, these uses are based on providing the features you request, our legitimate interests in operating a safe and reliable game, consent where required, or compliance with law.
When information is shared
We use service providers for hosting, database infrastructure, network delivery and security, transactional email, and authentication, including Cloudflare, Amazon Web Services, and Apple when you choose Sign in with Apple. They may process information only to provide those services under their own contractual and legal obligations. We may also disclose information when required by law, to protect users, or to investigate misuse.
We do not sell personal information, share it with data brokers, use it for third-party advertising, or combine it with activity from other companies’ apps or websites for tracking.
Retention and deletion
- Completed online games and their replay steps are retained indefinitely.
- Unfinished games are deleted after 30 days without an update.
- Chat for a finished game is deleted after 30 days.
- Each active room retains only its latest 100 chat messages.
- Unconfirmed accounts are deleted after seven days.
- Browser and mobile account sessions have rolling 30-day validity.
- The mobile guest token can remain valid for up to one year.
- On-device preferences remain until you clear them or remove the app.
- Shorter or longer retention may apply where needed for security or required by law.
Your choices and rights
You can use local Pass & Play and computer modes without using online features. You can remove locally stored information by deleting the app or clearing its data. Browser users can clear Chesspoly cookies through their browser settings.
Account owners can delete their account from account settings after reauthentication. Deletion removes credentials and the public profile, revokes sessions and Apple authorisation where possible, and detaches player identities. Completed games and replays remain with anonymous player labels so the historical game record remains intact.
To request access, correction, or help deleting server-held information, email [email protected] . Include your public handle, or relevant room codes and approximate dates for guest records. We may need to verify that the request relates to your account or device-held guest identity. Your rights vary by jurisdiction, and you may also have the right to complain to your local data-protection authority.
Security and younger players
Chesspoly uses encrypted HTTPS and secure WebSocket connections for online features. No online service can guarantee absolute security, but we limit collection and use technical and organisational safeguards appropriate to the information we hold.
Chesspoly is a general-audience strategy game and is not directed specifically to children. If you are below the age at which you can consent to online services where you live, use online features only with permission from a parent or guardian. Parents or guardians can contact us about a younger player’s information.
Changes and contact
We may update this policy when the Service or legal requirements change. The effective date at the top identifies the current version. Questions can be sent to [email protected].