Privacy Policy

Last updated: July 14, 2026

Who we are

ChessChat (chesschat.live) is a real-time chess platform where players meet over live video. For anything in this policy, contact [email protected].

Who can use ChessChat

ChessChat is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18; if we learn we have, we delete the account.

What we collect

• Account data: your username, email address, date of birth (to verify you are 18 or older) and a securely hashed password. If you sign in with Google, we store your Google account ID and profile picture instead of a password.
• Gameplay data: games, moves, results, ratings and who you were paired with. Finished games are kept so you (and your opponents) can review them.
• Safety data: reports you file or that are filed about you, players you block, and any account suspensions.
• Technical data: your IP address and basic browser information, used for abuse prevention (e.g. our human-verification check) and to run the service.

Video and audio

Your camera and microphone streams are transmitted live to your opponent and are not recorded or stored, with one exception: when a player reports someone, a single still frame of the reported player's video is captured and stored privately as moderation evidence. Evidence frames are never public, are accessible only to our moderation process, and are deleted when the report is resolved or after 30 days at the latest.

Cookies and local storage

Essential — we use your browser's local storage for sign-in sessions and preferences (theme, camera and sound settings). These are required for the site to work, so they are always on.

Analytics — with your consent, we use Google Analytics to understand which parts of ChessChat get used, so we know what to fix and what to build. Nothing is set until you agree: analytics storage starts denied and is only enabled if you accept. You can change or withdraw your choice at any time — change your cookie settings, or the cookie button in the corner of the page. We never sell your data.

Services we rely on

• Google: optional “Sign in with Google”.
• Google Analytics: usage analytics — only with your consent.
• Cloudflare Turnstile: human verification on sign-in and registration.
• LiveKit: real-time video and audio transport.
• Render: application and database hosting.

Each processes only what it needs to provide its function.

Why we're allowed to hold this (legal bases)

• Contract — account, gameplay and video transport: without them there is no game to play.
• Legitimate interests — safety data and abuse prevention: keeping players safe from harassment and cheating.
• Consent — analytics, and nothing else. You can withdraw it at any time, as easily as you gave it.

Retention and deletion

Account and gameplay data are kept while your account exists. Report evidence is deleted within 30 days. To delete your account and associated personal data, email [email protected] from your account email address.

Your rights

You can request a copy of your data, correction of inaccurate data, or deletion of your account at any time via [email protected]. You also have the right to object to processing, to ask us to restrict it, and to complain to your local data protection authority.

Changes

If we change this policy, we'll update this page and the date above. Significant changes will be announced in the app.