Privacy Policy

What we collect

If you create an account with an email address and password:

• Your email address.
• Your password, stored only as a one-way hash. We never store or see the password itself.
• The username you choose.
• When you verified your email address, and when you accepted these terms and this policy.

If you sign in with Google: Google shares your name, email address and profile picture with us, along with an account identifier. We don’t receive your Google password or access anything else in your Google account, and we don’t show your Google name or picture to anyone: other players see your username.

If you play as a guest: your browser generates a random identifier so the game can recognize you between visits. It isn’t linked to your name or email. If you later sign in on the same browser, your guest games move over to your account.

If you buy a membership: you enter your payment details and billing address on Stripe’s checkout page, not ours. Stripe uses the address to work out tax. We never see or store your card details. We give Stripe your email address and an account identifier, and we keep a record of your membership: which plan, monthly or yearly, its status, when it renews and, if you cancel, when it ends. If you share a plan, we record who is on it.

When you play: the games you create and join, their moves, the cards you draw and play, turn history, results, the decks you build, and the games you mark as favorites. While a game is in progress we also share some live activity with your opponent: for example, that you’re looking at your hand, or which card position you’re hovering over (never which card it is).

Your record and rating: your results, streaks, achievements and the players you face most, worked out from your games. Rated games give you a rating on each card mode's ladder, and we keep its history and your standing in each season. We also keep a measure of your connection quality across games, from how regularly your game screen checks in and how quickly it gets answers, to match you with players on similar connections.

Your profile and social activity: a photo, if you upload one; the achievements you choose to feature and the cosmetics you equip; your friends and friend requests, challenges you send and receive, and the players you block; the clubs you found or join; and a feed of things that happened in your games, such as achievements earned and seasons placed in.

If you report a player, or are reported: who reported whom, the reason picked and anything written with it. If we act on a report, by renaming an account or suspending it from games against other people, we keep a record of what we did.

If you contact support or send a feature request: what you write, the category you pick, any images or videos you attach, the email address you give for a reply (optional), and your username if you’re signed in. Files you attach are stored at a link that can’t be guessed but isn’t password-protected, so anyone who has the link can open them, so please don’t attach anything you wouldn’t want seen.

If you ask to join the closed beta: your email address and when you asked. If we invite you, we also record when we did and when you first and last used your code. We keep only a one-way fingerprint of the code itself.

Technical information: your IP address is used to limit repeated sign-in, sign-up, email, support and upload requests, which protects accounts from password guessing and abuse. Our hosting provider also keeps standard server logs (such as IP address, browser type and the pages requested) for security and troubleshooting.

Page visits: we count visits with Vercel Web Analytics, to see which pages are used and how people find us. It records the page, the site you came from, and your browser, device type and country. It uses no cookies, doesn’t identify you, and can’t follow you to other websites. We leave out anything that could identify a game or a player, such as a game’s room code, a username in the address, and the details at the end of a link. To leave your visits out of the count, open any page with ?analytics=off at the end of the address; that browser remembers it, and ?analytics=on undoes it.

How we use it

• To run the game: create and store games, match you with opponents, and show results.
• To create, secure and sign you in to your account.
• To take payment for memberships, and give members the features they’ve paid for.
• To send the emails the service needs, such as verifying your email address and telling you when your free membership trial is about to end and when it has, and your invite if you asked to join the closed beta. We don’t send marketing email.
• To answer your support requests and consider your feature requests, including replying to the email address you gave us.
• To prevent abuse, investigate problems, and keep the service working.

What other players can see

Your username is public: it’s how other players, the leaderboards and clubs know you. What else people see depends on where they meet you, and on your settings.

• In a game, your opponent sees your username, your moves, the cards you play, the live activity described above, your connection quality, the card back you’ve equipped and, in a rated game, your rating. Anyone with a game’s room code can join a game that is waiting for an opponent.
• Your profile (your record, achievements, rivals, recent games, ratings and activity feed) is visible to the people you choose under Who can see my profile in Settings: everyone, your friends, or only you. It starts as friends only. Someone you’ve blocked never sees it.
• Your photo, if you upload one, is shown only to people who can see your profile. Everyone else sees a pattern drawn from your username. You can remove it at any time.
• The leaderboards list your username and rating once your rating has settled, while you’ve played a rated game in the last 90 days, unless you turn off Show me on leaderboards in Settings. Your friends’ leaderboard shows you to your friends either way. Past seasons’ final standings are kept.
• Clubs are public: anyone can see a club, who’s in it, and its combined stats. Your photo, your place in the club’s rating ranking and your events in its feed follow your profile setting.
• Friends and challenges: who can send you friend requests and who can challenge you to a game are also settings. A block keeps the two of you apart: no matches, requests or profile, and we don’t tell the other player.
• Reports aren’t shown to the player reported.

On a shared membership plan, the buyer sees the usernames of the accounts they’ve invited, and each of those accounts sees the buyer’s username.

Advertising

We show ads from Google AdSense to players without a membership, including guests. Members don’t see ads.

To show ads, Google’s ad code runs on our pages. Google and its partners use cookies and similar technology to serve ads, measure them and prevent fraud. They can use these cookies to show you ads based on your visits to Stupidchess and to other websites. Google receives technical information such as your IP address, details about your browser and device, and the page you’re on. We don’t give Google your email address, your username or your games. How Google uses information from sites that use its services explains what Google does with it.

Your choices:

• Where the law requires it, including in the European Economic Area, the UK and Switzerland, we ask for your consent before ads use cookies to personalize them. You can change your choice at any time from the privacy settings link on the site.
• You can turn off personalized ads from Google in My Ad Center, and from many other ad companies at aboutads.info. You’ll still see ads; they just won’t be based on your browsing.
• Some US state laws treat personalized advertising as “selling” or “sharing” personal information. Visitors in those states can opt out with the “Do not sell or share my personal information” link shown on the site.

Cookies and browser storage

Most of the cookies and browser storage we use are needed for the site to work. The exception is advertising cookies, which Google sets for players who see ads.

• Sign-in cookies keep you signed in and protect sign-in forms from cross-site request forgery.
• Access cookies remember that you entered an invite code, on environments that require one.
• Browser storage holds your guest identifier and your preferences on the new-game screen, such as favorite settings, and whether you’ve left your visits out of the visit count. These stay on your device.
• Advertising cookies are set by Google and its partners to serve, personalize and measure ads, as described under Advertising. Google also stores the choices you make about them.

Who we share it with

We don’t sell your information. We share it only with the service providers that run Stupidchess on our behalf, and only as much as they need to do that:

• Vercel hosts the website.
• Convex hosts the game server and database where account and game data is stored, and stores the files you attach to support and feature requests.
• Resend delivers our emails.
• GitHub stores the support and feature requests and the player reports you send us, on a private project board that only we can see.
• Google handles sign-in, if you choose to sign in with Google, and serves our ads, as described under Advertising.
• Stripe processes membership payments and calculates tax, as described above. It handles your payment details under its own privacy policy.

We may also disclose information if the law requires it, or to protect the rights and safety of our players or the service. If Stupidchess is ever transferred to a new owner, your information may be transferred with it, and this policy will continue to apply to it. These providers are based in the United States, so your information is processed there.

How long we keep it

We keep your account information and games for as long as your account exists. Email verification links expire after 24 hours and can only be used once. When you ask us to delete your account, we delete your personal information. Games you played may remain in your opponents’ histories, but they will no longer be connected to you.

To give each email address one free trial, we keep a one-way fingerprint of the address once it has started a trial. The fingerprint can’t be turned back into your address; it can only be matched against the same address if it signs up again. We keep it for a year after your trial starts or your account is deleted, whichever is later.

We keep the record of your membership for as long as your account exists, and delete it with your account. Stripe keeps records of your payments for as long as tax and financial laws require.

We keep a support or feature request, including any reply-to email and username, while we work on it, and delete it within a year of resolving it. Files attached to a request are deleted 90 days after you send them, whatever the state of the request. Files you attach but never send are deleted within a few hours.

We keep the closed beta’s list of email addresses until the beta ends on November 15, 2026, and delete it within 30 days after that.

We keep a player report until we’ve dealt with it, and delete it a year after that. Records of what we did about one, such as a rename or a suspension, are kept for as long as the account they concern exists. A username we’ve taken away stays reserved, so nobody can use it again.

Your choices and rights

In Settings you can choose who sees your profile, whether you appear on the leaderboards, and who can send you friend requests and challenges. You can change your username, remove your photo, block other players, and delete your account.

You can ask us to show you the information we hold about you, correct it, give you a copy of it, or delete it and your account. Email hello@stupidchess.com from the address on your account and we’ll respond within 30 days. Depending on where you live, you may have further rights under local law, such as the right to object to or restrict how we use your information, or to complain to a data protection authority. We won’t treat you differently for exercising any of these rights.

Security

Passwords, email verification links and sign-in refresh tokens are stored only as one-way hashes, and all traffic to the site is encrypted. No system is perfectly secure, but we work to protect your information and will let you know if a breach affects it.

Children

Stupidchess is not intended for children under 13, and we don’t knowingly collect information from them. If you believe a child under 13 has created an account, contact us and we’ll delete it.

Changes to this policy

If we change this policy, we’ll update the date at the top of this page. If a change meaningfully affects how we use your information, we’ll tell you on the site or by email before it takes effect.

Contact

Questions about this policy or your information: hello@stupidchess.com. See also our Terms of Service.