ChessMessPrivacy Policy
This policy explains what ChessMess (www.chessmess.online) collects and why. The short version: we collect only what we need to run the site and never sell your data. The only advertising cookies come from Google AdSense on pages that show ads; supporters don't load ads at all.
Questions or requests: [email protected]. ChessMess is run from Pakistan.
What stays in your browser
If you play without an account, your games, settings, mistake trainer and World Tour progress, and what you've unlocked with videos (and until when), are stored in your browser's local storage, together with a random guest key used for games with friends. We don't receive them unless you play a friend game (see below). Clearing your browser data deletes them.
Chess analysis runs in your browser: the Stockfish engine works on your device, so positions you analyse aren't sent to us.
What we collect
| Data | Why | Kept |
|---|---|---|
| Email address, display name, @handle, avatar choice, optional country flag | Your account, sign-in, friends and profile | Until you delete your account |
| Password (stored only as a scrypt hash) | Signing in | Until you delete your account |
| One-time email codes (stored hashed) | Confirming your email and resetting your password | 15 minutes, then useless |
| Session cookie (cm_session) | Keeping you signed in | Up to 60 days, or until you sign out |
| Saved games, ratings, friends and friend requests | Game history, reviews and friends | Until you delete them or your account |
| Mistake trainer and World Tour progress | Syncing them across your devices | Until you delete your account |
| Friend-room games (moves, clocks, names) | Running the game between players | Up to 30 days |
| Payment records (what you bought, amount, date, Stripe reference) | Giving you what you paid for and handling refunds | Until you delete your account; Stripe keeps its own payment records as the law requires |
| Server logs (IP address, browser type, pages requested) | Security, abuse prevention and fixing problems | A short time, then deleted by our hosts |
We don't receive your card number: Stripe handles payments.
When you build a practice bot from a Lichess or Chess.com username, we fetch that player's public games and keep a summary in memory for up to 6 hours. The lookup isn't linked to your account. We also count requests by IP address in memory to stop abuse.
Cookies
We use one essential cookie, cm_session, and only when you're signed in. Cloudflare may set a security cookie to tell people from bots.
On pages with ads, Google AdSense may set cookies or use similar technology to show ads, measure them, prevent fraud and, where you allow it, personalise them. Visitors in the European Economic Area, the UK and Switzerland are asked for consent first through Google's consent message, and can change their choice at any time. You can also manage ads in Google's ad settings and read how Google uses information from sites that use its services. Ads aren't loaded for supporters or on the game screen.
Who helps us run ChessMess
- Railway: hosting and database
- Cloudflare: content delivery, security and email forwarding
- Postmark: sending account emails (codes and notices)
- Stripe: payments
- Google AdSense: banner ads and optional videos. Google uses ad data under its own privacy policy.
- Lichess and Chess.com: public game data for practice bots (we only read from them)
These providers process data for us under their own privacy terms. They may store data outside your country, including in the United States and the European Union.
What others can see
Your display name, @handle, avatar, country flag (if you set one), supporter badge (if you have one), when you joined, how many games you've saved, and whether you're online can be seen by other players. Your email address is never shown.
Your choices and rights
- See and export: your games are in Games and can be exported as PGN.
- Correct: change your profile in Settings.
- Delete: delete single games, or your whole account in Settings (you'll be asked for your password). Account deletion immediately and permanently removes your account, games, friends, trainer and progress data from our database; copies in our hosts' backups expire within 30 days. Stripe keeps its own payment records as the law requires.
- Ask us: email [email protected] for a copy of your data or any other request. Depending on where you live (for example the EU, UK or California) you may have further rights, such as objecting to processing or complaining to a data-protection authority.
Children
ChessMess accounts are for people aged 13 and over. If you think a child under 13 has created an account, email us and we'll delete it.
Security
Connections use HTTPS, passwords are hashed with scrypt, email codes are hashed and expire, and sessions can be ended by signing out or changing your password. No system is perfectly secure; if something goes wrong that affects you, we'll tell you.
Changes
We'll update this page when our handling of data changes and show the date at the top. Important changes will be announced on the site or by email.