Who is responsible
ChessDict is the service described in this policy. The legal operator, contact address and privacy contact must be confirmed before this draft becomes effective. This policy covers the website and mobile app; platform-specific data practices must be included.
Information collected
Account information includes your email, name, username, chosen avatar, country and authentication information. Gameplay creates moves, move timing, results, ratings, opponents, matchmaking and friend/challenge records, including staked-game outcomes. Messages you send through game chat are processed and stored by the service. Wallet features process wallet addresses, balances and transaction or withdrawal records. When you are signed in, we also record the IP address you connect from and a random identifier created by the website or mobile app; these are stored only as one-way codes (see Fair play and security). Reports you make and moderation decisions are kept. Our announcement and promotional emails record whether they were delivered, opened or clicked. Support requests contain the information you choose to provide. Hosting and mobile SDK data must be inventoried before release.
How information is used
Information supports sign-in, account recovery, player identity, games, ratings, social features, messages, wallet operations and customer support. We also use it for fair play, security and fraud prevention: detecting cheating, collusion and one person running several accounts, investigating reports and recording moderation decisions. Security and operational processing helps protect accounts and investigate problems. Email engagement information shows whether our announcement and promotional emails reach players. Optional analytics, advertising and tracking must be disclosed and governed by the applicable consent controls; this draft does not assume they are absent.
Fair play and security
To keep games fair and prevent fraud, we collect the IP address you connect from and a random identifier created by the website or mobile app. On the website, the identifier is kept in browser storage and a first-party cookie so it can accompany API requests and game connections. It stays across sign-ins and changes when you clear this site’s storage. If storage is blocked, persistence is limited. That identifier is not linked to your device’s hardware or advertising ID. The backend stores these only as scrambled one-way codes (keyed hashes), never the original values; the codes can only be compared to see whether accounts share a device or network. We also analyse gameplay information, such as move timing, results, rating changes, who you play and how often, and staked-game outcomes, together with the wallet addresses you withdraw to, compared across accounts. This helps us detect cheating, collusion and multiple accounts, especially in games played for money. Accounts may be flagged for review by a human moderator; we do not restrict accounts automatically. If you report a player, we keep the reason, your note and, for abusive chat, a copy of that game’s chat. Moderators’ decisions are recorded, and a player who receives a warning is notified by email. We use this information only for fair play, security and fraud prevention. We never sell it or share it with advertisers.
Optional website analytics
Where enabled, optional analytics uses PostHog only after you choose Allow analytics. It records selected screen names, feature actions, broad device categories and confirmed or uncertain action outcomes with a random browser identifier. This identifier is separate from the fair-play device identifier and is not linked to your ChessDict account, email or wallet. We do not send chat, form contents, passwords, codes, authentication tokens, wallet addresses, balances or transaction amounts, and session recording is disabled. You can change your choice through Analytics preferences in the footer or Account settings. Turning analytics off clears its browser identifier and stops new collection; it does not erase previously received records. If you request deletion of earlier analytics, support will need to identify the relevant browser records through a private verified process. The configured processing region, enforceable retention period and monitored deletion contact must be confirmed before production analytics is enabled.
Emails we send
Our announcement and promotional emails contain links and a small image that tell us whether an email was delivered, opened or clicked. You can unsubscribe from these emails at any time, using the link at the bottom of each one.
Who can receive it
Other players can see the public profile information and game information exposed by ChessDict. Game messages are delivered to the relevant game participants. Service providers process information needed for hosting, authentication, email delivery and wallet/blockchain operations. Fair-play, security and moderation information is used only by ChessDict and its moderators; it is not sold or shared with advertisers. The operator must confirm the full provider list and equivalent data-protection commitments. Blockchain transactions and addresses may be publicly visible and cannot be erased by changing your ChessDict account.
Retention and deletion
The current account-deletion flow schedules personal-data removal after a 30-day grace period. Your profile is hidden and sessions are revoked when scheduling succeeds; signing in during the grace period cancels deletion. Device and network codes and fair-play risk assessments are deleted when the deletion completes at the end of that period. Reports and moderation records are kept as a record of decisions, without your name, email or other contact details. Game, ledger and on-chain records may remain. Exact retention periods or criteria for chats, security logs, backups, support records and retained transaction data need operator confirmation.
Your choices
Use Account to update supported profile details and initiate account deletion. The deletion page explains confirmation, outstanding activity and retained records. Privacy requests, correction requests and consent withdrawal must have a monitored contact route. Applicable rights and complaint routes depend on your location and the confirmed legal operator.
Changes to this policy
The published version will show its effective date and explain how material changes are communicated. This review draft has no effective date.