Privacy policy

1. Scope · playing without an account

This privacy policy covers the Kinglet Chess website (kingletchess.com). Computer play, lessons and puzzles work without an account. Multiplayer requires a verified account and a public name. There is no newsletter or payment processing.

Playing without an account still involves some technically necessary data; the sections below describe it. Minors may use an account only with their parent’s or guardian’s permission. Parents and guardians can contact us with questions or deletion requests.

2. Website delivery, hosting and security

When you visit the website, your browser sends technically necessary data, in particular your IP address, the requested address, time of access, browser and operating-system information and, where transmitted, the referring page. To prevent abuse, the server counts requests per IP address in memory (rate limiting); when a limit is exceeded, only the limit category and waiting time are logged, without the IP address.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is secure, reliable delivery of the website and protection against misuse.

Fonts and program code are served under our own domain through Cloudflare. We embed no external fonts or advertising scripts. Choosing Google sign-in takes you to Google.

Our Hetzner server is located in Nuremberg, Germany. Our own error and security logs have a retention period of no more than seven days. After technical outages, cleanup resumes on recovery. Providers’ technical logs are covered separately in section 7.

3. Games, tutor and analysis

When you start a game, the server stores the game setup (level, colour, tutor mode, time limit), all moves and positions, timestamps and result. Computer games can be opened by their address and appear in public lists; signed-in games also retain a stable account identity. Multiplayer games, PGN and post-game analysis are readable only by their two participants. Only public waiting rooms with an open seat appear in the list of open games, with name, avatar and Elo. Private invitations do not.

Chess computation and tutor rules run locally in your browser. You explicitly start post-game analysis after a game ends. For guest games, analysis stays in the open tab's memory and is not uploaded to the server. For signed-in players, analysis results may be saved with the game on the server. Multiplayer training offers only delayed status lights and never changes personal Elo.

We remove full completed guest games after 90 days and abandoned or failed games after 7 days from their known end time. Signed-in players can permanently access up to 100 completed full games per library. When this limit is exceeded, we announce archival of the oldest game on the website 30 days in advance and offer PGN export. For multiplayer games, we remove moves, PGN and analysis only after the game has been archived from both participants' libraries.

Unrated games are removed in full from the active game database after these periods; multiplayer games are removed once both participants have archived them. To keep Elo ratings reproducible and verifiable, we retain a reduced result record for rated games: game ID, model or player IDs, result, rating attributes and rating events. The move sequence, PGN, analysis, clock readings and player key are removed from archived games. The reduced record remains for as long as the rating is maintained and cannot be opened as a game. Account deletion removes the public player identity and sign-in link; other players' past rated results are not changed retrospectively.

Games and explicitly requested analyses are processed under Article 6(1)(b) GDPR. We process the reduced rating record under our legitimate interest in consistent, verifiable Elo ratings (Article 6(1)(f) GDPR).

4. Cookies and browser storage

Kinglet Chess uses essential session cookies for accounts, but no advertising cookies, tracking pixels or additional third-party analytics scripts. For game functions and settings the site uses your browser's local storage, which is also covered by Section 25 TDDDG.

The entries stay until you remove them in your browser; they have no automatic expiry. Unlike cookies, they are not sent with every request. The player key is sent only when you move, resign or stop in your game.

Guest learning progress is stored locally. Signing in imports the guest state into your account once without losing best results. Accounts privately store best stars, viewed steps, first-attempt and explanation status, baseline and visit dates, explicit learning-path choices, review recommendations and best trainer records per rules version and profile. We use these to restore and sync your learning state (Article 6(1)(b) GDPR), without a public learning leaderboard.

Pending changes are kept in an account-bound browser cache and retried when reconnected. Signing out or switching accounts removes this cache and starts a new guest; unsynced changes may be lost. Account deletion explicitly erases learning data, claims and import receipts on the server and in the browser, rather than retaining them on the anonymised player tombstone. Server learning data lasts until account deletion; guest data until import or removal in the browser.

Stars, jewels, rank, crowns and “new” markers are computed by your browser from this learning data; they are not stored separately and nobody else can see them.

Task statistics disabled. We currently collect no additional task events for aggregate quality statistics. Your personal learning progress is unaffected. Any existing daily counters without personal identifiers are cleaned up after twelve months.

The tab’s Session Storage holds invitations in kinglet-invite and kinglet-room-code:* for sign-in and display. They are removed after joining or starting, or when the tab closes. The server stores only a code hash, rotates it when a guest leaves and invalidates it within 30 minutes of room creation.

Our self-hosted account software Better Auth stores your email, verified sign-in, sessions and optional Google connection on our server (Article 6(1)(b) GDPR). The HttpOnly kinglet.session_token cookie (with __Secure- under HTTPS) authenticates HTTP and WebSocket access. Sessions can be revoked in the account menu. Your public name and chosen animal avatar are public; your email is not.

Passwords are stored only as salted scrypt hashes, never as plain text. Normal email sign-in sends no email. Registration, fresh identity confirmation and password recovery send codes through our SMTP service; password updates send a security notice without a password or code. Codes are valid for five minutes and stored only as hashes. Protected password setup also stores proof of code sign-in for at most five minutes, bound to your account and exact session. Other sessions are then revoked. Passwords are never sent to external checking services. Recovery from a backup clears old password hashes and requires signing in with an email code and setting a password. Account sessions last seven days and may be renewed during use. Expired codes and sessions are deleted in the regular hourly cleanup; outages delay deletion. Account details and private learning progress remain until account deletion. We do not collect your date of birth.

Personal Elo and result counters may include private rated games. After archival, only the reduced result record and rating events described in Section 3 remain. Account deletion first ends participation according to the leave rule, then removes the name, avatar and link to credentials. Other players’ previous results are not recalculated.

The player key is strictly necessary for the game you request (Section 25(2)(2) TDDDG, Article 6(1)(b) GDPR). Account sessions, invitations and learning/analysis progress support functions you request (Section 25(2)(2) TDDDG, Article 6(1)(b) GDPR). Display and control settings remember your choices (Section 25(2)(2) TDDDG, Article 6(1)(f) GDPR).

You can remove the entries at any time in your browser's site settings. This resets your settings. Losing a guest game key removes your ability to move in that game; account games remain accessible after signing in again. Games stored on the server are not affected.

The non-public operator area (access with an access key) also sets a technically necessary session cookie after sign-in (arena_session, HttpOnly, valid for one hour).

5. Operational statistics from ordinary app requests

To review traffic, we use the Cloudflare dashboard’s analytics of requests served through Cloudflare for operational monitoring and capacity planning (Article 6(1)(f) GDPR). These analytics use connection and request data processed by Cloudflare as our delivery and security provider. We do not add a Cloudflare Web Analytics script for this purpose. Cloudflare Web Analytics/RUM and our own daily IP counting are disabled.

To assess discoverability, we count requests for known public content pages at the origin server. Only the UTC day, known content route, language class, HTTP status, an unverified bot hint and a broad source class are stored. Sources are derived from selected referring domains or allowed source parameters; full URLs, parameters, user agents, IP addresses and account, game or room identifiers are not included in these measurements. The existing logging service adds a technical reception timestamp. Private operational logs are removed within seven days and limited to 30 MiB in total. Daily reports contain only these counters. There is no recognition of returning visitors or link to learning progress. Bot and source hints can be forged; requests establish neither individual humans nor AI citations.

Game totals are counted separately at creation, first valid saved move and completion. The existing deduplication journal contains a hash of a random game ID, event and day; known IDs remain linkable. Its purpose is to prevent duplicate game counts (Article 6(1)(f) GDPR). The journal and daily aggregates are cleaned up after 14 calendar months from the event date. Expired events are not counted again if processed later. Technical outages can delay cleanup, which resumes on recovery. Backup copies follow the separate periods in section 7.

6. Contacting us

If you email us, we process your address and message to answer your enquiry (Article 6(1)(b) or (f) GDPR). We delete ordinary contact enquiries six months after they have been resolved. Where particular records are subject to statutory retention duties or are needed to resolve a specific legal dispute, we retain only the necessary records for the applicable longer period.

7. Recipients and international transfers

We do not sell your data. Hetzner hosts the website, accounts and games. Cloudflare provides delivery and security. Cloudflare provides SMTP delivery of requested verification and recovery codes and security notices for password updates. This processes recipient addresses, message content and delivery information. Migadu-Mail GmbH (Switzerland) operates our contact mailbox and processes your contact address and message. We retrieve messages directly from Migadu and do not automatically forward them to another mailbox. Our self-hosted account software Better Auth is not an additional cloud recipient. Regular external backups using Cloudflare R2 are enabled. Backup operation follows the periods below.

If you choose Google sign-in, Google receives connection data and learns that you are signing in to Kinglet. We receive your Google account identifier and verified email address, not your Google password. We request only the openid and email permissions. Our processing supports the sign-in you request (Article 6(1)(b) GDPR). Available sign-in methods are shown in the account menu. Email and password will be enabled after separate acceptance. Google’s own processing is described in its privacy policy.

Cloudflare’s optional preview of complete sent emails is disabled. Previews created before it was disabled expire after approximately seven days according to Cloudflare. Delivery logs still include information such as recipient address, time, delivery status and errors. Cloudflare makes security events available for up to 31 days of history. This viewing period is not a general deletion deadline for all provider logs. Where no fixed period is specified, further retention depends on the necessary delivery, troubleshooting or security purpose and legal obligations. Details: Cloudflare email logs and security events.

At Migadu, we delete ordinary contact enquiries according to section 6. Migadu describes further retention as purpose-dependent and generally specifies deletion within 30 days after the service contract ends, subject to legal obligations and specific disputes. This contract-end period is not a deletion deadline for each individual email or backup. Transfers to Switzerland are covered by a European Commission adequacy decision.

Backups. Encrypted backups of the account, learning and game databases are stored in a private Cloudflare R2 bucket with EU jurisdiction. Hourly and test backups are scheduled for automatic deletion after seven days; daily and pre-migration backups after 30 days. A separate account-deletion journal containing a cryptographically derived identifier, action and timestamp is retained for 40 days so deletions can be reapplied after restoration. It contains no messages or learning progress. Incomplete uploads are aborted after one day. Provider processing times can delay actual deletion. Backups serve recovery only and are not an ongoing usage archive (Article 6(1)(f) GDPR; preserving erasure under Article 17 and security under Article 32 GDPR).

Cloudflare and Google may process data outside the EU/EEA. Storing backups in the EU does not mean every service processes data exclusively in Europe. Published contract and transfer information is available from Cloudflare, Migadu and Google. We have a data processing agreement with Hetzner; Cloudflare’s data processing terms form part of its service agreement. Migadu’s published privacy terms also serve as its data processing agreement. Cloudflare provides EU Standard Contractual Clauses for applicable international transfers. Google describes adequacy decisions, including the EU-US Data Privacy Framework for covered transfers, and Standard Contractual Clauses in the linked frameworks. You can also request information or copies of applicable safeguards through our contact address. Retention of providers’ technical logs depends on the service; our own log retention period does not automatically apply to these providers.

8. Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and to object to processing based on legitimate interests (Article 21 GDPR). Just write to [email protected]. For an account or game request, the relevant identifier helps us find the data. You do not need an account to object to visitor statistics. Please do not send passwords or sign-in codes.

You may also lodge a complaint with a data protection supervisory authority, for example the Hessian Commissioner for Data Protection and Freedom of Information: submit a complaint.

9. Changes

We update this policy when the website or the law changes. The version published here applies.