Effective 2026-10-10
Pilot privacy notice
This notice covers the 1chess.online website, the verified pilot list and online play: guest profiles, games against people and bots, matchmaking, and one public chat room. Online play needs no account.
1. Who is responsible
The data controller is 1ChessOnline. Send data requests to privacy@1chess.online.
2. Data we process
- Pilot signup: normalized email, locale, selected feature interests, consent time, and pending, verified, or unsubscribed status.
- Acquisition: landing path, content cluster, and UTM values supplied by the URL. We do not place email or verification tokens in URLs.
- Abuse prevention: one-way hashes derived from IP and email for rate limiting. They are used for security, not player profiling.
- Optional analytics: only after you choose Allow, GA4 may receive page views, content type, locale, and funnel events. Email, form answers, and tokens are never sent to GA4.
3. Purposes and legal basis
We use data to send verification, administer the pilot list, provide access when the pilot opens, understand feature demand, measure acquisition, and prevent abuse. Pilot email and optional analytics rely on your consent. Minimal anti-abuse processing relies on legitimate interests where permitted. Withdrawing consent does not affect processing that was lawful before withdrawal.
4. Storage, recipients, and transfers
Signup data remains in the website database and is available only to maintainers who need access. Production hosting/database and transactional email providers may process it under the controller's instructions. Google receives analytics only after consent. We do not sell personal data.
Production processors and processing regions: Website hosting, data storage, transactional email, and optional analytics providers after consent.. Required safeguards apply to international transfers.
5. Retention
| Data | Planned retention |
|---|---|
| Verification token | Stored as a hash, expires after 24 hours, and cannot be replayed after use. |
| Unverified signup | Deleted within 30 days if verification is not completed. |
| Verified signup | Until unsubscribe or pilot close, then deleted or de-identified within 90 days unless law requires otherwise. |
| Rate-limit records | Hashed values are pruned within 24 hours. |
| Optional analytics | Up to 14 months in GA4; aggregate reports may remain longer but do not contain email. |
| Chat messages | 30 days; messages under a report are kept 180 days; legal holds until released. |
| Reports and moderation actions | Reports 180 days; moderation actions and strikes 1 year. |
| Guest profile and games | Until you delete it, or 400 days after your last visit. |
| Abort records | 30 days. |
6. Your rights and choices
You may ask to access, correct, delete, or restrict data; withdraw consent; object where applicable; and request information about processors or transfers. Email privacy@1chess.online from the registered address. We may verify control of the email before acting.
Every pilot email includes unsubscribe. Analytics choices can be reopened from the footer; declining analytics does not affect reading or signup. You may also complain to the competent data-protection authority where you live.
7. Children
The pilot does not set an age limit for playing chess and does not ask for date of birth. We do not knowingly seek children's data without an appropriate basis and authorization. A parent or representative can contact us to request review and deletion. If accounts, public profiles, or community features launch later, a dedicated minors workflow and notice will be introduced first.
8. Security and changes
Email is normalized and unique; verification and unsubscribe tokens are hashed; operational access is limited; and the production database must be backed up off-server. No system is perfectly secure, but suspected incidents will be contained, assessed, and notified as required.
If purposes, providers, or data categories change, we will update the effective date and provide a prominent notice where the change materially affects your choices.
9. Online play, chat and guest profiles
When you use online play we create a guest profile identified by an essential, HttpOnly cookie (oc_id). We use it to run games, match players, keep your game history and bot rating, enforce the community rules and prevent abuse. The legal basis is performing the service you request and our legitimate interest in a safe community.
The chat room is public and shared by players in every country. Messages are checked automatically; there is no team of human moderators. Mild swearing is masked, messages that break the rules are not sent, and community reports can hide a message. Automatic restrictions always expire (at most 7 days). Only the site owner can apply longer restrictions.
Public chat and challenges from strangers are for people 16 and over (self-declared). Younger players can still play bots, puzzles, friends and Quick Pair. You can download your data or delete your profile at any time from Name & settings.
- Guest profile: random id, display name and former names, language, settings, the answer to “how well do you play?”, age confirmation, recovery-code hash, hidden matchmaking ratings and a bot rating.
- Games: moves (PGN), time per move, result, time control and opponent. Opponents see your display name only.
- Chat: message text, time, detected language and the country code derived from your IP on our own server (used for the per-country chat switch; IP geolocation by DB-IP, db-ip.com).
- Safety: reports you send or receive (with the surrounding messages), blocks and mutes, automatic strikes and restrictions.
- Network: keyed hashes of your IP address and network prefix (never the raw IP) for rate limits and ban evasion checks.
- Bot opponents: bots 7–10 run on our servers (Stockfish); only moves are exchanged. Bots 1–6 run in your browser.
- Bot checks: Cloudflare Turnstile may run an invisible check when many profiles are created from one network.