Privacy Policy

What the Chess? is an independent strategy game, available on the web at whatthechessgame.com and as an Android app (package com.whatthechess.game). In this policy, “we” means the team that makes and operates the game. For any privacy question you can reach us at hello@whatthechessgame.com.

You can play against the computer without providing an email address, and gameplay remains available if identity services are unavailable. When a connection is available, the game creates a pseudonymous guest identifier and authentication session to operate guest mode and service features. If you want online play and account features—such as matchmaking, rated games against other people, saved progress across devices, ratings, statistics and achievements—you can attach an email address to your profile or sign in. This policy covers both guest and signed-in use.

We collect only the categories described below. Some are collected only when you use the related feature.

• Guest identifiers and authentication data: a randomly assigned pseudonymous guest or user ID and the authentication and session data needed to operate guest mode and keep you signed in. If you add or use an email account, we also process your email address. Authentication is handled by Supabase.
• Profile details you choose: an optional display name and username, an optional avatar or profile photo, and interface preferences such as your piece theme.
• Account-linked game records: completed games and their results, moves and timelines, move counts, formations used, duration, opponents faced, Jester conversions and post-game analysis, plus in-progress saved games.
• Ratings and statistics: your rating and rating history, wins, losses, draws and peak rating.
• Achievements and progress: achievements you have earned and any you feature on your profile.
• Online-play records: challenges and invitations, matchmaking queue entries, player-search terms, and online match records including live presence while a match is in progress.
• Messages and forms: anything you type into the feedback, contact, physical-game interest or account-deletion forms, including an email address where you provide one.
• Limited game analytics: a randomly generated app or browser installation identifier; app version and build, platform and runtime; app opens; tutorial completion or skipping; whether a saved game exists; and game events such as mode, opponent type, computer difficulty, formations, player color, result, move count and duration. The current PostHog integration does not send your name, email address, profile photo, full move history or advertising ID, and does not use session replay or automatic interaction capture.
• Android advertising and consent data: the Android app includes Google Mobile Ads (AdMob) and Google’s User Messaging Platform. When advertising features operate, Google may automatically collect or receive an IP address, approximate location derived from it, app interactions, diagnostic information, device or account identifiers such as the Android advertising ID or app set ID, and advertising-consent or privacy choices. Google uses this information for advertising, analytics, measurement, security and fraud prevention. Collection can vary based on device settings, consent choices, region and whether limited or non-personalized ads are used.
• Android purchase and entitlement data: when you make or restore an in-app purchase, we and our providers may process the product purchased, purchase token, order or transaction status, entitlement status and related timestamps to complete, verify, restore and support the purchase and prevent fraud. Google Play Billing and Google Payments process the payment itself. We do not receive or store your full payment-card or bank-account details.
• Notification data: if you allow push notifications, we process a Firebase or browser push token, the associated pseudonymous user and installation identifiers, platform, delivery status and limited app activity such as account creation, app return and whether a game was completed. We use this to send challenge alerts and a limited number of onboarding reminders. Notification messages do not contain your email address or private game history.
• Transactional email: when you first verify an email account, we use your email address to send one welcome message. This is separate from marketing email and is not used to subscribe you to a mailing list.
• Local data: preferences, progress, a pseudonymous analytics identifier and a small pending analytics queue may be stored on your device. Signed-in users may also sync supported game data to the service.
• Website analytics: the public website uses Vercel Web Analytics to measure page views and general usage with data such as the page or route visited, referrer, approximate location, device type, operating system and browser. Vercel describes this service as anonymous and aggregate.
• Ordinary technical and security data: providers process network information such as IP address, browser or device type, and diagnostic and security logs to deliver the service, route requests, prevent abuse and keep it secure. An IP address may also be used by a provider to derive an approximate region.

• To provide the game and its online features, including sign-in, matchmaking and multiplayer matches.
• To save your progress, ratings, statistics and achievements and show them back to you.
• To operate leaderboards, ratings and fair matchmaking between players.
• To understand broad feature usage, diagnose problems and improve the game and website.
• To process, verify, restore and support Android in-app purchases and maintain paid entitlements.
• To display, measure and protect advertising, respect applicable advertising choices, and prevent invalid activity and fraud.
• To respond to your messages, feedback and requests.
• To send a one-time welcome email and, when you grant device or browser permission, challenge alerts and limited reminders intended to help you begin playing.
• To gauge interest in the physical edition when you opt in to the interest list.
• To keep the service secure and to detect, prevent and address fraud, abuse and technical problems.
• To meet legal obligations and enforce our terms.

Online play is social by design. When you play or compete with others, details such as your display name or username, your avatar or profile photo, your rating and the information about a shared match are intentionally visible to your opponents and, for rated and public play, to other players. Do not put anything you want to keep private into your display name, username or avatar.

We keep the number of providers small, and we share only what each one needs to do its job.

• Supabase provides authentication, database, file storage and realtime services for guest and signed-in identifiers, profiles and profile photos, saved and completed games, ratings, achievements and online play.
• PostHog processes the limited pseudonymous game analytics described above. The current integration uses PostHog’s United States service endpoint and does not enable session replay or automatic interaction capture.
• Vercel hosts the public website, browser game and online services, processes ordinary technical and security logs, and provides aggregate website analytics.
• Resend delivers our transactional email, including the one-time member welcome and confirmations or administrative notifications about your requests.
• Firebase Cloud Messaging delivers Android push notifications and processes push tokens, app-instance identifiers and delivery information needed to route those messages. Browser push delivery will use the corresponding browser push service when that option is available.
• Google Play Billing and Google Payments process Android in-app purchases and payment transactions. They provide the transaction information needed to verify purchases and maintain entitlements, but they do not provide us with your full payment-card or bank-account details.
• Google Mobile Ads (AdMob) provides advertising in the Android app, and Google’s User Messaging Platform helps manage advertising consent and privacy choices where applicable. These services may collect and share the advertising and consent data described above for advertising, analytics, measurement, security and fraud prevention.

These providers may process information in the United States and other places where they or their service partners operate.

You can learn more in the Google Privacy Policy and Google's information about how it uses information for advertising.

We do not sell your personal information. The Android app includes Google Mobile Ads (AdMob) and may display personalized, non-personalized or limited ads depending on your region, device settings and available consent choices. Information sent to Google for advertising is described above and may be treated as data sharing for app store disclosures even though we do not sell it.

The website and browser version do not currently display third-party advertising. If advertising is enabled there in the future, we will update this policy and provide any notice, consent or opt-out controls required before or when that advertising is introduced.

We serve the site and app over HTTPS and apply reasonable access controls, including database row-level security, to protect your information. No method of transmission or storage is perfectly secure, so while we work to protect your data we cannot guarantee absolute security.

We keep account information for as long as it is needed to provide the service. When you make a verified deletion request, we normally complete it within 30 days. After that, limited records or backups may remain temporarily—only for security, fraud prevention, resolving disputes, meeting legal obligations, or until normal backup cycles expire—and are then removed. Purchase and transaction records may be kept as needed to maintain entitlements, process refunds, prevent fraud, and meet accounting, tax or other legal obligations. Technical logs, advertising data and pseudonymous analytics are retained according to our provider settings and policies and only as long as reasonably needed for the purposes described above. Analytics or advertising data that is not connected to an email account may not be identifiable as belonging to a particular person.

You can ask us what we hold about you, ask us to correct it, and ask us to delete it. You can also clear locally stored game data, including the local analytics identifier and pending analytics events, by clearing the app or site data on your device. You can ask us to remove an email address from the physical-game interest list. Device-level Android controls may also let you reset or delete the advertising ID and limit certain advertising uses. You can decline notification permission, turn notifications off at any time in Android or browser settings, or remove a registered device by signing out. Where required, advertising consent or opt-out choices are presented through the app or the relevant provider.

To delete your account and associated data, use the Delete Your Account and Data page (https://whatthechessgame.com/delete-account). You can also email hello@whatthechessgame.com.

The service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will remove it.

We may update this policy as the game and its services change. When we do, we will revise the “Last updated” date above and describe material changes here.

September 25, 2026: Added disclosures for the one-time member welcome email, Android and browser push tokens, challenge alerts, onboarding reminders and notification controls. September 16, 2026: Added disclosures for Android advertising, advertising-consent choices, Google Play Billing, purchase verification and possible future advertising in the website and browser version.

Questions about this policy or your data can go to hello@whatthechessgame.com.