Privacy policy.

What we collect

• Account data: email address, username, password hash (Argon2id), optional display name, country and avatar URL.
• Security data: session identifiers (hashed), IP address, browser user agent, trusted-device records, one-time-code attempts and audit events.
• Chess data: games, PGN, moves, analysis requests, puzzle attempts, ratings and achievements.
• Billing data: payment provider order and payment identifiers, amount, credits purchased and status. We do not store card numbers.
• Support data: messages, bug reports and the page you reported them from.

Why we use it

To operate your account, verify email, deliver two-factor codes, run games and analysis, meter credits, prevent abuse, answer support requests, comply with law and improve reliability. We do not sell personal data, and we do not use your games to train a public model.

Legal bases

Contract (providing the service), legitimate interests (security, abuse prevention, service improvement), consent where required (optional analytics or marketing), and legal obligation (tax and accounting).

Processors

We use Cloudflare for DNS and Turnstile, Razorpay for payments, Google for optional OAuth, analytics and, if enabled, AdSense, and our own mail infrastructure for transactional email. Each processor receives only what the task requires. Turnstile, Google OAuth, analytics and ads are loaded only when enabled.

Retention

Account and game data are kept while your account exists. Security logs are kept up to 12 months. Billing records are kept as required by Indian tax law. Email logs retain the recipient and delivery status, not the message body. Backups are rotated and encrypted at rest.

Your rights

You may request access, correction, export or deletion by emailing admin@chessurge.org from your account address. You can export games as PGN at any time. Deletion removes personal data; limited records may be retained for legal or fraud-prevention purposes.

Cookies

Essential cookies keep you signed in, remember your theme and, if you choose, trust a device for 30 days. We use privacy-conscious analytics to understand aggregate usage. If advertising is enabled, Google AdSense may set advertising or measurement cookies; where required, ads are only shown with consent. You can block non-essential cookies in your browser without losing core features.

Children

ChessUrge is not directed at children under 13. If you believe a child has created an account, contact us and we will remove it.

International transfers

Our servers are currently in India. Processors such as Cloudflare and Razorpay may process data in other countries under their standard contractual safeguards.

Contact

Email admin@chessurge.org or call +91 9471092673. Postal address available on request.