Privacy Policy

ChessGrand decides how and why your personal data is used on Chess Grand and is the controller of it.

For anything in this policy, write to [email protected] or use the support form on this site.

We collect what the product needs to run, what the law requires us to keep, and what we need in order to tell a fair game from an unfair one. We do not buy personal data, and we do not run advertising trackers.

• Account: email address, username, date of birth, a hash of your password (never the password), the terms version you accepted and when
• Sign-in: for a Google or Telegram sign-in, the identifier and the basic profile that provider returns
• Technical: IP address, browser and device description, timestamps of sign-ins and of sessions still open
• Gameplay: your games, every move and its timing, results, ratings, tournament entries and placements
• Money: deposit addresses issued to you, transaction hashes, amounts and coins, balances, escrow, withdrawals and their status
• Fair play: the signals our anti-cheat analysis produces about your games, and any report made about you
• Communications: support requests you send, and what we reply
• Preferences: language, theme and interface settings
• Marketing choices: whether you asked for news and offers by email, when, where and in which wording, and any unsubscribe

You can sign in with Telegram on this site, or open Chess Grand inside Telegram as a Mini App from our Telegram bot. Each time you do, Telegram sends us, signed so that we can check it came from Telegram, your Telegram user ID, your first and last name, your Telegram username and a link to your profile photo. In the Mini App, Telegram also sends your language setting and whether you allow our bot to send you messages.

We store your Telegram user ID, which is how we recognise you the next time, your Telegram username, and whether our bot may message you. When an account is created through Telegram, we use your Telegram name as its first display name, which you can change in Settings, and we copy your Telegram profile photo to our own servers as its first avatar; like any avatar uploaded to this site, that copy is first checked by our image-moderation provider. Later changes to your name or photo in Telegram do not change them here. We do not store your language setting. An account created through Telegram has no email address until you connect one.

Our bot messages you only if you have allowed it to, and only about your own account: when a Google account is being connected to it, is connected or is disconnected, when a Telegram account is connected to it, and when someone opens a link you created to connect a Google account and says it was not them. We do not use the bot for marketing. Telegram carries these messages under its own privacy policy, and you can stop them at any time by blocking the bot in Telegram.

You can ask us to delete the data we received from Telegram, or your whole account: write to [email protected] or use the support form. We delete it except where the law requires us to keep a record, or where it is the evidence behind a money, fair-play or fraud decision (see “How long we keep it”).

When you sign in with Google, or connect a Google account to an account you use with Telegram, Google tells us your Google account ID, your email address and whether Google has verified it, your name, a link to your profile picture and, if Google provides it, your language setting. We ask Google for nothing more: we never see your Google password, your mailbox, your contacts or your files.

We store the Google account ID and the email address on your account, and that address becomes your account's email address. When you sign in with Google, your Google profile picture is shown as your avatar and is updated each time you sign in with Google. When a Google sign-in creates your account, or is first added to an existing account, we also use your Google name as its display name and keep the language setting if Google sent one.

We use Google data only to sign you in, to give your account an email address, and to show your name and picture. We do not use it for advertising and we do not pass it to advertising platforms. We send marketing email to that address only if you ask for it (see “Marketing email”).

When you connect a Google account to an account you use with Telegram, or connect Telegram to an account you opened on this site, we keep a record of each attempt, so that we can stop someone from connecting their account to yours, look into a complaint and undo a connection. The record holds which account started it and whether from Telegram or from this site, the time of each step, the IP address and browser description of the devices used for each step, the Google email address and name shown to you for confirmation, and the result.

After 180 days we erase the IP addresses, the browser descriptions and the Google email address and name from that record, and keep only its result and times. Like any sign-in, each step also appears in your account's activity log (see “What we collect”).

When a Google account is connected, we may send a notice to that Google address and, if you allow our bot to message you, a Telegram message, each with a way to undo the connection within 7 days.

Each purpose below is separate, and we do not quietly reuse data collected for one purpose for another.

• To run your account and the games and tournaments you play
• To take deposits, hold balances, settle stakes and send withdrawals
• To keep the platform fair: detecting engine assistance, collusion, multiple accounts and fraud
• To keep accounts secure: sign-in checks, session control and abuse investigation
• To meet legal obligations, including age limits and financial-crime rules
• To send service messages: verification, password resets, and notices about your money or your account
• To fix defects and understand which parts of the product are used, in aggregate
• Only if you ask for it: to send you news and offers by email (see “Marketing email”)

We send news and offers by email only if you ask for them. We ask with a box that is never ticked for you: when you register, when you confirm a Google account you are connecting, once in a one-time question if your account already has an email address, and at any time in Settings → Notifications. Saying no, or not answering, changes nothing else: the service works the same either way.

When you answer, we record your answer, the time, where you gave it and the version of the wording you were shown, so that we can show what you agreed to. Our legal basis for marketing email is your consent.

You can withdraw at any time, and it takes effect at once: use the unsubscribe link in any of these emails (one click, no sign-in needed), or turn the option off in Settings → Notifications. Emails about your account, your games and your money are not marketing and continue.

Marketing email goes only to an address you have confirmed, and never to an address that has bounced or been reported as spam. To send it we give your email address to the email-delivery provider that sends it for us. We do not sell your address, and we do not give it to advertisers or advertising platforms.

Where data-protection law asks for a legal basis: we process account, game and money data because it is necessary to perform our contract with you; we process fair-play, security and anti-fraud data on our legitimate interest in a platform that is not rigged; we keep age and financial records because the law requires it; and anything optional we ask for by consent, which you can withdraw.

We do not sell personal data and we do not share it for anyone else's marketing.

• Infrastructure providers who host the service and store its data on our instructions
• Email delivery, so verification and account notices reach you
• Blockchain nodes and rate providers, which see the transactions and addresses a deposit or withdrawal involves
• An image-moderation provider, which checks each profile picture uploaded to this site, and each Telegram profile photo we copy, before it is shown
• Telegram, which runs the Mini App you open inside it and carries the messages our bot sends you
• Professional advisers, and an acquirer if the business is ever sold
• Law enforcement or a regulator, where we are legally required to respond, or where we need to establish or defend a legal claim

A deposit or a withdrawal is a public transaction on the coin's network. The address, the amount and the time are permanently visible to anyone, and cannot be edited or deleted by us or by you.

Anyone who can link an address to you can see what moved through it. Consider that before you reuse an address you have published elsewhere. Monero is the exception among the coins we support, as its transactions are not public in the same way.

We keep account, game and transaction records for as long as your account is open, and afterwards for as long as we are required to keep financial and age-verification records, or for as long as a claim could still be brought.

Closing your account deactivates it rather than erasing everything: the email address and username stay reserved so the account cannot be reopened or re-registered, and the money and fair-play records that prove what happened stay with it.

Support requests are kept separately from your account, so that closing the account does not delete the complaint you made about it. Technical logs are kept for a short period for security triage and then discarded.

Depending on where you live, you can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, or ask for it in a portable form.

Write to [email protected] or use the support form. We will answer within one month. We may ask you to confirm who you are first, and we may have to refuse a deletion where the law requires us to keep the record, or where it would remove the evidence behind a fair-play or fraud decision.

If you are not satisfied with our answer you can complain to the data-protection authority where you live.

We use the smallest set of cookies the product can run on, and none of them are advertising cookies.

Parts of the site load third-party components: Google Sign-In, Telegram's login widget, and the anti-abuse challenge on the registration form. Those providers set their own cookies when they load, and their own privacy policies apply.

• A session cookie that keeps you signed in, and the refresh token behind it
• A language cookie so the site opens in the language you last used
• Local storage for interface preferences such as theme and board settings
• Short-lived cookies that hold a Google sign-in, or a step of connecting a Google account, while it is in progress (at most 15 minutes)

Passwords are stored as hashes and never in a readable form. Traffic to the site is encrypted. Sessions expire, one device is signed in at a time, and unusual sign-in activity locks an account rather than letting it run.

No service can promise it will never be breached. If a breach affects your data we will tell you and the relevant authority as the law requires.

The platform is for adults only, and we do not knowingly hold data about anyone under 18. If we learn that an account belongs to someone under age we close it and delete the data we are not required to keep.

Our infrastructure and our providers may be in a different country from you, so your data may be transferred and processed there. Where it is, we rely on the safeguards data-protection law provides for such transfers.

This policy is versioned, and its version and effective date are shown at the top of this page. Where a change materially affects how we use your data we will tell you before it takes effect.

[email protected] for anything about your data, or the support form on this site for anything else.

ChessGrand.