Privacy Policy
How Ember Chess processes account, gameplay, training, chat, moderation, product activity, and basic registration-source information.
Version 1.9 · Effective 2026-10-02
Puzzle training
We store your puzzle attempts, unfinished positions, results, separate puzzle rating and training progress. We may use mistakes in your completed reviewed games to generate private personal puzzles using local Stockfish analysis. Personal puzzles and their source-game links are available only to you; source games keep their existing access rules. External puzzles come from a locally stored CC0 Lichess database. Normal puzzle solving does not contact Lichess or send your identity there. Puzzle records remain while your account is active and are included in account export; account deletion removes your attempts, puzzle rating, personal puzzles and generation jobs. An unfinished adaptive attempt expires after 30 days without progress and counts once as unsuccessful. Retained backups follow the backup policy below.
Who we are and who can use Ember
Ember Chess operates this service. Contact [email protected] about privacy. Ember is not intended for children under 13. Account holders must be at least 13 and meet any higher minimum age where they live. We do not currently offer a parental-consent program for younger users or verify government identity or age.
Information we process
Account information includes username and username history, optional email address and verification status, a password hash, role and account status, immutable account creation time, appearance preferences, and optional invite metadata. Recovery records can include hashed time-limited verification or reset tokens, encrypted authenticator secrets, hashed one-time recovery codes, session and approximate device metadata, and security-event history. Staff badges reflect account roles. Optional Ember and externally verified chess titles include assignment and audit history; official-title verification can include a federation ID, verification method, evidence reference, and internal staff note. Gameplay information includes challenges, games, moves, move times, positions, PGNs, results, opponents, time controls, rating changes and placement progress, bot settings, analysis, Ember Accuracy, and training activity. We process human-game chat, reports, limited surrounding evidence, fair-play case evidence, rating-adjustment records, appeals, sanctions, moderator notes, and audit events. For authenticated product use, we record a daily account activity date and first/last activity timestamps; this is throttled and does not store an IP address or device identifier in the activity record. When a registration comes from an Ember link, we may retain first-touch campaign source, medium, campaign name, referring hostname, and the first Ember landing path with that account for growth reporting. Before signup, a separate attribution cookie lasts up to 30 days; after account deletion, linked attribution is de-linked and limited aggregate counts may remain. We do not retain the referring URL query string. A restricted internal/QA exclusion flag and reason may be kept for aggregate reporting. Technical records can separately include IP address, browser or device information available in requests or logs, timestamps, routes, sessions, network events, rate-limit data, and errors. We do not currently require real names or government ID, collect payment-card information ourselves, sell personal information, or use behavioral advertising. Passwords are not stored in plaintext.
Why we use information
We use information to create accounts, authenticate sessions, run chess games and ratings, provide bots and analysis, save history and preferences, support challenges and chat, review reports and appeals, prevent abuse, understand account registration and product use through first-party aggregate reports, troubleshoot failures, improve the product, and meet applicable legal obligations.
Tournament records
Public tournaments display organizer identity, entrants, pairings, standings, results, and completed-event history to signed-in viewers. Unlisted events require an invite link or participation. A public tournament record remains visible even when a player restricts their separate profile game-history page. Completed game review still follows the existing player privacy rules. Tournament records and audit history may remain after account deletion, with the former username replaced by Deleted Player.
Live viewing choices
Watch lists public tournament boards and ordinary human games shared by both players. Live viewers see the players, position, moves, clocks, game mode, result, and public event details. Game chat and player controls are excluded. Ordinary games require separate consent from both players for each game; either player can end live viewing immediately. Rematches start private. Unlisted tournament boards and computer games are not listed in Watch. Completed-game review continues to follow both players’ history privacy settings.
Profiles and social sharing
Signed-in players can view current usernames, joined dates, ratings, records, earned titles, and profile pictures. Players may send friend requests, become friends, block others, and set online status, last active, game history, friend-request, and challenge visibility. By default online status and last active are visible to friends, completed-game history to signed-in players, and friend requests and challenges are available to signed-in players. A shared completed game can reveal both opponents, moves, result, PGN, and saved review. We require both human players to permit access for a nonparticipant viewer. Active games, private game chat, reports, and internal fair-play evidence are not opened by profile visibility. We process profile picture uploads into square WebP images, remove source metadata, and do not retain the original upload. A reported picture revision may be retained as moderation evidence. Blocking removes friendship and pending requests and restricts social contact, but does not change completed results or end an active game.
Activity and registration attribution
Authenticated activity is grouped by Pacific calendar day and used for daily, weekly, and monthly account activity counts and limited signup-retention measures. Anonymous visits, crawler requests, and health checks are not counted as account activity. Only after you opt in through Privacy choices, a separate first-party, Secure, HttpOnly, SameSite=Lax attribution cookie can preserve the first Ember landing source for 30 days across emberchess.com and play.emberchess.com; it contains no authentication credential and cannot grant access. UTM source, medium, and campaign values are bounded and sanitized. We categorize known search/referral hosts where possible and otherwise use the available source or Unknown. Campaign values and referring hostname are visible only to authorized administrators. Optional attribution is off by default. You can withdraw through Privacy choices; this clears that browser’s attribution cookie and, when signed in, stored account source details. A necessary preference cookie remembers this choice for one year. We do not add advertising analytics or fingerprinting.
Providers and sharing
Cloudflare provides DNS, HTTPS/TLS, Tunnel, network and security services, and inbound email routing for Ember Chess. Our interface requests fonts from Google Fonts, which receives ordinary network request data such as IP address. Stockfish analysis runs on Ember’s server and does not send games to an external AI provider. If transactional outbound email is enabled, its configured delivery provider processes destination email addresses and message content needed for verification or recovery. Other players see information needed for games and challenges, such as usernames, moves, results, and displayed staff or verified chess titles. Authorized staff can inspect game, report, case, and title-verification information needed to assess safety or credentials. Internal evidence and reporter identity are not shown to players through game history. We may disclose information where required by law or to protect the service and its users.
Retention
Account information can remain while an account exists. Daily authenticated activity and first-touch registration attribution are used to calculate product aggregates. When an account is deleted, its activity and acquisition records are de-linked from the account identifier while de-identified aggregate counts may remain; account-linked retention measures then exclude it. Internal exclusion audit history, games, ratings, and moderation or audit records may be retained for competition, safety, security, or legal integrity. Ordinary completed-game chat is scheduled for cleanup after approximately 48 hours; chat in an active game remains available while that game is active. Reports preserve a limited evidence snapshot, which can outlive ordinary chat. Technical logs are retained as reasonably necessary and may also be held by infrastructure providers. Backups may contain deleted information until an operator removes the relevant backups; there is currently no automatic backup expiry. We do not promise a fixed deletion date for every retained record.
Notifications and feedback
In-app notifications store account-specific events, read status, and safe navigation links for 90 days. Feedback stores your category, subject, description, account ID and username, route without query parameters, accessible game ID when relevant, Ember build/version, browser family, device class, and timestamp. Authorized feedback staff may read reports and record internal notes; those notes are never visible in My Feedback. Do not send passwords, authenticator secrets, recovery codes, or private chat in feedback. Screenshots are not collected. Feedback does not send email. Resolved or closed feedback is removed after 180 days without updates; open reports remain until resolved or the account is deleted. Account deletion removes notifications and feedback, while a minimal staff action audit may remain.
Age eligibility concerns
Ember is for users age 13 or older and any higher minimum age required locally. We do not request a full birth date. An ineligible age declaration prevents signup. If authorized staff establish actual knowledge that an existing account is under 13, they disable access and pseudonymize it through the account deletion process. Credentials, sessions, ordinary avatars, social state, notifications, and feedback are removed. Limited pseudonymized competition, moderation or security records and backups may remain as described above. Contact [email protected] to report a concern; an unverified allegation alone is not treated as proof.
Security
We use password hashing, HTTPS, Secure and HttpOnly session cookies for public HTTPS use, server-side role authorization, origin and host checks, rate limits, authenticated WebSockets, bounded engine jobs, backups, and operational logging. No system is perfectly secure.
Your choices and rights
While you can sign in normally, Privacy & Account lets you download a machine-readable export of your own data and request account deletion with password confirmation. If your account is suspended or banned, contact [email protected] for a privacy request. Deletion disables access and pseudonymizes the account while preserving records needed for other players’ history and legitimate moderation, security, or legal purposes. For access, correction, deletion, restriction, objection, or portability requests where applicable law provides them, contact [email protected]. We will assess requests under applicable law and may need to retain some records.
Questions?
Contact [email protected].