Privacy Policy
BidChess is a small hobby chess game run by [OPERATOR NAME] ("we", "us"). This page explains, in plain words, what we collect, why, how long we keep it, and how to delete it. If anything is unclear, write to privacy@bidchess.example.
The short version
- We collect only what the game needs: your email, your username, your password (stored only as a one-way hash) and your game history.
- No ads, no tracking SDKs, and we never sell or rent your data.
- You can delete your account at any time, in the app or via the account deletion page.
- BidChess has no real money in it. Points are only a game mechanic.
What we collect and why
| Data | Why we need it |
|---|---|
| Email address | To sign you in and to contact you about your account (for example a password reset). |
| Username | Shown to your opponents. It is public inside the game. |
| Password | To sign you in. We store only a salted Argon2id hash, never the password itself. |
| Game history | Moves, bids (after they are revealed), results and timestamps of your games, so you and your opponent can see past games and so we can keep games fair. |
| Sessions | Which devices are signed in (platform such as "android", app version, last use), so you can stay signed in and sign out everywhere. |
| IP address | Kept in our security audit log next to sign-in, sign-up and account events, to fight abuse and account theft. Short-lived server logs may also contain it. |
| Reports | If you report a player, or someone reports you, we keep the report (reason, optional note, game) to review it. |
We do not collect your contacts, location, photos, phone number or advertising ID. There is no chat in BidChess.
Legal basis
Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) we process your personal data on the basis of your consent, which you give when you create an account and accept these terms, and only for the purposes listed above. If you are in the European Union or the UK, the GDPR bases are: performance of a contract (running your account and games) and our legitimate interest in keeping the service secure and fair (audit logs, reports, bans).
How long we keep it
- Account data (email, username, password hash): until you delete your account.
- Security audit log (including IP addresses): 90 days.
- Server logs: 30 days. They never contain passwords, sign-in tokens or unrevealed bids.
- Backups: encrypted, kept on a rolling 30-day window. Data you delete disappears from backups within 30 days.
- Finished games: kept so your opponents still see their history. After you delete your account they are linked to an anonymous "deleted_xxxx" name, not to you.
Deleting your account
In the app: Profile → Delete account. This immediately deletes your email, password hash and sessions, resigns any game in progress, and renames your account to an anonymous "deleted_xxxx" name. More details, and what to do if you no longer have the app, are on the account deletion page.
Your rights
You can ask us to access, correct or erase your personal data, withdraw your consent (by deleting your account), and nominate another person to exercise your rights if you cannot. EU/UK users may also object to processing, ask for a copy of their data, and complain to their data protection authority. Write to privacy@bidchess.example; we answer within 30 days. For India, our grievance contact is [OPERATOR NAME] at the same address.
Who else sees your data
Your opponents see your username and your games with them. Our hosting provider stores the server and database on our behalf. We share nothing else, except where the law requires it.
Security
All traffic is encrypted (HTTPS/WSS). Passwords are hashed with Argon2id, refresh tokens are stored only as hashes, and access is limited to the operator. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
Children
BidChess is for people aged 13 or older. If you are under 18 (or under the age of digital consent where you live), please use it with your parent's or guardian's permission. We do not knowingly collect data from children under 13; if you think we have, contact us and we will delete it.
No real money
Points in BidChess are a game mechanic only. They cannot be bought, sold, won, cashed out or exchanged for anything, and they have no monetary value.
Changes
If we change this policy in a meaningful way, the version above changes and the app asks you to accept the new version.