Chess Arena

Privacy policy

Last updated: 15 October 2026

Who we are

Chess-Arena is published by Ivan Stoev, an individual developer based in Sofia, Bulgaria — "we". We are the controller of the personal data described here. Contact: support@chess-arena.org.

The short version

We collect only what the game needs. The first time you open the app it makes a game account for you on our server, with a random player number, so your coins and progress are saved and can come back on a new phone. You do not have to give us your real name, e-mail or phone number. We do not build an advertising profile of you and we do not sell your data. When you play online, the game sends what it needs to play to the other player. Two things are optional and off until you say yes: anonymous crash and usage reports, and (once ads are switched on) personalised ads.

Your game account

When the app first starts, our server creates an account with a random player number, a secret key that lets your phone sign in to it (we keep only a scrambled fingerprint of the key), the kind of phone (iPhone or Android), the date it was made, when it was last used and a friend code. The app then saves a copy of your game to it: coins, level and experience, rating and game statistics, the items you own, quests, vault, adventure and puzzle progress, daily-reward dates, game settings, and the player name, country and avatar you chose. This keeps your progress safe if you lose or change your phone, and lets us deliver purchases and rewards. The server is run for us by Cloudflare, Inc. (Cloudflare Workers and D1). Data may be stored and processed in the European Union and in other countries, including the USA; transfers outside the EEA are protected by the European Commission's standard contractual clauses. We keep the account until you delete it. Legal basis: providing the game you asked for (contract, GDPR Art. 6(1)(b)).

You can link your account to Sign in with Apple or Google (Quests > Account & Friends) so you can get it back on a new phone. Apple or Google then tells us a sign-in number for you and your e-mail address (with Apple you can choose to share a private relay address instead). We use them only to find your account again. We do not send you marketing e-mails and we never see your Apple or Google password.

Friend codes

Every account has a friend code. If you enter a friend's code, we record that you were invited by that account so that both of you get the reward. The person who invited you sees how many friends joined, not who they are.

What stays on your phone

Your phone keeps its own copy of your game, plus the list of players you have blocked and your sound and display settings. Deleting the app erases the phone's copy. Settings > Delete account erases both the phone's copy and your account on our server.

Games online (friends and matched players)

When you create or join a room, or search for an opponent, the app sends your random player number, player name, avatar, level, country flag, your rating and game statistics (games played, wins, best win streak, biggest win, date you started), the room code or search queue, the clock chosen, your moves, clock times, draw offers, emojis and chat messages. These travel through a third-party message server (currently EMQX and HiveMQ public servers) to the other player's phone. We do not store them. The server operator may keep technical logs such as IP addresses under its own policy, and these servers may be located outside the European Economic Area. Legal basis: providing the game you asked for (contract, GDPR Art. 6(1)(b)).

The rank list

The Rank list is served by our server and every player of the app can see it. It shows each player's name, country flag, avatar, level, rating, wins, losses, draws, best win streak, biggest win, coin balance and the date they started. Delete account removes you from it. Legal basis: providing the feature (Art. 6(1)(b)).

Playing the computer

Practice games against the computer happen entirely on your phone. Nothing is sent anywhere.

Game analysis

When a game is analysed, the app sends the positions of that game (the board positions only, with no name, player number or other information about you) to our analysis server, which is run for us in the European Union (Hetzner, Germany). The server works out the moves and sends the result back. It keeps positions in its memory for a while so the same position is not worked out twice, without anything that links them to you. Your IP address is used only briefly to stop abuse (limiting how many positions one address can ask for) and is not stored. Legal basis: providing the analysis you asked for (contract, GDPR Art. 6(1)(b)).

Purchases

Coin, offer and Puzzle Pass purchases are handled entirely by Apple (App Store) or Google (Google Play). We never see your card or payment details. After a purchase the app sends our server the store's transaction number; the server checks it with Apple or Google and then delivers the coins, items or pass. We keep a record of each purchase (transaction number, product, date, what was delivered and to which account) so that it is delivered once only, to deal with refunds and questions, and for accounting for as long as tax law requires. Coins have no cash value and cannot be exchanged for money or anything of value. Subscriptions renew until you cancel them in your store account. Legal basis: contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).

Rewarded ads

You can choose to watch an optional video ad in exchange for coins or a bonus; there are no ads in or between games. Ads are provided by Google AdMob. When you watch one, Google and its ad partners may process your advertising identifier, IP address and device information to serve and measure the ad and prevent fraud, under Google's own policy. In the EEA, UK and Switzerland you are first asked, through Google's consent form, whether ads may be personalised; you can say no and still watch ads, which are then not personalised. Puzzle Pass Pro subscribers can collect the same rewards without watching an ad. (Ads are switched on once the app has its ad account; until then the app shows a test ad that sends nothing.)

Crash and usage reports (optional)

If you allow it (first launch, or Settings > Anonymous reports), the app records technical crash reports (what went wrong, app version, phone model and system version) and simple usage counts (for example which screens are opened) so we can fix problems and improve the game. They do not contain your name, player number or chat, and are not linked to you. If you do not allow it, nothing is collected. You can change your mind at any time. Legal basis: your consent (Art. 6(1)(a)).

The clock check

So that daily rewards cannot be collected twice by changing the phone's clock, the app asks a Google server for the current time. This is a plain technical request (it reveals your IP address to Google, as any connection does) and sends nothing about you.

Chat safety

Chat is filtered for abusive words, links and phone numbers. You can mute chat, block a player (they can no longer play or talk with you) and report a player. A report opens an e-mail from you to us containing the player's number, name and their recent messages; we use it only to look into the report and protect players (legitimate interest, Art. 6(1)(f)), and keep it for up to 12 months.

Contacting us

If you e-mail us, we use your e-mail address and message only to answer you, and keep them for up to 24 months.

Age

Chess-Arena includes simulated casino-style games played with virtual coins. It is intended for adults (18+) and is not directed at children. If you believe a child is using it or has sent us personal data, contact us and we will delete the account.

Your rights

Under the GDPR you may ask for access to, correction or deletion of your personal data, restrict or object to its use, and ask for a copy (portability). Settings > Delete account erases your account on our server straight away, except the purchase records the law requires us to keep. For anything else, write to support@chess-arena.org. You may also complain to the Bulgarian Commission for Personal Data Protection (www.cpdp.bg) or your local data protection authority.

Security

Everything the app sends to our server, to the message servers and to the analysis server travels over encrypted connections (TLS). Your phone's secret key is stored on our server only as a fingerprint. Because online games use public message servers, a determined person could read or forge a message in a game, so do not share personal information in chat.

Changes

If this policy changes we will update it here and, for important changes, tell you in the app.