Privacy Policy

Gambit collects what it needs to run chess games and a ledger, and nothing to sell. There is no analytics, no advertising, no tracking script and no third-party pixel anywhere in the app. The only outside company that ever receives anything about you is Stripe, and only when a real card payment is involved.

The two things people are usually surprised by: we store the IP address your session signs in from, and we record how many milliseconds you spent on every move you have ever played. Both are explained below.

Your account. A display name, an email address, a password, the time the account was created and last changed, an internal id, whether the account is suspended and why, what role it has, and which version of the terms you accepted and when. There is a field for a profile image; nothing in the app sets it today.

Your password is stored as a hash, never as the password. We cannot read it.

Your sessions. Every time you sign in we create a session row holding a token, an expiry, and — this is the part worth reading — the IP address and the browser user-agent string the sign-in came from. That is the default behaviour of the authentication library we use, and it is genuinely useful for spotting a stolen session, but it means your IP address is stored against your account for as long as the session row lives.

Your games. Every game you play, who you played, the time control, the starting position, the stake, the result, why it ended, and the complete move list. Move history is not a convenience — the server replays it to decide what the position is — so it cannot be discarded without breaking the game itself.

How long you thought. Every move carries the number of milliseconds spent on it. See the next section.

Your rating. A Glicko-2 rating, deviation and volatility, plus a history row for every game that moved it.

Your money. A ledger account, and a permanent double-entry record of every cent that has moved in or out of it: deposits, stakes into escrow, payouts, the house cut, refunds and corrections. Separately, a record of every attempt to move money across a payment provider — the amount, which provider, the provider’s reference, where a withdrawal was going, and why it failed if it did.

Integrity findings. When automated analysis flags your play, the flag itself is stored: what kind it was, a score, the plain-language reasons behind it, which game or which other account it concerns, and what a reviewer decided.

Server logs. The API writes operational logs — a request failed, a sweep ran, a payment was recovered. They carry internal ids such as your user id and a game id. They do not carry your IP address, your name or your email.

Because staked chess attracts engine assistance, and move timing is the cheapest signal there is for detecting it. A player consulting a machine has a different rhythm from one who is not, and that rhythm shows up in the milliseconds.

It has to be recorded from the first game or it is not there when it is needed, so it is recorded from the first game — including in free casual games, and including for players nobody has any reason to suspect. We analyse it, together with the pattern of results between accounts that repeatedly play each other, and the analysis can produce a flag for a human to review.

A flag is not a verdict and carries no automatic consequence. It withholds no payout and freezes no balance; it puts an item in a queue for a person to look at.

You cannot opt out of move timing and keep playing. It is part of how the game is stored.

This list is short and it is meant to stay that way.

• No analytics of any kind. No product analytics, no session recording, no heatmaps.
• No advertising, no ad networks, no advertising identifiers, and no sale or sharing of anything about you for advertising.
• No third-party tracking scripts, tags or pixels. The pages load nothing from anyone else’s server: the fonts are compiled into our own build and served from our own origin.
• No marketing email — in fact no email at all. There is no email provider connected to this application, which is also why account verification and password reset do not work.
• No error-reporting or crash-reporting service.
• No data brokers, no enrichment, no buying information about you from anywhere.

Stripe, and only for real card payments. When a deposit is taken in real-money mode, we ask Stripe to open a checkout page and we send it two things: the amount, and your internal Gambit user id so the payment can be matched back to your ledger account. We do not send your name or your email. You then give your card details to Stripe on Stripe’s own page — those details never reach Gambit — and Stripe collects whatever it needs to process the payment, under its own privacy policy.

Nobody else. There is no other processor, no other vendor with access, and no third party we hand data to for their own purposes.

We will disclose data when the law requires it — a valid legal demand — and to investigate fraud, cheating or a threat to the service. If we are ever bought or merged, your data would move with the service; you would be told before that changed anything about this policy.

The application, its database and its backups run on infrastructure we operate. Nothing about you is stored in a third-party service other than the payment records Stripe keeps for payments it processed.

Your display name and your rating are shown to opponents, in the lobby, and on the leaderboard. Anyone you play sees the moves you played and the result. If the game was staked, your opponent knows the stake, because they matched it.

Your email address, your balance, your payment records and your integrity flags are never shown to another player.

Pick a display name accordingly. It is free text and we do not check it, so it reveals exactly as much about you as you decide to put in it.

Accounts marked as administrators can read player records and work the integrity review queue. That access exists to investigate cheating and to fix money that has gone wrong, and reviewer decisions are recorded against the reviewer’s own account so no decision is anonymous.

An administrator can also open a session as you, to see what you see. Such a session is marked as an impersonation for its whole life, and the server refuses every write from it — it cannot stake your balance, play your moves, resign your games or move your money. It expires after fifteen minutes.

One cookie: the session cookie that keeps you signed in. It is strictly necessary — without it there is no signed-in state — and there are no advertising or analytics cookies to consent to, because there is no advertising or analytics.

Four small preferences are stored in your browser’s local storage and never sent to us: your light or dark theme, whether board coordinates are shown, whether pieces animate, and whether sound is muted. Clearing site data resets them and nothing else.

In the iOS app, the equivalent session token is held in the device keychain.

You can already see most of what we hold: your games and their full move lists on your history page, your rating, and every ledger line that has ever touched your balance on your wallet page.

You can change your display name yourself in settings.

Your email address cannot currently be changed, because changing it safely needs the email verification that does not exist.

Financial records are the exception that will survive any schedule we write. A ledger that forgets entries stops being able to prove balances, and payment records have to be retained for as long as the tax and anti-money-laundering rules that apply to them require.

Passwords are hashed. Sessions are tokens with an expiry, and cross-site request protection is on. Administrative access is a separate role that cannot be granted by anything a client sends, and impersonation cannot write. The invariants that protect money — balanced entries, one settlement per game, a balance that cannot go negative — are enforced by the database, not only by the code above it, so a bug in the application cannot overdraw an account.

Backups exist as tooling and are verified by a restore drill when they are run, but nothing runs them on a schedule and nothing yet ships them off the machine. That is a known gap.

No system is perfectly secure. If you find a problem, tell us before you tell anyone else.

Gambit is not for children. You must be at least 18 to play for a stake, and we do not knowingly collect anything from a child under 13. If you believe a child has an account, tell us and we will deal with it.

We do not verify anyone’s age.

Every version carries an identifier and a date, both printed at the top of this page.