Privacy Policy

Last updated: March 2026

1. Introduction

AuroraChess ("we," "our," or "the Platform") is a self-hosted, open source chess platform. This Privacy Policy explains how the operator of this instance collects, uses, stores, and protects your personal information when you use the Platform.

By creating an account and using AuroraChess, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this policy, you must not use the Platform.

2. Information We Collect

2.1 Account Information

When you register, we collect:

• Email address
• Username
• Password (stored as a bcrypt hash — we never store your plaintext password)

2.2 Game Data

When you play games, we collect and store:

• Game moves (SAN and UCI notation)
• Game results, time controls, and timestamps
• Elo rating changes
• Post-game analysis results (engine evaluations, move classifications)

2.3 Social Data

• Friend lists and friend request history
• Online presence status (stored temporarily in Redis with a 30-second expiry)

2.4 Preferences

• Display preferences (dark/light mode, board theme, piece set)
• Game collections you create

2.5 Technical Data

• IP address (logged in server access logs and admin audit logs)
• Authentication tokens (JWT access tokens and hashed refresh tokens)
• Session data stored in cookies (httpOnly refresh token cookie)

2.6 Offline Data

When playing offline, game data is stored locally in your browser (localStorage). This data is synced to the server when you reconnect to the internet.

3. How We Use Your Information

We use your information to:

• Provide and maintain the chess platform
• Authenticate your identity and manage your account
• Display your profile, rating, and game history to other users
• Facilitate real-time multiplayer games via WebSocket connections
• Run post-game analysis using the Stockfish chess engine
• Calculate and update Elo ratings
• Show friend online status
• Enable admin users to manage the platform
• Generate aggregate platform statistics (total users, games played, etc.)

4. Data Storage and Security

• All data is stored on the server infrastructure where this instance is hosted
• Passwords are hashed using bcrypt with 12 rounds
• Refresh tokens are SHA-256 hashed before storage
• JWT access tokens expire after 15 minutes
• Refresh tokens expire after 7 days and are rotated on each use
• Admin actions are protected by CSRF tokens and rate limiting
• All admin mutations are logged in an audit trail

5. Data Sharing

AuroraChess is a self-hosted platform. Your data is not shared with any third parties. The Platform does not use any external analytics services, advertising networks, or third-party APIs. All processing happens on the server infrastructure where this instance is deployed.

6. Public Information

The following information is publicly visible to other users:

• Username
• Rating
• Game history (opponents, results, time controls)
• Win/loss/draw statistics
• Account creation date

7. Cookies

We use the following cookies:

• refresh_token — httpOnly, secure (in production), sameSite: lax. Contains an encrypted refresh token for session management. Expires after 7 days.
• csrf_token — Used for CSRF protection on admin panel operations. Expires after 1 hour.

8. Data Retention

• Account data is retained for as long as your account is active
• Game data is retained indefinitely as part of the platform history
• Expired refresh tokens are deleted on use or expiry
• Online presence data expires after 30 seconds in Redis
• Prometheus metrics are retained for 30 days. Logs in Loki follow default retention policies.

9. Your Rights

You have the right to:

• Access your personal data through the /profile and /settings pages
• Update your preferences at any time
• Request account deactivation by contacting the platform administrator
• Request data deletion — contact the platform administrator. Note: deleting your account will cascade-delete your games, moves, analysis, friendships, and collections.

10. Children

AuroraChess does not knowingly collect data from children under 13. If you believe a child under 13 has created an account, please contact the platform administrator.

11. Changes to This Policy

The platform administrator may update this Privacy Policy. Users will be notified of significant changes. Continued use of the Platform after changes constitutes acceptance.

12. Contact

For privacy-related questions, contact the administrator of this AuroraChess instance.