Privacy Policy

GrandArena is a chess app: play offline against the computer or pass-and-play, or sign in to play rated games online. This policy explains what we collect, why, and your choices. We keep data collection deliberately small.

1. Offline play needs no account and no data

Playing the computer and pass-and-play work with no account, no sign-in, and no network. Game preferences and local stats for those modes stay on your device and are not sent to us.

2. What we collect when you play online

Online play requires an account. We collect:

• Account: email address (via our auth provider), a username you choose, and optionally a country you select. Passwords are handled by our auth provider (Supabase) and are never stored by us in readable form.
• Gameplay: your rated games — moves, clocks, results, rating changes, and match history — so we can run matchmaking, keep ratings, and show your history.
• Anti-cheat signals: per-move timing and related technical measurements used to detect engine assistance and protect fair play. See our fair-play approach in the Terms.
• Technical/connection data: IP address and basic logs needed to run the real-time connection and diagnose abuse or outages.

We do not collect contacts, precise location/GPS, photos, or microphone data. We do not send push notifications.

3. Advertising and purchases

GrandArena is free and supported by ads. The chess board itself is always ad-free; ads appear only on other screens. What this involves:

• Ads on non-gameplay screens (home, lobby, match history) and occasionally between games, served by Google AdMob. AdMob may use a device advertising identifier and related technical data to show and measure ads. In the EEA, UK, and Switzerland we ask for your consent first (Google's consent form); on iOS we ask through Apple's App Tracking Transparency prompt. If you decline, you still see ads — just less relevant ones.
• A one-time "remove ads" purchase, handled by the app stores and our purchases provider (RevenueCat). We receive only a non-financial entitlement flag and your purchase history — never your card details. Buying it removes ads permanently.

4. How we use it

To provide online play (matchmaking, ratings, history, reconnection), keep the game fair (anti-cheat), operate and secure the service, support you, and — where applicable — show ads and honor a "remove ads" purchase. Legal bases (GDPR): performance of our contract with you, and our legitimate interest in a secure, fair service.

5. Who processes data for us

We use these providers (data processors) to run the service:

• Supabase — authentication (email/Google/Apple sign-in). Hosted in the EU (Frankfurt).
• Neon (PostgreSQL) — accounts, ratings, match history. Hosted in the EU (London).
• Railway — application hosting.
• Resend — transactional email (sign-up confirmation and password reset only; no marketing email).
• Google AdMob — advertising. Ads may use device identifiers per Google's policies; see Google's privacy disclosures.
• RevenueCat + Apple App Store / Google Play — the "remove ads" purchase.
• Apple / Google — "Sign in with Apple" / Google sign-in, and app distribution.

We do not sell your personal information.

6. Deleting your account and data

You can delete your account in the app (Account → Delete account). When you do, we revoke your sign-in (you can no longer log in) and scrub your personal details (email association, username, country). To preserve the integrity of other players' game histories and the leaderboard, your past match records are retained in anonymized form (no longer linked to your identity). You may also contact us at [email protected] to exercise data rights.

7. Your rights

Depending on where you live (e.g. EEA/UK GDPR, California CCPA/CPRA) you may have rights to access, correct, delete, or port your data, and to object to certain processing. Account deletion is available in-app; for anything else, contact [email protected]. You may also complain to your local data-protection authority.

8. International transfers

Our database is hosted in the EU. Some providers may process data outside your country under appropriate safeguards (e.g. Standard Contractual Clauses).

9. Data retention

We keep account data while your account is active. After deletion we retain only anonymized game records as described in §6, plus limited logs needed for security and legal compliance.

10. Children

GrandArena is not directed to children under 16, and online play (which requires an account) is not intended for them. We do not knowingly collect personal data from children under that age. If you believe a child has provided us data, contact [email protected] and we will delete it.

11. Security

We use industry-standard measures (encrypted transport, managed auth, scoped server access). No system is perfectly secure, but we work to protect your data.

12. Changes

We may update this policy; we'll change the effective date and, for material changes, notify you in the app.

13. Contact

Questions or requests: [email protected].