Public-benefit privacy commitment
XIANGQI is operated as a free public-benefit learning project. We do not enable advertising cookies, sell personal data, or use donations, sponsorships, or partnerships to create gameplay advantage. Any future fundraising, institutional partnership, or formal nonprofit structure must preserve the published data-minimization and player-rights commitments.
Information we handle
We handle an opaque hosted-account reference, email address and display name when you sign in; a pseudonymous guest identifier when you do not; game commands, positions, results and ratings; reconnect state; data rights requests; explainable fair-play signals; and privacy-minimized operational logs. Raw session credentials and reconnect tokens are not included in account exports or backups. When you report a public display name, we also handle the selected reason, optional review context, the reported name at that time, the surface where the report was made, the related game reference when applicable, and the human review outcome. Human operations decisions also retain the signed-in reviewer identity, queue item, action, note and time for accountability.
Why we use it
To create and reconnect games, enforce rules, keep clocks synchronized, prevent duplicate results, show history and rankings, secure the service, review suspected abuse, answer data-rights requests, recover data after an incident, and diagnose failures.
Cookies and local storage
An essential HTTP-only cookie keeps a guest identity across refreshes. Language, board, sound, motion and local-practice history may be stored on the device. We do not enable advertising cookies in this public-benefit release.
Optional anonymous product analytics
Anonymous product analytics are off until you actively allow them. After consent, we record only nine journey events: a daily site visit, entering the tutorial, making a first legal move, completing a first game, returning on day 1, day 7 or day 30, matchmaking wait duration and outcome, and a connection interruption. The analytics dataset does not store names, account references, game identifiers, moves, board positions, IP addresses, Cookie values, or free text. A random browser identifier is converted to a one-way SHA-256 digest before storage and is not joined to account or game tables.
You can decline without losing any feature. You can change the choice in Settings at any time; turning analytics off immediately stops future collection and requests deletion of records linked to that browser identifier. Raw anonymous events expire after 90 days, and the operations view exposes only 30-day counts, conversion coverage, wait-time aggregates, and disconnect totals.
Service providers and transfers
The site uses OpenAI Sites authentication and Cloudflare hosting, Workers, D1 and R2 infrastructure. The final controller identity, nonprofit or fiscal status if any, processor list, processing regions and transfer safeguards must be confirmed in the reviewed publication version.
Retention and deletion
Delivered realtime events are kept 7 days, undelivered events and command deduplication records 30 days, guest and casual games 365 days, rated games 5 years, account security audit events 1 year, and fair-play signals and data-rights audit records 2 years. Resolved display-name reports are kept for 2 years; unresolved reports remain until review. Operations review records are kept for 2 years; if a reviewer deletes their account, the reviewer-name snapshot is pseudonymized while the action record remains. Account deletion removes the reported name and free-text context associated with the deleted account. Daily encrypted backups rotate after 30 copies and weekly copies after 12. Deletion runs only after a same-day backup and a recent successful recovery drill. Opt-in anonymous product events are retained for 90 days and then deleted by the same guarded lifecycle process.
Your choices
Signed-in players can open Profile or Settings to correct a display name, download a JSON copy, request restriction or object to processing, request deletion, check status, or appeal a fair-play action. Deletion has a 7-day cancellation window. Other requests receive a 30-day target due date; a verified request may be extended where applicable law permits. Account deletion removes direct account identifiers while pseudonymous game records remain only for the published retention period and game-ledger integrity. Anonymous product analytics are controlled separately per browser in Settings because they are never attached to the signed-in account.
General guidance: the European Commission describes access, rectification, erasure, restriction, portability and objection rights and a one-month response principle; California’s Attorney General describes rights to know, delete, correct, opt out and non-discrimination. See the European Commission overview and the California privacy overview. The right that applies to you depends on your location and the final operating entity.
Fair play and automated signals
The server rejects illegal moves, client clock changes and replayed commands. Repeated integrity anomalies may create a review case, but an automated signal does not suspend an account. A human operator must decide any warning, rated-play lock or suspension, and the player can appeal from Profile.
Public display names and reports
Public names are normalized and checked for hidden directional characters, high-confidence abusive language, and claims that could be mistaken for XIANGQI staff or protected services. Signed-in users may report an account or guest nickname from the leaderboard, a live game, game history, or a replay for impersonation, abuse, sexual or hateful content, threats, or another concern. Game-surface reports are accepted only from a verified participant in that game. Reports are rate-limited, deduplicated, and reviewed by a person before a warning, forced rename, or suspension. The reported user receives any resulting action in their account export; the reporter’s identity is not disclosed.
How to contact us
The authenticated Account & Data panel is the primary verified request channel. A public privacy email and postal address will be added once the operating entity and any public-benefit governance structure are formally confirmed. Until then, this site should not be represented as a registered charity, tax-deductible donation program, or jurisdiction-specific legally reviewed nonprofit service.