What we keep, and what we don’t.

• We ask for your birth month and year, and keep only that you’re 18 or over. Never the date.
• You can play as a guest with just a first name and last initial. Signing in takes an email address (or Google), and the only emails we send are sign-in codes and a note if a gambit you’re going to is called off.
• “Near you” rounds your location on your device, uses it to search while you’re on the page and never saves it.
• Castle Gambit is for adults: nobody under 18 gets an account, and nobody under 18 goes on a club’s roster.
• Nobody can send anyone a private message, and your Castle Gambit rating is seen only by the people you choose.
• We don’t sell your data, show ads, or use advertising trackers.

Each part below says what we keep, who sees it, how long it stays, and why we need it at all. When a screen asks you for something, it links to the part that covers it.

Jump to: your age · your email · your name · your rating · linked accounts · location · gambits · roster players · sign-in

Your age

Before anyone signs in, we ask for a birth month and year. Our server works out from them whether you’re 18 or over, then throws them away: the date is never stored or logged. Why not keep it? A birth date is one of the details identity thieves look for, and whether you’re 18 or over is all Castle Gambit needs to know. We keep only the answer, “18 and over”, on your profile and in a cookie on your device so we don’t ask again. If you’re under 18, Castle Gambit isn’t for you yet: we set a cookie for 24 hours that brings you back to that page, and nothing else is kept.

Your email address

Guests don’t give us one. Anyone who signs in does, typed in or passed on by Google, and we use it for two things:

• Sign-in codes. Six digits, good for 10 minutes and five tries, and we store only a scrambled, one-way copy of each. Codes instead of passwords means there’s no password to leak or reuse.
• A called-off note. One email if a gambit you’re going to is called off: by its host, by one of its Castle’s organizers, or because the host left or was removed from the Castle. If an organizer calls off a gambit you’re hosting, you get one too; whoever called it off doesn’t. Each goes to you alone and names nobody. It’s there so nobody turns up to an empty room.

Nothing else: no newsletters, no marketing. The address also lets a Google sign-in join an existing account with the same address, if Google says it has checked that address.

• Who sees it: no other player, organizers included. It’s on no profile, lobby, TV, Castle or gambit page. Behind the scenes it’s handled by us (we can find an account by its email, to delete it when you ask), Convex (which stores it), Resend (which delivers our emails) and Google, if you sign in with Google.
• How long: it stays on your account until you ask us to delete the account (a button is on its way), even if you never finish setting it up. Only a sign-in that never reaches setup at all is deleted, address and all, after a day.
• The emails themselves: our copy of each one we send (your address, the subject line, which for a code includes the code, and the body) is deleted four weeks after sending. Resend keeps its own logs, on its own terms.
• A code you never used leaves your address, unscrambled, on the code’s record (only the code itself is scrambled). The record goes when you use the code. If you don’t, it goes after the code expires, the next time anyone asks for a code or finishes a Google sign-in, so there’s no fixed date.
• The code limit: to cap how many codes one inbox gets, we keep a keyed, one-way scramble of the address, never the address itself. It’s deleted within two days.

Signing in with Google. Google tells us your name (first and last), your email address, whether Google has checked it, your Google account ID and a link to your profile photo. We keep the name, the photo link and that check on your account, and the sign-in tokens Google sends on the record that ties your Google account to ours, until the account is deleted. If you’re new and no guest is playing on that phone, Google’s name is your first display name until you change it at setup; if a guest is, the guest’s name stays. We never show the photo.

Your name and handle

People need a name to find their opponent and their board, so a name is the one thing everyone gives us. First name and last initial is plenty.

Playing as a guest, your name (up to 40 characters) is all you type. It’s seen by:

• everyone checked into that night’s lobby, while you’re not marked away;
• the Castle’s organizers, including their lists of past nights’ games and of anyone removed tonight;
• the club TV, while you’re waiting for a game or playing one;
• your opponents, in their game history.

It’s never next to a rating, handle or photo in the lobby or on the TV. A guest account is deleted 30 days after it’s made, by a daily sweep, however often you play: the clock starts when you join, not at your last visit. Save your games before then (with an email or Google) and it stays. If you played, your opponents keep their games against you under this name (with the rating numbers behind them, shown to nobody), so their history and ratings still add up. If you never played, it all goes.

With an account, you also pick a handle, which is your profile page’s address (castlegambit.com/p/yourhandle): change it and old links stop working. Your profile page opens for anyone with its link, signed out included, and shows:

• your name, your handle and your home Castle, if you’ve picked one;
• your photo, if you’ve added one (see Your photo);
• any chess.com or Lichess account you’ve linked, with that site’s ratings and any title (see Accounts you link);
• your Castle Gambit rating and rated-games count, only as your rating choice allows (see Your games and your rating).

Search engines are asked not to list it or follow its links, and it’s not in our sitemap. Your email is never on it, and your rating chart and recent games show only to you. A member’s name also shows:

• In your Castles: active members see your name, handle, role and when you joined on the member list. Asking to join shows your name and handle to that Castle’s owners and organizers only. The request waits until they let you in or turn it down, you take it back, or your account is deleted.
• On gambits you post or accept, as host or on the who’s-going list, to anyone signed in who can see the gambit, guests included. Signed out, nobody is named (see Gambits).
• At the board: in the lobby, on the TV and in your opponents’ game history, as for guests.

If your account is deleted, your opponents keep their games against you under the name you had. (A roster name taken off by request becomes “Former player”; an account’s name doesn’t.)

Your photo

A photo is optional. Members can add one in Settings or from their profile page; guests can’t. Until you do, you’re your initials.

• What we keep: one square, 512 pixels across, which your browser crops and redraws before it’s sent. The photo you picked never leaves your device, and neither do the hidden details a camera saves with a photo, like where and when it was taken or on which phone.
• Who sees it: anyone who opens your profile page, and you, at the top of your own pages. It’s never shown to others in the lobby, on the TV, on member lists or on gambits.
• Where it’s kept: in our database’s file storage. Your profile page loads it from a long, unguessable address, and anyone given that address can open the file.
• How long: until you replace or remove it, which deletes the old file straight away, or your account is deleted. A photo that was sent but never saved (a closed tab, a dropped connection) is deleted within three hours.

Signing in with Google doesn’t set it: we never show Google’s photo.

Your games and your rating

For each game: who played whom, which Castle, which board, when, and the result each of you reported. Your rating is worked out from those games. Castles you belong to and gambits you’ve accepted are kept too, so they show up for you next time.

Who sees your rating is your choice, and our server enforces it, not just the screen:

• People in my Castles (the default): people who are active members of a Castle you’re an active member of, its organizers included. A join request still waiting, yours or theirs, doesn’t count.
• Everyone: anyone who opens your profile page, signed in or not.
• Just me: nobody else, organizers included.

You always see your own. Whoever you pick, the only place anyone else can see it is your profile page: never in the lobby, on the club TV, in pairings or the organizer’s pairing preview, on who’s-going lists, on member lists, in game history, or next to crowns and stamps. We still use it to pair you, whatever you choose.

• No number before five rated games, for anyone; you see how many to go. After that it shows as provisional (“1480?”) until it settles. The rated-games count on your profile follows your choice too, and your rating chart and the change after each game are shown only to you.
• Where it starts: if you pick a starting level at setup (“How much chess do you play?”), only you see which one. It just sets where your rating starts, and that rating then follows your choice like any other. Link a chess.com or Lichess account before your first rated game and, if that site’s rating is settled enough to trust, it sets the start instead, replacing any level you picked: chess.com rapid, else blitz, else Lichess rapid, classical or blitz less 150, kept between 400 and 2400. After that, only games across a real board move it. Why a head start at all? So a new player gets a fair game on their first night.
• Linked accounts don’t follow this choice. A chess.com or Lichess account you link shows on your profile, to anyone, with that site’s ratings, even if your Castle Gambit rating is just for you. And because that rating may be where your Castle Gambit rating started, anyone who sees it can work out roughly where you began, until your games move it.
• How long: your games and rating stay while you have an account. If it’s deleted, your opponents keep the games, and your rating numbers and their history stay behind with them: detached from you, shown to nobody, so everyone else’s ratings still add up.

Accounts you link

Optional, and for saved accounts only: guests can’t link. A link proves a chess.com or Lichess account is yours before your name goes next to it, and gives a new player a fair first night (see where your rating starts). We never ask for, or see, your chess.com or Lichess password, and each chess.com or Lichess account can be linked to one Castle Gambit account.

• chess.com, while you prove it’s you: you type a username and our server looks it up in chess.com’s public, read-only data. If it isn’t there, nothing is kept. If it is, we keep the username, chess.com’s ID for that player, and a one-time code (CG-XXXXXX) for up to 48 hours. You paste the code into the Location field of your chess.com profile, where anyone on chess.com can see it until you take it out. We look for it about every 30 minutes. If the code expires first, the next look deletes the code, the username and the ID; “Start over” deletes them at once.
• chess.com, once linked: we keep a copy of everything that account shows publicly on chess.com, and its stats, and refresh it about once a day. That includes whatever you’ve put there, like a real name or a town in the Location field, plus the avatar, country, join date, last online, followers, title and account status, and the ratings, records and puzzle scores for every speed. We only ever show the username, the title and four ratings.
• Lichess: you sign in on lichess.org, and we ask for no permissions. Our server uses the key Lichess gives us once, to read your public account, then asks Lichess to cancel it; we never store it. (If Lichess doesn’t hear us, the key may stay listed in your Lichess security settings until it runs out.) We keep your username, any title, and your Lichess stats: for every variant, the rating, how settled it is, games played and recent progress, plus your puzzle, Puzzle Storm, Racer and Streak scores. It’s a snapshot from the day you link and never updates. Closed Lichess accounts, and ones flagged for breaking Lichess’s rules, can’t be linked.
• Who sees it: your profile page, which opens for anyone with its link, signed out too (search engines are asked not to list it). It shows each linked account’s site, username (a link to that site that doesn’t tell it where you came from), title and ratings: chess.com rapid, blitz, bullet and daily; Lichess rapid, classical and blitz. It shows them whatever you chose for your Castle Gambit rating. If a chess.com account is closed, its badge just disappears. Linked accounts show nowhere else in Castle Gambit, and nobody but you sees codes, how a link is going, or the copies we keep.
• How long: until you unlink, which deletes the link and our copy straight away, or until your account is deleted. Your Castle Gambit rating stays, with a note only you see of where it started. If a chess.com link stops holding (chess.com gives the username to someone else, or another Castle Gambit account links that chess.com account first), we keep the old username and chess.com ID, and our last copy if the link had gone through, until you start a new link or your account is deleted.
• What chess.com and Lichess learn: our server asks chess.com for that username’s public profile and stats, saying it’s Castle Gambit and giving a contact address: about every 30 minutes while a code waits, then about once a day. We send chess.com nothing about you. Lichess learns that your Lichess account signed in to castlegambit.com, and gets our server’s requests to read your account and cancel the key.

Where you are, and where you meet

“Near you” (on Castles, and the Near you tab on Gambits) is opt-in: nothing is asked until you tap “Use my location”. Why ask at all? A club is only useful if you can get to it.

• Rounded first: before anything leaves your device, we round your position to two decimal places, which puts it within about half a mile of where you are.
• Used only to search: while you’re on the page, the rounded point goes to our server only as part of a search, for Castles or upcoming gambits within 25 miles (100 if you ask). If you’re signed in, the search runs as you, so it can include members-only gambits from your Castles.
• Never saved: not in our database, not with your account, not in the page address, cookies or your browser’s storage, and our own code doesn’t log it. Page-view counts never see it.
• Forgotten when you’re done: it stays in the page’s memory until you leave the page, switch tabs on Gambits, or tap “Stop using my location”.
• Your browser keeps your yes, not us. How long depends on the browser: some keep it until you change it, some ask again after a while or offer “only this time”. While it allows location for castlegambit.com (after a yes on any of our pages, a Castle’s pin included), these pages look again by themselves when they open (on Gambits, when the Near you tab opens). To stop that, turn location off for the site in your browser; “Stop using my location” only clears it for this visit.
• Your browser or phone may ask its own location service (Google’s or Apple’s) where you are. That’s between you and them.

Where a Castle meets is public, because that’s the point of a club. Its address and map pin show on its page, in the list of Castles, in “Search by name or town”, in “Near you” with a distance, and in a Directions link that opens Google Maps when someone taps it. Search engines get them too: every Castle is in our sitemap, verified or not, its page description calls it “a chess club at” its address, its structured data carries the address and the pin’s coordinates, and we tell search engines when a Castle is started or edited.

• Setting the pin: “I’m there now: pin it” (starting a Castle) and “Use my current location” (Castle details) read your phone’s position once per tap, rounded to about 11 metres, and send it only when you save. Organizers can also type the numbers in. We keep no other record of where the organizer was. The pin is public even without an address, so tap it in the room itself.
• How long: only a Castle’s organizers can change its address or pin, and they stay until changed. A Castle stays when the account that started it is deleted, and there’s no way to delete a Castle yet.
• Gambits posted from a Castle copy its pin, and its address if theirs was left blank, when they’re posted, and keep that copy if the Castle changes later (see Gambits).
• If your Castle meets in someone’s home, give just the town and don’t pin it.

Other clues to where you are, so none of this sounds like we know nothing:

• your time zone, kept in a cookie for a year so times show in your local time (our server reads it to draw the page);
• the network address a signed-in session started from (see Sign-in and security);
• Vercel’s page-view counts, which can include the country a view came from, worked out by Vercel from the network address.

Gambits you host or accept

A gambit is an open offer at a place and a time, so where it is matters, and who can see it depends on who it’s for.

• “Anyone” (and every “Just me” gambit): its title, time, place and address are shown to everyone, signed out too: in Gambits, on its Castle’s page, and in “Near you” if it has a pin. While it’s upcoming, search engines get it through our sitemap and the page’s event data, which carries the place, address and pin, and we tell them when it’s posted, changed or called off. Once it’s over or called off, we ask them to drop it, but the page still opens at its link, place and address included.
• “Members of” a Castle: only the host and the Castle’s active members can see it, place and address included. It never goes to search engines, and anyone else, signed out included, gets “not found”. Switch a gambit from Anyone to members-only and we ask search engines to look again, but copies they already took may linger for a while, and anyone outside the Castle who’d accepted loses their spot, without an email.
• The pin: a gambit posted from a Castle copies the Castle’s pin, and its address if you left yours blank. Its Directions link and “Near you” distance use that pin, even if you meet somewhere else, and later changes to the Castle don’t change it. “Just me” gambits have no pin, so they don’t show in “Near you”.
• Public places, never someone’s home. That’s our advice; we can’t check it.

Saying you’ll come. For each reply we keep the gambit, that it’s you, going or “not for me”, and when. “Not for me” is seen by nobody but you.

• The who’s-going list shows each person’s display name and handle; the handle links to their profile page, where their rating follows their own choice. Never a rating, a photo or contact details. It names up to 200 people; past that, it just counts.
• Who sees it: on an Anyone gambit, anyone signed in, guests included (someone who’s only given a name at a club night). On a members-only gambit, only the host and the Castle’s active members. Signed out, nobody is named, not even the host: just how many are going, and nothing we give search engines names anyone.
• Email: if it’s called off, everyone going gets one email (on a very big gambit, the first 200 of them) with its title, its place (not the address) and its Castle, naming nobody. Whoever called it off doesn’t. No email goes out when its time or place changes, or when it goes because the host’s account was deleted.
• How long: the list stays on the page as “Who was going” after the gambit ends, and there’s no button to take your name off once it has started or been called off. Before it starts, “Can’t make it” deletes your reply, frees your spot and emails nobody. Otherwise your reply stays until your account is deleted, or the host’s is (the gambit and every reply go with it). Leave a Castle, or be removed, and your replies to its upcoming members-only gambits go (past ones stay, visible to its members), and any upcoming gambits you host from it are called off. A gambit’s place and address stay with it after it’s over or called off, when it can’t be edited any more.

Roster players

Some regulars don’t carry a phone. An organizer can add them to their Castle’s roster so they still get paired.

• What we keep: a display name, the Castle that holds them, and their games. The games are rated like anyone’s, so pairing stays fair, but a roster player’s rating is never shown to anyone. No email, photo, birthday, account or profile page. We also note which organizer added them, as that organizer’s word that the person is 18 or over. The note is never shown to anyone, and it’s cleared if that organizer’s account is deleted.
• Who sees the name: the roster itself, only the Castle’s owners and organizers, not its other members. People checked into a night, and the club TV, see the name while that player is checked in. Organizers see it in the night’s games, and opponents in their own game history.
• Archiving takes someone off the roster and marks them away in any lobby. Their name stays on past games, and an organizer can bring them back.
• Taking a name off for good: the player or an organizer writes to castlegambit.support@avevue.com, and we do it (there’s no button). Someone who never played is deleted, with their check-ins, crowns and stamps. Otherwise the name becomes “Former player” and the games stay for their opponents, with the rating numbers and the note of who added them, still shown to nobody.

Sign-in and security

A signed-in session is a cookie on your device. Each session records the network address and browser it started from, so we can spot misuse. A session stops working after 30 days without a visit. Its record stays until you sign out on that device (or come back on it after the session has run out) or your account is deleted; nothing clears old ones on a schedule.

To slow down anyone hammering the sign-in, we also count requests from each network address for a minute or so. Those counts, with the address, are deleted within two days. Guest sign-ins and code requests also go through a bot check (see Who helps us run it).

• In the room: people checked into tonight’s lobby, and the club TV, see the display names of everyone there. Never ratings.
• Your email: no other player, organizers included.
• Your rating: people who share a Castle with you, by default. You can change that to everyone or just you. You always see your own, and nobody else sees it anywhere but your profile page.
• Your profile page (your name, handle, home Castle and any chess.com or Lichess account you link, with that site’s public ratings) opens for anyone with its link. Search engines are asked not to list it, and your Castle Gambit rating on it follows your choice above.
• Places: a Castle’s address and map pin, and where an Anyone gambit meets, are public, search engines included. Your own location never is (see Where you are).
• Gambits: signed-in people who can see a gambit, guests included, see who posted it and who’s going. Signed out, nobody is named: just how many are going.
• Roster players (adults without a phone, added by an organizer): a display name and nothing else, seen by their Castle’s organizers, in the night’s lobby and on its TV, and by their opponents. Never a rating.
• Nobody can send anyone a private message. There’s no chat and no comments.

• Guest accounts are deleted 30 days after they were made (not after your last visit), unless you save your games. Your opponents keep their games against you, under your display name only.
• An account you never finish setting up stays until it’s deleted, like any other. Only a sign-in that never reaches setup at all is deleted after a day.
• Tonight’s lobby closes on its own after the night. An organizer can remove someone from the night and put up a fresh join code.
• Your location isn’t kept at all. A Castle’s address and pin stay until its organizers change them.
• Sign-in codes stop working after ten minutes. Our copies of the emails we send are deleted four weeks after sending. (An unused code’s record can last longer: see Your email address.)
• The code limit: to cap how many sign-in codes one address gets, we keep a scrambled, one-way copy of the address (never the address itself). It’s deleted within two days.
• Linked chess.com and Lichess accounts stay until you unlink them (one exception, in Accounts you link).
• Your account stays until you ask us to delete it. When we delete it, your profile, memberships, linked accounts, replies to gambits, the gambits you posted, and your crowns and stamps go with it; your opponents keep the games, under a name only, with the rating numbers behind them, shown to nobody.

A few companies process data for us, only to run Castle Gambit:

• Convex stores our database and runs the app’s logic, in the United States.
• Vercel hosts the website.
• Vercel Web Analytics counts page views, so we know which pages people use. It sets no cookies and doesn’t know who you are, and before a view is counted we take out anything personal in the address: someone’s profile name, a club night’s code, a TV’s link.
• Vercel BotID checks guest sign-ins and sign-in code requests for bots, from signals your browser sends with them. If we switch on its deeper check, Vercel uses Kasada to analyse those signals.
• Resend sends our emails: sign-in codes and called-off notes.
• Google, only if you choose to sign in with Google.

If you link a chess.com or Lichess account, our server talks to that site too: here’s what it learns.

We don’t sell data to anyone, and we don’t share it with advertisers.

We use a handful, all for the app to work. None of them track you across other sites.

• Sign-in cookies, while you’re signed in.
• That you’re 18 or over, for a year, so we don’t ask twice.
• The under-18 note, for 24 hours.
• Your time zone, for a year, so club nights show in your local time.
• Two while you link a Lichess account: they last up to 10 minutes, only go to our Lichess link pages, and are cleared when you come back.
• Which of the lobby’s optional cards you skipped, for a week or a month, and the club TV’s size and theme, for a year.
• Your light or dark theme choice, kept in your browser.

“Near you” uses your location only to search, for Castles or gambits, and never stores it, in a cookie or anywhere else. How we handle it.

• Change your name, handle and who sees your rating in settings.
• Unlink a chess.com or Lichess account in settings.
• Leave a Castle whenever you like.
• Turn location off for castlegambit.com in your browser whenever you like.
• Ask for a copy of your data, a correction, or for your account to be deleted: write to castlegambit.support@avevue.com. A delete button in settings is on its way.

Parents: Castle Gambit is for adults only. The page for parents explains what that means, and how to ask us to delete an account that belongs to someone under 18.

If we change what we collect or who can see it, we’ll update this page and its date, and tell signed-in members before it takes effect.