Privacy Policy — Variochess

Last updated: August 23, 2026

Variochess ("we", "our", or "us") operates the Variochess mobile application (the "App"). This page informs you of our policies regarding the collection, use, and disclosure of personal information when you use our App.

1. Information We Collect

When you create an account and use Variochess, we collect the following information:

Account data: username and email address provided during registration. If you sign in with Google, we also store the account identifier Google gives us for you, which is what links your Google account to your Variochess account.
Game data: records of games you play, moves made, game results, and player statistics (wins, losses, rating).
Communication data: game chat messages sent inside active games, friend requests, and game invitations you send or receive.
Moderation data: reports you submit about other players or messages, and the list of users you have blocked. Reports are retained so moderators can act on them and review repeat behaviour.
Device data: your device's IP address, which is used for security logging and account protection (e.g. detecting unusual login activity).
Notification preferences: your choices regarding email and in-app notifications for turn reminders, game invites, and friend requests.

We do not collect payment information, location data, contacts, or any information beyond what is listed above.

2. How We Use Your Information

To create and manage your account.
To operate the multiplayer game service (matchmaking, move validation, game state).
To send transactional emails: email verification, password reset, turn reminders, game invitations, and friend request notifications — only when you have enabled these in your notification preferences.
To display player statistics and leaderboards inside the App.
To protect account security through audit logging of login attempts and suspicious activity.
To send service announcements (e.g. scheduled maintenance). These cannot be opted out of while you have an account.

We do not use your data for advertising, profiling, or sell it to third parties under any circumstances.

3. Data Storage and Security

Your data is stored on servers operated by us. We use industry-standard security measures including:

Passwords stored as bcrypt hashes (never in plaintext).
JWT tokens for authenticated sessions with automatic expiry.
Rate limiting and account lockout to protect against brute-force attacks.
Security event logging for audit purposes.

While we take reasonable precautions, no internet transmission or electronic storage method is 100% secure. We cannot guarantee absolute security.

4. Data Retention

We retain your account data for as long as your account is active. Game records and statistics are retained indefinitely to maintain leaderboard integrity. Security logs are retained for 90 days. You can delete your account at any time from inside the App (More → Settings → Delete account, or More → Delete account on older versions) or via our account deletion page. When you delete your account, your personal data (username, email, messages, friends) is removed immediately; games you played with others are kept but your identity in them is anonymised.

5. Third-Party Services

The App uses the following third-party services:

Email delivery: we use an SMTP provider to send transactional emails. Your email address is transmitted to this service solely for delivery purposes and is not stored or used by them for other purposes.
Google Sign-In (optional): if you choose to sign in with Google, Google provides us with an account identifier and your email address so we can create or recognise your account. We never receive your Google password. Using this option is entirely your choice — an email and password account works the same way. Google's handling of your data is covered by Google's own Privacy Policy.
Google Play: app distribution, in-app updates and the optional in-app review prompt are provided by Google Play and are subject to Google's own Privacy Policy.
Calendar subscription (optional): if you subscribe to your personal Variochess calendar feed, the calendar application you use — Google Calendar, for example — will fetch your upcoming game deadlines from us on its own schedule, and that data is then held by whoever provides that calendar. The feed address is private to you and acts like a password: anyone who has it can read your game schedule without signing in, so do not share it. You can invalidate it and get a new one at any time using Reset URL in the App.

We do not integrate advertising networks or analytics SDKs (e.g. Firebase Analytics, Crashlytics). Apart from the optional Google Sign-In described above, we do not use social login providers, and we do not use any social network SDK.

6. Children's Privacy

Variochess is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal information, please contact us using the details below.

7. Your Rights

You have the right to:

Access the personal data we hold about you.
Correct inaccurate data via your profile settings.
Delete your account and associated personal data directly in the App (More → Settings → Delete account, or More → Delete account on older versions) or via our account deletion page.
Opt out of non-essential notifications via the Notifications section in your profile screen.
Data portability: request a copy of your data in a structured format.

To exercise any of these rights, please contact us at the email address below. We will respond within 30 days.

8. Cookies and Local Storage

The App stores your authentication tokens securely on your device using Android's EncryptedSharedPreferences (via the flutter_secure_storage library). This is necessary to keep you logged in between sessions. No browser cookies are used.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via a notice inside the App or by email. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the App after changes constitutes your acceptance of the revised policy.

10. Contact Us

If you have any questions about this Privacy Policy, or wish to exercise your data rights, please contact us at:

Email: privacy@variochess.com
App: Variochess on Google Play