Privacy Policy

1. Overview

Xiangqi Arena is operated from Singapore and follows the Singapore Personal Data Protection Act (PDPA). We extend the same rights to every player, wherever you live.

This policy covers the website at xiangqi.tranchitam.com and its API.

2. What we collect

We keep the service's data collection to what running it requires:

• Account: your email address, your password (stored only as a one-way hash, never in readable form), and your display name.
• Profile choices: country, avatar image, language, and theme, if you set them.
• Play records: your games and moves, results, ratings, and puzzle and learning progress.
• Membership status: your plan plus Stripe customer and subscription identifiers. Card details never reach our servers.
• Security records: sign-in sessions (with IP address and browser identifier) and short-lived server logs (with IP address).

That is the full list. There is no hidden telemetry.

3. What we never do

Some things are off the table:

• We never sell, rent, or trade your personal data.
• We run no third-party analytics or tracking scripts.
• We send no marketing email.
• We share nothing with data brokers.

4. Language suggestion

On your first visit we check your IP address against a country database hosted on our own servers to suggest a site language. The lookup happens in memory: the result is not stored and your IP address is not sent to anyone else for this.

This site includes GeoLite2 data created by MaxMind, available from maxmind.com.

5. Cookies and local storage

We set one essential cookie: a session token that keeps you signed in. It is HTTP-only and is not readable by scripts. Preferences such as theme, language, and board settings live in your browser's local storage.

We set no advertising or cross-site cookies of our own.

6. Advertising

Members see no ads. Free accounts currently see our own house promotions on main pages; these involve no third parties and no tracking.

If we ever enable third-party ads (Google AdSense), Google would set its own advertising cookies under its own policies. We will update this policy before that happens.

7. Payments

Payments are processed by Stripe. Your card details go directly to Stripe and never touch our servers; we keep only your plan and the Stripe identifiers needed to manage your subscription. See stripe.com/privacy for how Stripe handles data.

8. How we use your data

We use the data above to:

• Run games, matchmaking, ratings, and leaderboards.
• Enforce fair play and rate limits.
• Provide membership features and manage billing.
• Keep accounts secure and sessions working.
• Diagnose problems using short-lived logs.

In legal terms: we process data to provide the service you signed up for, out of legitimate interest in keeping play fair and the service secure, and with your consent where the law requires it.

9. What is public

Xiangqi Arena is a place of public competition. The following are visible to everyone:

• Your display name, avatar, country, and plan flair.
• Your ratings and leaderboard standings.
• Your games, including moves and results, live and in the archive.
• Your puzzle and storm bests.

Your email address is never public.

10. Who we share data with

Only the processors the service is built on:

• Amazon Web Services: hosting, in the Singapore region.
• Stripe: payment processing.
• Authorities: only when the law requires it.

Google would join this list only if third-party ads are enabled, as described in the advertising section.

11. Retention and deletion

Account data is kept while your account is active. Sign-in sessions expire on their own, and operational logs are kept only briefly.

To delete your account, contact us. We will close it and remove your personal data within 30 days.

Finished games are part of your opponents' histories and of the site's public record; when we delete an account, we remove or de-identify the personal details attached to them.

12. Security

All traffic is encrypted with TLS. Passwords are stored only as one-way hashes. Data lives in access-controlled infrastructure in AWS Singapore.

No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires.

13. Your rights

You can ask us at any time to:

• Show you a copy of the personal data we hold about you.
• Correct it.
• Delete it.
• Withdraw a consent you gave earlier.

Contact us as described below and we will respond within 30 days. You can also complain to the Personal Data Protection Commission of Singapore or the data protection authority where you live.

14. Children

The service is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

15. Where your data lives

Our servers are in the AWS Singapore region. If you use the site from elsewhere, your data is processed in Singapore.

16. Changes to this policy

Updates are posted on this page with the date above. Material changes will be announced on the site.

17. Contact

For any privacy question or request, including access and deletion, reach the site operator via tranchitam.com. This is also the service's data protection contact.