Privacy Policy

Last updated: 20 October 2026

checkmates is random 5-minute chess with a stranger, over video or voice. There are no accounts, and we don't ask for your name or email. But we do keep a few things, mostly to stop abuse. This page says exactly what, why and for how long.

Who we are

checkmates (https://checkmates.me), run from the UK. We are the "controller" of your data under UK data protection law.

Contact: team@checkmates.me

The short version

• Your video and voice go straight to the other player, encrypted. We never see, hear or record them.
• Chat is kept only in memory during the game, unless someone reports it.
• If you're reported, we keep your IP address and the last 20 chat lines for 12 months.
• We count visits using a random ID saved in your browser. You can turn this off (see Stats). No names, no ad tracking (no ads yet).
• The other player sees your country flag, worked out from your IP address. They never see your IP address.

What we use, and why

When you play

The relay means the other player never sees your IP address, and you never see theirs.

The other player can see and hear you, and could record their screen. We can't stop that. Don't show or say anything you wouldn't want kept.

Reports and bans

When someone presses Report, we save:

• the time and the game ID
• both players' IP addresses
• both players' browser IDs, scrambled (hashed) so the original can't be read back
• the reason (nudity, abuse, other, or none)
• the last 20 chat lines from both players

Why: to deal with abuse, to ban people who break the rules, and so the two of you are never paired again.

How long: 12 months, then deleted. The two of you are never paired again for as long as the report is kept.

Automatic bans. If 3 different people (different browsers and different IP addresses) report the same browser for the same reason within 24 hours, that browser and its IP address are banned for 24 hours. No person checks this first. Anyone else using the same IP address (for example at home or at work) is blocked for those 24 hours too. We keep the ban (IP address, hashed browser ID, reason, end time) until it ends, then delete it. If you think a ban is wrong, email us and a person will look at it.

Manual bans. We can also ban an IP address by hand. A person reviews these every 6 months and removes any that are no longer needed.

Stats

We count how the site is used, so we can make it better:

• daily totals: visits, games, waits, results, reports. These are just numbers, kept for 60 days.
• returning visitors: a hashed copy of your browser ID with the first and last day we saw it. Deleted 90 days after your last visit.
• if you came from a link with ?ref= (e.g. a creator's link), that code is saved with your hashed ID, so we can count visits per link. It's also kept in your browser tab until you close it.

Only we see the stats. We don't use them to find out who you are.

Don't count my visits. You can stop being counted, free, at any time, with this switch. It's saved in this browser. When it's on, we delete this browser's hashed ID from our stats straight away, and from then on we don't record its visits, whether it comes back, or which link it came from. Your games still count in the daily totals (games played, results, reports), as plain numbers with nothing linked to you. Everything else works the same.

The switch only covers this browser. Clearing your browser's data for checkmates.me turns it off.

Logs

Our server doesn't log visits or IP addresses. It logs start-up messages and errors. Our host keeps these logs for a short time.

Backups

Our host makes a daily copy of our data files (reports, bans, stats). Each copy is deleted after 5 days. So anything we delete can stay in a backup for up to 5 days.

Our legal reasons (lawful bases)

• Running the game (browser ID, IP address, country, language, chat, moves, the call): our legitimate interests in running the service you've chosen to use.
• Reports, bans, limits: our legitimate interests in keeping players safe and stopping abuse. Keeping reports for 12 months lets us spot repeat abusers and deal with appeals.
• Stats: our legitimate interests in knowing how the site is used, using as little data as we can.
• Ads (when they're on): your consent.

We've weighed these interests against your privacy. You can object at any time (see Your rights).

Your browser's storage (cookies and similar)

We don't set cookies. We use your browser's storage for:

• token (local storage): your browser ID. Strictly necessary: without it you'd lose your game on a refresh, and bans and never-pair wouldn't work. We also use it to count returning visits.
• allowed (session storage, this tab only): you've already allowed camera and mic, so a refresh doesn't ask again. Strictly necessary.
• ref (session storage, this tab only): the ?ref= code, for stats. Not sent when you've turned stats off.
• nostats (local storage): only if you've turned on "Don't count my visits".

Ads

There are no ads on checkmates today, and the page loads nothing from Google.

If we turn ads on, we'll update this page first. Ads would come from Google AdSense. Google and its partners use cookies and similar storage to show ads, measure them and, if you agree, personalise them. Google's script would run on our page, so it could also read what we keep in your browser's storage (your browser ID).

We'd ask for your consent first, using Google's consent message, and set no ad cookies until you agree. Google is responsible for its own use of the data: see https://policies.google.com/technologies/partner-sites.

Who else handles your data

We don't sell your data or share it with anyone else for their own use. These companies run parts of the service for us:

• Fly.io hosts our server and data files, in London.
• Cloudflare relays video and voice calls (it sees both players' IP addresses and how much encrypted data passes, not what's in it), and runs our domain's DNS.
• Google, only once ads are on (see Ads).

We may share data if the law requires it, for example with the police about a serious crime.

Data outside the UK

Fly.io and Cloudflare are US companies, and Cloudflare's relay may run from the location nearest to you, which may be outside the UK. Where data leaves the UK, it's protected by the UK's approved safeguards, such as the UK-US data bridge or the UK's standard data transfer contracts.

How long we keep things

Your rights

You have the right to:

• see the data we hold about you
• have it corrected
• have it deleted
• object to how we use it, including the stats
• ask us to restrict how we use it
• get a copy to take elsewhere (where this applies)
• ask for a person to review an automatic ban

Email team@checkmates.me. We'll reply within a month.

Because there are no accounts, we can only find your data if you tell us something that links it to you. Include your ID (below) when you email us, or give your IP address with the date and time you played.

This is the scrambled (hashed) form of your browser ID, which is how we store it. The ID itself is kept only in this browser; this page works it out there and doesn't send it anywhere. Another browser or device has its own ID.

You can also delete the browser ID yourself at any time by clearing your browser's data for checkmates.me.

Complaints

If you're unhappy with how we've handled your data, email team@checkmates.me first. We'll confirm we've got it within 30 days and tell you what we've done.

You can also complain to the Information Commissioner's Office (ICO), the UK regulator: https://ico.org.uk/make-a-complaint or 0303 123 1113.

Do you have to give us this data?

No. But checkmates can't work without your browser ID and IP address, and you can't join a call without allowing your camera or mic. You can play with voice only, or with your camera and mic off.

Over 18s only

checkmates is for adults. You must be 18 or over to use it. We don't knowingly collect data from anyone under 18. If we find out someone is under 18, we'll ban them.

Changes

If we change this policy, we'll update it here and change the date at the top. If it's a big change (such as turning ads on), we'll say so on the site.