Privacy Policy

# XRP CHESS — Privacy Policy

**Last updated:** April 2026

XRP CHESS is a Discord chess bot and companion website. This policy explains what data the bot and website collect, how it is used, and how it is stored.

## What Data We Collect

### Discord Bot
- Your Discord user ID and username
- Chess game history (moves, results, timestamps)
- Glicko-2 rating and game statistics
- Custom settings (board theme, ring color, language, piece teams, bio, title)
- Achievement progress and University lesson completion
- Anti-cheat flags (if triggered during gameplay)
- Server ID and channel IDs created by the /setup command
- Server configuration settings (default theme, game limits)
- Tournament data (brackets, registrations, results)

### Website (xrpchess.com)
- Email address (for account creation — email + password auth)
- Hashed password (scrypt, never stored in plaintext)
- Linked Discord user ID (optional, via 6-digit code from the bot)
- Game history played on the website
- Arcade Mode progress (levels cleared, kings completed)
- Bug reports and feature requests submitted via /contact
- Presence status (online/away/offline) for the friends system
- Browser user-agent string (captured with bug reports for reproduction)
- Puzzle solve statistics

### Friend System
- Friend list connections (Discord user IDs only)
- Online status visibility to friends

### XRPawnsley (AI Chat Feature)
- Your **username** (display name only — never real names, emails, or personal details)
- Chess topics you've discussed (openings, tactics, etc.)
- Estimated chess skill level based on conversations
- Visit count and interaction frequency (for friendship tier progression)
- Play style observations from completed games (openings played, win/loss record, average game length)
- Achievement progress related to XRPawnsley interactions
- XRPawnsley does **NOT** store: real names, email addresses, locations, ages, or any personally identifiable information
- All XRPawnsley memory is tied to your username only and can be deleted with your account

## What We Do NOT Collect

- We do not collect message content outside of chess move inputs
- We do not collect IP addresses or geolocation data
- We do not collect personal information beyond what is listed above
- We do not collect payment or financial information
- We do not use cookies for advertising or tracking (only session auth)
- We do not sell, share, or transfer any data to third parties
- We do not track users across other websites

## How Data Is Used

All collected data is used exclusively to provide site functionality:
- Tracking game history and ratings
- Saving your customization preferences
- Running tournaments and leaderboards
- Anti-cheat detection during games
- Providing personalised XRPawnsley interactions (remembering chess topics, adjusting conversation depth)
- Tracking achievement progress across all categories

## Data Storage

Data is stored in a MongoDB database hosted by the bot operator. Data is retained as long as the bot is operational in your server.

## Third-Party Services

XRP CHESS connects to:
- **Lichess.org** — to fetch daily chess puzzles (no user data is sent)
- **Chess.com** — only when you verify your chess.com account (sends only the username you provide)
- **Stockfish** — chess engine runs locally in your browser as a Web Worker (no data sent externally)
- **MongoDB Atlas** — database hosting (encrypted at rest, encrypted in transit)
- **Railway** — application hosting (no user data stored by Railway beyond standard HTTP logs)

## Data Deletion

- **Website accounts**: You can delete your account from Settings → Account → Delete Account. This permanently removes your WebAccount document including email, password hash, and linked Discord ID.
- **Discord bot data**: Individual users can request data deletion by contacting the bot operator. Server admins can use the Unsetup feature to remove all bot-created channels and roles.
- **Bug reports**: Admin can archive or delete submitted reports from the admin dashboard.
- Player data (ratings, teams, profiles) is retained unless explicitly deleted via account deletion or data request.

## Contact

For questions about this privacy policy or data deletion requests, contact us on:
- Discord: https://discord.gg/vwA33NRBNp
- X (Twitter): https://x.com/XRPCHESS

## Changes

This privacy policy may be updated from time to time. Continued use of the bot constitutes acceptance of the current policy.