Privacy Policy
Cờ Tướng Online – “Xiangqi Online” (home page) is a free web game for playing Xiangqi (Chinese chess). This page explains what data is collected, what it is used for and how you can ask for it to be deleted. The Vietnamese version is available at /chinh-sach-bao-mat; both versions have the same content.
1. Playing as a guest
You can play without signing in. When you play as a guest, we do not create an account and do not store any of your information in our database.
- The name you type, your moves and chat messages exist only in the server’s temporary memory while the room is active, and are then deleted (when the room has been empty for more than 12 hours or when the server restarts).
- Your browser saves a few settings on your own device (localStorage): the name you typed, a random code that keeps your seat when you reload the page, your last room, sound on/off, your language (Vietnamese/English) and any game in progress against the computer. You can remove them by clearing this site’s data in your browser.
2. When you sign in with Google
Signing in is optional. We only ask for basic public profile information (openid, profile) and store:
- The sign-in provider (Google) and the account identifier Google issues to this app (“sub”);
- Your display name;
- Your profile picture URL (the picture stays on Google’s servers; we do not download or store it);
- The account creation date and statistics of your Win/Loss/Draw counts in online games;
- Your Elo rating and number of rated games for each game type (Xiangqi, Jieqi – hidden pieces) when you use “Quick match”;
- A random internal account ID;
- The private messages you send to / receive from other signed-in players (text up to 500 characters, sender, recipient, time sent, read or unread) and your block list.
We do not request and do not store your email address, phone number, friends list or password. You only enter your password on Google’s own pages. The access token returned by the provider is used once to read the profile above and is not kept.
3. How the data is used
- To show your name and avatar in the lobby and in game rooms (other people in the same room will see your name);
- To record and display your Win/Loss/Draw statistics and Elo rating, and to pair you with opponents of similar rating (your name and Elo are shown to the opponent you are matched with);
- To show your “Player info” card when someone taps your avatar: name, avatar, sign-in type (Google), Elo per game type, Win/Loss/Draw counts, number of rated games and join date (the provider’s identifier is never shown);
- To deliver private messages to their recipient (immediately if they are online, otherwise stored until they next read them) and to block messages from players you have blocked;
- To keep you signed in.
Private messages: only signed-in players can send or receive them; guests cannot use them. Messages are stored as plain text in the database (not end-to-end encrypted) so they can be delivered and shown again to the two people in the conversation; we do not read messages unless needed to handle an abuse report or when required by law. Messages and block lists are deleted together with your account when you request data deletion. Please do not send sensitive information (passwords, account numbers…) in messages.
We do not use your data for advertising and we do not build user profiles.
4. Cookies
ct_session: a signed sign-in cookie that contains only your internal account ID and an expiry time (30 days). It is deleted when you click “Sign out”.ct_oauth: a temporary cookie (10 minutes) that protects the sign-in process against forgery.
There are no advertising or tracking cookies.
5. Storage and security
Account data is stored in a PostgreSQL database operated by our hosting provider (Supabase); the app runs on Render.com. Connections use HTTPS. Fonts are loaded from Google Fonts and avatars are loaded directly from Google servers, so these services may receive your browser’s IP address under their own policies. The hosting provider may keep ordinary technical logs (such as IP address and access time) to operate the service. The share buttons (Zalo, Messenger, Facebook) only open those services’ own pages or apps with the link you chose to send; we do not send them any account data.
Data is kept until you ask us to delete it.
6. No selling, no sharing
We do not sell, rent or share your data with third parties, other than the infrastructure providers listed above (only to operate the service) or when required by law.
7. Your rights – data deletion
You can ask to see, correct or delete your data at any time by emailing huydinhvn1@gmail.com. See the detailed instructions on the Data Deletion page. You can also revoke the app’s access in your Google account settings.
8. Children
The service is not directed at children under 13. Google sign-in follows Google’s age limits.
9. Changes and contact
When this policy changes, the date at the top of the page will be updated. Please send any questions to huydinhvn1@gmail.com.