Privacy policy

This policy covers this site, kami-chess.kamidesigns.be, and Kami Chess accounts, including the sign-in and registration pages on auth.kamidesigns.be, including online games in the Kami Chess app. Playing the game without an account collects nothing; the game's own policy is on kamidesigns.be.

KamiDesigns is responsible for the personal data described here. Our address is at the end of this page.

When you create an account, we keep:

• your username and the display name other players will see;
• your email address, and whether you have confirmed it;
• your password, stored only in a form that cannot be turned back into the password.

We use them to create your account, let you sign in, show your display name and let you reset a forgotten password. We need them to provide the account you ask for (Article 6(1)(b) GDPR). Your email address is never shown to other players.

We keep your account until you delete it. You can change your details or delete your account yourself on your account page. Deleting it removes these details from your account at once; the security records described below are deleted 30 days after they were made. Copies in our backups are kept longer, as described under Where your data is kept.

If you do not confirm your email address within 24 hours of creating your account, we delete the account and these details automatically, so that an address typed by someone else is not kept. The security records and the copies in our backups are then kept as for an account you delete yourself.

While you are signed in to the Kami Chess app, it tells our server about every 30 seconds that you are online. Other signed-in players can then see that you are online now, in the list of players described under Online games. They never see when you came online or when you were last seen.

To do this, our server keeps your account id, your display name and the time your app last checked in, and keeps them only in its memory: they are never written to disk or to a database, so they are not in our backups either. They are gone 60 seconds after your app last checked in. Signing out or closing the app shows you as offline at once; if the app stops without being able to tell us, you are shown as offline within those 60 seconds. We do this to show players who they can play with, which is part of the account you ask for (Article 6(1)(b) GDPR).

Once you have signed in to the Kami Chess app, you are in the list of players that other signed-in players see in the app, whether you are online or not, so that they can challenge you. There is no setting to leave the list. Next to you, it shows them:

• your display name;
• whether you are online now;
• a player id the app uses to challenge you, a random code that is not your account id;
• their own results against you, if the two of you have played.

It shows them nothing else about you: not your username or email address, not when you were last seen, and not your results against anyone else. Your own totals are shown only to you.

When you challenge a player, they see your display name and can accept or decline. A challenge that is not answered ends after 7 days. A player who declines can also block you, and you then cannot challenge them. In a game, your opponent sees your display name and every move you make.

To run online games, our server stores in our database:

• your account id and display name, and when you first and last used online play, with a player id of your own;
• the challenges you send and receive, and whether each was accepted, declined, withdrawn or ended unanswered, which we delete 30 days after the challenge ended;
• the players you have blocked;
• each game you play: its two players, every move and when it was made, and the result, from which your wins, losses and draws are counted;
• the notices the app shows you, such as a new challenge or your opponent's move, which we delete after 30 days.

We keep the rest until you delete your account. We check for deleted accounts every 5 minutes, so within minutes of deleting yours we delete all of it, except that:

• games you are still playing end, and your opponent is told that your account was closed. These games stay in your opponent's history, without your name or anything else that links them to you, and count in nobody's results;
• finished games stay in your opponent's history and results, without your name or anything else that links them to you.

Copies in our backups are kept longer, as described under Where your data is kept. We do this to let you play other players, which is part of the account you ask for (Article 6(1)(b) GDPR).

In the Kami Chess app you can report another player to us, for example for an offensive name, harassment or cheating. A report holds:

• your player id, and the reported player's player id and display name as it was when you reported;
• the reason you chose: an offensive name, harassment, cheating or something else;
• if you add them, a short text of up to 280 characters and the game the report is about.

The reported player is not told that they were reported and never sees who reported them, and no other player sees a report.

Our server stores the report in our database and emails it to us at hello@kamidesigns.be, through the email service described under Email. The email also holds both players' account ids and your display name, so that we can find both accounts and write back to you about your report at the email address of your account. Mail to that address is received by Amazon Web Services in Ireland, which keeps a copy, and forwarded to our mailbox at Microsoft (Outlook.com), which may process it outside the European Union.

We delete a report from our database 90 days after it was sent; one that has not yet reached us by email is kept until it has. If the reported player's account is deleted, the reports about them are deleted with it. If you delete your account, the reports you sent stay until their 90 days are over, without anything that links them to you, because the player you reported may still need our attention. Copies in our backups are kept longer, as described under Where your data is kept. The emails, and the copy Amazon Web Services keeps of them, currently have no fixed time limit; when we set one, we will update this page.

We do this to keep online play safe and fair and to act on what players tell us, which is our legitimate interest and that of our players (Article 6(1)(f) GDPR).

When you create an account, your username and your display name are checked against a list of words that are not allowed, such as slurs and obscene words, and refused if they contain one. Your display name is checked again whenever you change it.

We may change a display name, and disable or delete an account, that breaks these rules or that we find offensive, for example after a report. Other players see the change within about 5 minutes. A disabled account cannot sign in, other players no longer see it in the list of players and cannot challenge it, and its data is kept, so that we can enable it again. A deleted account is handled as described under Online games.

We do this to keep online play safe and fair for everyone, which is our legitimate interest and that of our players (Article 6(1)(f) GDPR).

We record what happens to your account: creating it, each sign-in and each failed attempt, signing out, confirming your email address, changes to your details or password, requests to reset your password, and deleting the account. Each record holds your account, the time and your IP address. Some hold more: a sign-in or a failed attempt holds the username or email address you typed; creating the account, confirming your email address and requesting a password reset hold your email address; and a change to your details holds your previous and your new details, such as your email address and display name. We keep these records for 30 days and then delete them automatically, also after you have deleted your account; copies in our backups are kept longer (see Where your data is kept). After repeated failed attempts an account is locked for a short time. Like any website, our servers also see your IP address and browser details with each request, to deliver the page.

We do this to keep accounts safe from people who try to guess passwords or take them over, and to find out what happened when something goes wrong with an account, which is our legitimate interest and yours (Article 6(1)(f) GDPR).

We send you email only when your account needs it: to confirm your address and when you ask to reset your password. No newsletters and no advertising. These messages are sent through Amazon Web Services (Amazon Simple Email Service, in the EU region in Ireland), which receives your email address and the message to deliver it. When a player reports another player, the report is emailed to us through the same service, as described under Reporting a player.

The page where you create an account uses Google reCAPTCHA, a checkbox that tells people from automated programs. It is used there only: not on this site and not on the sign-in page.

When that page loads, and when you tick the box, your browser connects to Google. Google receives your IP address, information about your browser and device, how you use the checkbox, and cookies Google may already have set. When you submit the form, our server sends Google your IP address and the checkbox's answer to check it. Google may process this data outside the European Union.

We use it to keep automated programs from creating accounts, and from making us send email to addresses that do not exist. That is our legitimate interest in keeping the service and its email working (Article 6(1)(f) GDPR). Google's use of the data is described in Google's Privacy Policy and Terms of Service.

This site sets two cookies, and only when you sign in:

• one while you sign in, which ends after 10 minutes;
• one that keeps you signed in, which holds, encrypted, what identifies your account and your display name, and ends when you sign out or your session ends (after 7 days, or 30 days if you chose to be remembered).

The sign-in pages on auth.kamidesigns.be set their own cookies to sign you in and, if you ask, to remember you. The registration page also lets Google set its reCAPTCHA cookies. All of these are needed for what you asked for. We use no analytics, no advertising and no tracking cookies.

Your account, the security records, your online games, and the backups of them, are kept on servers we run ourselves, in Belgium, and so are the reports players send. Only the email service, Google reCAPTCHA and, for reports, our mailbox at Microsoft, as described above, receive any of it.

Our backups currently have no fixed time limit. What they hold, including accounts that have since been deleted, security records older than 30 days, the online games of deleted accounts and reports older than 90 days, stays in them until we set one. When we do, we will update this page.

You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it or to receive it in a portable form, and you can object to what we do on the basis of our legitimate interest. Write to us at the address below. You can also complain to the Belgian Data Protection Authority, dataprotectionauthority.be.

Questions about this policy can be sent by post to:

To report a player, or about a report or anything else on this page, you can also email us at hello@kamidesigns.be or use our contact page.

Enterprise number 0776.578.238 (Crossroads Bank for Enterprises, Belgium).