1. Who we are
Blitzle (https://blitzle.io) is run by Blitzle, which is the controller of your personal data. You can reach us using the details in section 10.
2. What we collect and why
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| Account: username, email, password (stored only as a scrypt hash), and a two-factor key if you turn it on. Guests get an account tied to their cookie. | Run your account and send account emails (confirmation, password reset) | Contract | Until you delete your account |
| Your calls, runs, streaks, duels (your calls and move guesses) and friends (who you added, and your invite link) | Score calls, show your record, the leaderboards and day pages, and enforce fair play | Contract; legitimate interests | While the site runs; anonymized when you delete your account |
| Sign-in sessions: IP address, browser (user agent), and when each session started and was last used | Keep you signed in, show your active sessions, protect accounts and detect multiple accounts | Legitimate interests | Until you sign out, or 30 days without a visit, and never more than 90 days |
| Usage events: things like starting a run, sharing, or arriving from a shared link, with your account ID if you're signed in | Understand which features are used, to improve the site | Legitimate interests | 90 days |
| Time on the site: how many seconds you spend each day playing runs, in duels and on other pages, with your account ID. Only counted while the page is open, visible and in use, and not at all when your browser sends Global Privacy Control or Do Not Track | Understand how the game is played, to improve it | Legitimate interests | 13 months; deleted with your account |
| Page-view counts: page, the other site's name if you came from one, and a visitor code made from your IP address and browser with a random value that changes daily and is never stored | Count visits without cookies or tracking you across days | Legitimate interests | 13 months |
| Reminder emails, if you turn them on: your chosen hour, and a record of each email sent and whether its link was clicked | Send at most one reminder a day, and see whether they help | Consent | Setting until you turn it off; email records 90 days |
| Push notifications, if you turn them on: your browser's push address and keys, and a log of notifications sent | Send the notifications you asked for | Consent | Until you turn them off; log 30 days |
| Contact form messages: your name, email, topic, message, account (if signed in) and IP address | Answer you and stop spam | Legitimate interests | 1 year (a copy also goes to our email inbox) |
We don't use your data for advertising. We don't use your data for automated decisions that have legal or similarly significant effects on you, and we don't sell it.
3. Cookies and browser storage
We use one cookie, sid (called __Host-sid on the live site). It keeps you signed in, including as a guest, and lasts 30 days after your last visit, up to 90 days in total. We don't use tracking or advertising cookies.
The site also saves a few small settings in your browser's local storage, which never leave your device: your sound setting (cb.sound), which results you've already seen (seenResults), and which one-time tips you've dismissed (intro, askFirst, pushAsk). For the current tab only, session storage remembers whether you arrived from a shared link, email or notification (src) and whether you dismissed a browser tip (inappHint). A service worker keeps copies of the site's styles, scripts, fonts and icons so it loads on a weak connection. You can clear all of this in your browser settings.
4. Who we share it with
- Service providers: our hosting and email providers, which process data only on our behalf.
- Advertising: none: the site shows no ads.
- Push services: if you turn on notifications, your browser's push service (such as Google, Apple, Mozilla or Microsoft) delivers them.
- Other players: your username and results appear on leaderboards and results pages; your email never does. You can hide from leaderboards in account settings, but daily winners are always named. Your friends also see today's run and your day streak.
- Authorities and successors: when the law requires it, to protect our rights or users' safety, or to a successor if the site changes hands.
We send nothing about you to Lichess. Links to games on lichess.org are covered by Lichess's own privacy policy.
5. Lichess players
Blitzle shows live public Lichess games. From the public Lichess API we keep the usernames, ratings and results of games shown here, and a list of usernames and ratings we use to find games. We use them to score calls and show results (legitimate interests). We show the moves live but don't store them. Blitzle isn't affiliated with Lichess.
To have your games excluded, email chesstreaks@gmail.com or use the contact form's "Lichess player opt-out" topic with your Lichess username. We then replace your username with "Anonymous" in our game records, remove you from our player list, and keep only your username on an opt-out list so we don't show your games again.
6. International transfers
Our servers are in the United States. If you use Blitzle from outside the US, your data is transferred to and processed in the US, where data protection law may differ from yours. We make this transfer because it is necessary to provide the service you ask for.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or download your data, to object to how we use it, and to withdraw consent at any time (for example by turning off reminders or notifications), without affecting what we did before.
In account settings you can download your data, change your email and password, turn reminders and notifications off, hide from leaderboards, and delete your account. For anything else, email chesstreaks@gmail.com or use the contact form's "Privacy request" topic. We may need to confirm it's your account, and we'll reply within 30 days.
When you delete your account, we remove your email address, password and two-factor key, replace your username, sign you out everywhere, and delete your sign-in links, push subscriptions, reminder settings and friends list. Your calls and runs stay with the anonymized account so leaderboards and past results still add up; a past daily winner is shown as "A former player". Usage events, email records and contact messages are deleted on their normal schedule (section 2).
If you are in the EU or UK, you can also complain to your local data protection authority.
8. Do Not Track and Global Privacy Control
If your browser sends a Do Not Track or Global Privacy Control signal, we don't record page-view counts, usage events or reminder-email clicks for your visits. Everything else in section 2 is needed to run the game and works the same either way.
9. Changes to this policy
If we change this policy, we'll update the "Last updated" date above, and tell you by email or with a notice on the site if the change is significant.
10. Contact
Questions or requests about your data? Contact us:
Blitzlechesstreaks@gmail.com
You can also use the contact form.