Shahmat is a self-hosted chess platform. This page explains what data we keep about you, why, and how you can delete it.
Data controller
[[operator name and contact]]
What we keep on the server, and why
- Account: your display name, and — if you signed up with email/phone/Google — that email or number, used to sign you in and identify your account. Guest accounts have neither.
- Games: moves, results, rating — kept to preserve history, compute ratings, and build leaderboards. These are public, as on any chess site.
- Chat: lobby, club, and in-game messages are kept on the server so a short history can be shown and reports can be handled. Moderators can see reported messages.
- Your profile photo and "about me" text, if you set them.
- Reports: when you report someone, moderators/admins see your name next to the report; the reported person does not.
- Anti-cheat data: move timing, and whether you left the window/app mid-game — used to detect engine assistance or abuse of the presence system.
External services
Only the ones actually active on this server:
- Email: verification-code emails are sent through an SMTP server.
Shahmat has no third-party ads, trackers, or analytics, and never sells your information.
On your own phone/browser
- Your login token and display settings (language, board theme, sound, …) are kept in your browser's local storage (localStorage) — the server never sees these; they're cleared when you log out or clear the site's data in your browser.
- A cached copy of pages you've viewed, for offline use — also only on this device.
Server logs
The web server (nginx) logs the IP address of each request, for troubleshooting and security. Retention period for these logs: [[nginx log retention period]].
Retention periods
- Account and game data: kept while the account is active; games remain even after account deletion (with personal details removed — see the account-deletion section).
- Lobby/club chat: up to the last 60 messages, for up to 7 days.
- In-game chat: ephemeral, only for the duration of that game; not stored durably unless reported.
- One-time verification codes: valid for a few minutes; the (hashed) request record is kept until account deletion.
- Anti-cheat and moderation data (reports, mutes, moderator logs): kept only to prevent abuse, for [[anti-cheat / moderation data retention period]].
Deleting your account
You can permanently delete your account at any time — from the app (Settings → Account → Delete account) or from the account deletion page. That page lists exactly what gets deleted and what stays (anonymized).
Children
Shahmat is not intended for anyone under 13, and we do not knowingly collect data from children under that age.
Security
Traffic to the server is encrypted over HTTPS (TLS). Passwords are never stored in plain text, only their (bcrypt) hash.
Changes
Last updated: 2026-09-26