Privacy Policy

You can play as a guest. When you do, we create an identifier for you and a random display name, and store nothing else — no email, no password, no phone number. You can change the display name at any time.

We store your username, display name, avatar colour, the avatar picture you choose (if any), and your password.

Your password is stored only as a bcrypt hash. We cannot read it, and neither can anyone who obtains a copy of the database.

We record the result of finished matches: which game, which room, who took part, who won, and how long it lasted. This is what your win/loss record and the leaderboard are built from.

Messages you send are stored so they can be delivered and so a conversation still reads correctly when you reopen it.

Messages are deleted automatically after 24 hours. A background sweep removes them; we do not keep an archive.

Voice in a match is carried live between players and is never recorded or stored. Nothing is written to disk, and we have no way to play a conversation back.

Your microphone is used only while you switch voice on, and only your browser or phone can grant that permission — you can withdraw it at any time in your device settings.

If you allow notifications, we store the subscription your browser or device issues — an endpoint and the keys needed to encrypt a message to it — so we can tell you about friend requests, invites and results. Turning notifications off removes it.

We use cookies to keep you signed in. They are HttpOnly, meaning page scripts cannot read them, and they carry only your player identifier — not your name or password.

In the mobile app there is no cookie: the same session is held as a token in the app's own private storage on your device.

Avatar pictures for players and groups are drawn by DiceBear. When a picture is shown, your browser loads it from DiceBear's servers, which see your IP address and the picture's settings (a style, a colour, and the word you typed to generate it) — nothing else about you.

The Adventurer style is by Lisa Wischofsky, licensed CC BY 4.0. The other styles are free to use without credit.

We use Google Analytics to count visits, games played and which features get used. It tells us how many people did something, not who they are. Google's own handling of that data is governed by its privacy policy.

We do not sell your data. We do not share it with advertisers. We do not ask for your phone number, address, contacts, photos or location, and we do not read your device's storage.

Chitwan Arena is suitable for general audiences, and board games attract younger players. We do not knowingly collect more from a child than from anyone else — guest play requires nothing at all, and an account requires only a username.

If you are a parent or guardian and want an account and its data removed, write to us at the address below and we will do it.

You can change your display name and avatar at any time, turn notifications off, refuse the microphone, or stop using an account and play as a guest.

To have your account and its data deleted, email chitwan.lib@gmail.com from the address you signed up with, or from any address together with your username.

If this policy changes materially, the date at the top changes with it. Continuing to use Chitwan Arena after that means the updated policy applies.

Questions about privacy, or a deletion request: chitwan.lib@gmail.com.