Privacy Policy

Effective 11 November 2026

Contents

1. Who is responsible
2. What we collect and why
3. What other players see
4. What's stored on your device
5. Who else handles your data
6. Data outside the EU
7. How long we keep it
8. Your rights
9. Age
10. Security
11. Automated decisions
12. Changes

1.Who is responsible

The controller of your personal data is this company, registered in Bulgaria:

You can reach us about anything in this policy through the contact form.

This policy covers toxichess.com and the emails we send. The words “we” and “us” mean that company.

2.What we collect and why

Only what the game needs to work, keep you signed in, take payments and stop abuse.

Playing as a guest

You can play every free mode without an account. We don't ask who you are. Your nickname, game options, Dumbass Profile and own swears are saved in your browser only (see section 4). Our server still sees your IP address when your browser connects (see “Technical data” below).

Your account

Online games

Moves, chat, curses, GIF picks and your own swears travel through our server to your opponent while you play. They're held in memory for the game and not saved once the game ends. For rated games we keep only the result's effect on both players' ratings. Your own swears pass through an automatic filter that blocks slurs before they reach your opponent.

Move analysis and Big Gary

When you ask for the autopsy, or play Big Gary, your browser sends the game's moves or the board position to our chess engine. We cache results by position so repeat positions are fast; the cache doesn't record who asked.

PRO payments

When you buy PRO you pay on Stripe's checkout page. Stripe collects your card details, email and, where tax rules need it, your billing address. We receive and keep your Stripe customer ID, your plan, its status and the dates of the current period, so we know when PRO is on. Legal basis: contract, and our legal duties under tax and accounting law (Art. 6(1)(c)).

Contact form

If you write to us, we get your email address, the name you give (optional), the topic, your message and, if you're signed in, your account name and email. We use them to answer you and, for data requests, to check it's really you. Legal basis: our legitimate interest in answering you (Art. 6(1)(f)), or a legal duty when you exercise your rights.

Technical data

• IP address. Used, in memory only, to limit how often one address can request sign-in codes, analyses, engine moves and contact messages, and to count visitors online over the last 70 seconds. We don't keep web access logs. An IP address may show up in short-lived error logs if something breaks.
• Interest clicks. When you click a PRO or shop button, we record which item and price, your answer and the game mode, with a timestamp. These records don't include your account, IP address or anything else that identifies you.

Legal basis for technical data: our legitimate interest in keeping the site secure, working and affordable (Art. 6(1)(f)).

We don't use your data for advertising, we don't build marketing profiles, and we don't sell or rent it to anyone.

3.What other players see

• Leaderboards (The Hood): your display name and ratings, if you have an account and have played enough rated games.
• In an online game: your nickname, your ratings (if signed in), and everything you send in the game.
• Never: your email address.

Replay clips and cards are made in your browser. They're only shared if you share them.

4.What's stored on your device

We use one cookie and some browser storage, all needed for features you use. There are no advertising or analytics cookies, so there's no cookie banner.

Stripe sets its own cookies on its checkout and billing pages for security and fraud prevention; see Stripe's privacy policy.

5.Who else handles your data

We use a few service providers. Those marked “processor” handle data only on our instructions under a data processing agreement.

Spoken lines: recorded voice clips come from our own server. Lines without a recording, like your own swears, are read aloud by your browser's built-in speech voices. Some browsers use online voices for this, which send the text to the browser maker (for example Google or Microsoft). That's between you and your browser; turning Voice off stops it.

We may also disclose data when the law requires it, to protect people from harm, or to a buyer if the business is ever sold (with this policy still applying).

6.Data outside the EU

Our servers are in the United States, and some of our providers process data there. These transfers are covered by the EU–US Data Privacy Framework, which our providers are certified under, and by the European Commission's Standard Contractual Clauses in their data processing agreements. You can ask us for a copy of the relevant safeguards.

7.How long we keep it

When you delete your account, your account data is removed from the live database straight away and disappears from backups within 30 days.

8.Your rights

Under the GDPR you can ask us to:

• see the personal data we hold about you and get a copy (access);
• take it with you in a machine-readable format (portability);
• correct it (rectification);
• delete it, including your whole account (erasure);
• restrict how we use it, or object to uses based on our legitimate interests.

Use the contact form (or the “Delete my account” topic). To protect your account, send it while signed in, or from the email address on the account; we may ask you to confirm by email. We answer within one month. It's free.

You can also complain to a data protection authority. Ours is the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, cpdp.bg. You can also go to the authority where you live or work.

9.Age

ToxiChess is for adults (18+). We don't knowingly collect data from anyone younger. If you think someone under 18 has an account, tell us and we'll delete it.

10.Security

The site only runs over HTTPS. There are no passwords to leak: sign-in codes and session tokens are stored as one-way hashes, codes expire after 10 minutes and allow only a few wrong tries. Backups are encrypted, and access to our servers is limited to the people who run them. No system is perfectly secure; if a breach puts your data at risk, we'll tell you and the authorities as the law requires.

11.Automated decisions

Software rates your moves, calculates your ratings and filters slurs out of your own swears. None of this has legal or similarly significant effects on you, so it isn't automated decision-making in the GDPR sense. If a filter blocks something you think it shouldn't, tell us.

12.Changes

If we change this policy, we'll update the date at the top. For important changes, such as using your data for something new, we'll tell you on the site or by email before they apply.