Privacy Policy

Last updated: 2026-10-30

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

No data protection officer is appointed, as there is no legal obligation to do so.

2. Overview

Multi Chess is a free browser chess game. You can play against a chess engine that runs in your own browser, play live games against other people via an invite link or the public lobby, and play e-mail matches over several days. You can play as a guest or create an optional account. The game was built to process as little personal data as possible:

• playing as a guest needs no registration, no e-mail address and no cookie;
• an account is optional; it needs an e-mail address, a username and a password;
• the only cookie is the login cookie of members (strictly necessary, see section 7);
• no analytics, no tracking, no advertising, no social media plugins, no profiling;
• no external resources: all scripts, styles, images and the chess engine are delivered by this server, so your browser does not connect to any third-party server;
• chat messages are only visible to the two players, are not read by the operator and are not archived.

3. Hosting and server log files

This website is hosted by i-make.media – Magnus Brühl, Wilhelm-Elfes-Straße 46, 41065 Mönchengladbach, Germany, who acts as a processor on my behalf under Article 28 GDPR. The data centre is provided by the sub-processor Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. All servers are located in Germany.

When you access the website, the web server infrastructure automatically processes information that your browser transmits:

• IP address,
• date and time of the request,
• requested page or file,
• referrer URL (the page you came from, if your browser sends it),
• browser type and operating system (user agent),
• HTTP status code and amount of data transferred.

Purpose: delivering the website and ensuring the security and stability of the servers (e.g. defending against attacks). Legal basis: Article 6(1)(f) GDPR — my legitimate interest in operating the website securely. Retention: log files are deleted after 30 days at the latest. The game application itself does not write access logs and does not store IP addresses.

4. Member accounts (optional)

If you create an account, the following data is stored in the game's database on the server:

Providing e-mail address, username and password is necessary to create an account; without them no account can be created (you can still play as a guest). You must be at least 16 years old or have the permission of your parents. Accounts whose e-mail address is never confirmed are deleted automatically after 7 days.

Legal basis: Article 6(1)(b) GDPR (the account you asked for and its functions) and Article 6(1)(f) GDPR (security notices, preventing misuse, proof of the accepted terms).

Administration: the operator can see the list of accounts (username, e-mail address, timestamps, statistics, notification setting, number of login sessions and whether you are online) and the running games (players, settings, moves, clocks) in a protected administration area, only to run the service, to help with problems and to act on reports (for example ending a game, see the terms of use). Chat messages, passwords and IP addresses are not shown there. Opening the user list and ending games are written to the server log.

Your control: on your account page you can change your username, e-mail address and password, switch notifications off, lift blocks, download all your data as a file (Art. 20 GDPR), delete your game history, and delete your account at any time (see section 13).

4.1 E-mails

Account e-mails (activation, password reset, confirmation of a new address, security notices) and notifications about e-mail matches (your turn, someone accepted your match, a reminder before deletion, the result, deletion) are sent through the mail server (SMTP) of my e-mail provider, which processes the e-mail address and the content of the message on my behalf (Article 28 GDPR). The e-mails contain no tracking pixels or tracked links. Notifications can be switched off in your account settings; every notification says how. To protect your mailbox against misuse, the number of e-mails per address and hour is limited.

5. Playing online

When you open the lobbies or an online game, your browser establishes a WebSocket connection to the game server. For this, the following data is processed:

Who can see it: your opponent sees your name, whether you are a registered player, your moves and online status. Anyone who knows the link of a game can watch it — except games for registered players only and e-mail matches, which only members can open. Open public games are listed with name and settings for all visitors until someone joins.

Storage: live games are kept only in the working memory (RAM) of the game server. Open public games are removed when their creator leaves; invite links expire after at most 30 minutes; finished live games are removed from memory 30 minutes after they end. If at least one player is a member, the finished game is additionally stored in that member's game history (section 4) — games between guests are never stored.

Legal basis: Article 6(1)(b) GDPR (providing the game you requested) and Article 6(1)(f) GDPR (legitimate interest in fair play, e.g. lag compensation, rate limiting against abuse).

5.1 Messages and chat

Depending on the setting of a game, the two players can exchange predefined quick messages (“Good luck!”) or chat messages in their own words. Messages are sent only to the two players, never to spectators. The operator does not read or monitor the chat. The messages of a live game are kept in the server's memory together with the game and disappear at the latest 30 minutes after the game ends; messages of an e-mail match are stored in the database with the match until it ends or is deleted. Messages are never added to the game history and never analysed for any other purpose. Please do not share personal data in the chat.

Automatic moderation: before a message is delivered, the server checks it automatically. Messages containing links or web addresses, e-mail addresses, phone numbers, social-media handles or certain threats are not delivered (the sender gets a note); severe insults are replaced by asterisks; shouting (all capitals) is converted to lower case. The check happens in the moment of sending; rejected messages are not stored. Legal basis: Article 6(1)(b) GDPR (the chat you use) and Article 6(1)(f) GDPR (protecting players against spam, phishing, the disclosure of contact data and abuse).

5.2 E-mail matches

E-mail matches are games without a clock between two members. So that they survive server restarts, their settings, the names and account IDs of both players, the moves, open offers and the messages of the two players are stored in the database. Your e-mail address is not part of the match; it is only looked up when a notification is sent (section 4.1). No e-mail is sent while you have the match open. A match is deleted after 14 days without a move (a reminder is sent before); a finished match is removed from the list of running matches and, without its messages, added to the members' game history. Legal basis: Article 6(1)(b) GDPR.

5.3 Relaxed and strict games

The game style (relaxed or strict) only changes which helpers the game shows; no additional data is processed.

5.4 Blocking players

You can block another player. For members, the block is stored with the account (player ID, name of the blocked player, date); for guests it is kept in the server's memory until the next restart. Blocked players cannot join your games and you do not see their open games; the blocked player is not notified, but may notice that they cannot join. Legal basis: Article 6(1)(f) GDPR — the legitimate interest of players to protect themselves against harassment. Blocks are deleted when you lift them or when one of the two accounts is deleted.

5.5 Spam and abuse protection

To keep the lobby usable and to protect accounts against password guessing, there are limits per player and per network connection: how many games may be opened and how often, how many connections may be open at the same time, how many sign-ups, e-mails, chat messages and failed logins are allowed, and a temporary block from the public lobby for players who repeatedly abort games. For this, the server derives a pseudonymous key from your IP address (for IPv6: from the first half of the address, the /64 network) using a keyed hash with a secret that is newly generated on every server start and never stored. Failed logins are counted per account name, which is also kept only as a hash. The IP address itself is not stored.

These keys and counters are kept only in the server's working memory, for at most three hours (the longest time window of the limits), and are deleted by every server restart. They are not used for any other purpose and not shared with anyone. Legal basis: Article 6(1)(f) GDPR — my legitimate interest in protecting the service and your account against spam and abuse.

6. Reports of illegal content

If you report content (for example a username or a chat message) to the contact address, I process your report, your name and e-mail address and the reported content to examine the report, to inform you and, if necessary, the affected player about the decision, and to take action. Legal basis: Article 6(1)(c) GDPR in conjunction with Article 16 of the Digital Services Act, and Article 6(1)(f) GDPR. Reports are deleted six months after the case is closed, unless they are needed longer to establish or defend legal claims.

7. Cookies

Guests get no cookie. When a member logs in, the server sets exactly one cookie:

Legal basis: § 25(2) no. 2 TDDDG, as the cookie is strictly necessary to provide the login you explicitly requested; no consent is required. Processing of the associated data: Article 6(1)(b) GDPR.

8. Local storage in your browser

The game stores a few entries in your browser's localStorage. They stay on your device; the website does not read them from the server side.

Only the guest token (as described in section 5) and your nickname are transmitted to the server, and only when you use the online modes. Legal basis: § 25(2) no. 2 TDDDG, as the storage is strictly necessary to provide the service you explicitly requested, and Article 6(1)(f) GDPR. You can delete these entries at any time through your browser's settings (“clear site data”).

9. Playing against the computer, coach and game review

The chess engine Stockfish runs entirely inside your browser (WebAssembly). The engine file is downloaded from this server, but no position or move of your games against the computer is sent to the server. The same applies to the coach, hints, analysis and the game review. The list of opening names is also downloaded once and looked up in your browser.

Only if you are logged in, your browser sends the result of each finished game against the computer to the server (the level and whether you won, drew or lost), and when you log in it adds the results stored in that browser (mc.aiLevels, see section 8) — including games played there before you logged in. They are stored as your record against the computer (see section 4). Legal basis: Article 6(1)(b) GDPR — providing the account features you asked for.

9.1 Your progress on the game platform (only if you connect it)

Multi Chess is also listed on my game platform gaming.bugfish.eu, which can show the computer levels you have beaten here as your progress in Multi Chess (each level 12.5 %, all eight levels = completed). This only happens if you switch it on by clicking “Connect Multi Chess” on the Multi Chess page of gaming.bugfish.eu; this browser then remembers the connection (mc.platformLink, see section 8). Without that click, this website never contacts gaming.bugfish.eu.

Once connected, after a finished game against the computer (and at most every few hours otherwise) your browser asks gaming.bugfish.eu whether you are logged in there and, if you are, sends it which levels you have beaten. Your browser includes the login cookie of gaming.bugfish.eu, because both websites belong to bugfish.eu; this website (chess.bugfish.eu) never sees that cookie, your account there or your data there. Nothing about your games or your account here is sent, only the numbers of the levels you have beaten. If you are not logged in there, nothing is stored in an account there; like every request, it appears in the server log files of gaming.bugfish.eu. The requests go to the same operator and the same server infrastructure (section 3); their processing there is described in the privacy policy of gaming.bugfish.eu.

Legal basis: Article 6(1)(b) GDPR — showing your progress in the platform account you created there; for remembering the connection in your browser and for sending the platform's cookie, § 25(2) no. 2 TDDDG, as both are strictly necessary for the function you explicitly asked for. You can stop it at any time in the settings (gear icon → Game platform → Disconnect); the progress already stored on the platform can be deleted there (Save States).

10. Contacting me

If you contact me by e-mail or phone, the data you provide (e.g. name, e-mail address, phone number and the content of your message) is processed to handle your request. Legal basis: Article 6(1)(f) GDPR, or Article 6(1)(b) GDPR if your request relates to your account. The data is deleted once your request has been dealt with, unless statutory retention obligations apply.

11. Recipients and transfers to third countries

Apart from the hosting providers named in section 3 and the e-mail provider named in section 4.1, no data is passed on to third parties — except to authorities where the law requires it. There is no transfer to countries outside the EU/EEA. If you share an invite link through a messenger or e-mail service of your choice, that service's privacy policy applies to the sharing. Links to external websites (e.g. in the “Made by Bugfish” section) only take effect when you click them.

12. Security and automated decisions

When the website is accessed via HTTPS, all data including the game connection is transmitted in encrypted form (TLS). Passwords are stored only as salted scrypt hashes; login cookies, e-mail links and sessions use long random values of which only hashes are stored. Repeated wrong passwords temporarily lock the account. The website uses a strict Content Security Policy and loads no third-party code.

There is no automated decision-making or profiling within the meaning of Article 22 GDPR. The automatic chat filter and the limits against spam (sections 5.1 and 5.5) only prevent a single message or delay an action for a short time; they have no legal effect.

13. What is deleted when

14. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Members can exercise most of these rights directly on their account page (change data, download data, delete history or account). No processing is based on consent, so there is no consent to withdraw. Please note that for guests the game stores no data that directly identifies them and deletes all game data after a short time; I will therefore often be unable to attribute data to a guest (Art. 11 GDPR). To exercise your rights, use the contact details in section 1.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for me is:

15. Changes

I may update this privacy policy when the game or the legal situation changes. The current version is always available on this page.