Privacy Policy
2026-09-30
Payments and ticket data
Stripe processes payments and billing management. We store account-linked customer, checkout, subscription and invoice identifiers, payment verification records, membership status, ticket balances and grant/use records to provide benefits, prevent duplicates and investigate problems. Card numbers are handled by Stripe, not stored by Q-Gambit. Account deletion removes game data; Stripe or legally required payment records may remain under their applicable retention rules. No unverified retention period is promised.
The minimum payment-processing identifiers needed to prevent delayed notifications from recreating a deleted account or its benefits are retained separately. We do not promise immediate deletion of records that the law or payment provider requires to be retained.
1. Introduction
Q-GAMBIT ("the Service") is an online quantum chess game. This Privacy Policy explains how we collect, use, and protect your information when you use the Service.
2. Information We Collect
- Account information: Sign-in details, user ID, display name and any chosen profile picture are used for accounts and multiplayer features. Your public name, avatar and rating can be visible to other players.
- Game Data: We record game replays (move history, results) to provide replay functionality and leaderboard rankings.
- Gameplay metrics are off by default. Only after you turn them on in Settings, this browser sends seven milestone events: first visit after opt-in, tutorial start and completion, first match start and finish, second match start, and next-day return. Children should choose with a parent or guardian. Security audit logs contain only action type, outcome, server time and the affected account. They are retained for 30 days and expired entries are removed hourly. These logs do not store passwords, tokens, email content or raw IP addresses. Linked logs are erased with account deletion. Inactive accounts are not automatically deleted.
3. Third-Party Services
The Service uses the following third-party services that may collect information:
- Google ads: Advertising and ad-based daily limits are disabled in this release. H5 Games Ads is not activated. If ads are enabled later, required consent and child-audience protections must be in place first.
- Supabase: We use Supabase as our backend database to store user profiles, game records, and rankings.
- Cloudflare Pages hosts the Web site, Render runs the match server, and Supabase stores account and game data. These providers may process essential service logs.
4. Cookies
Language, audio, cosmetic choices, game progress and sign-in state may be stored on your device. Clearing browser storage may remove local progress and sign you out. Signed-in progress and appearance choices also sync to the server. Account deletion erases this cloud save as well.
Optional gameplay metrics
Gameplay metrics are off by default. Only after you turn them on in Settings, this browser sends seven milestone events: first visit after opt-in, tutorial start and completion, first match start and finish, second match start, and next-day return. Children should choose with a parent or guardian.
The browser stores your choice, the UTC day you opted in, and one-time sending flags. We store only the event type, that UTC cohort day, the receipt time, and a random per-event duplicate-prevention ID for up to 90 days. No account ID, email, match record, advertising ID, or page URL is sent in these events. Results are approximate, per browser, and are not linked across devices. Hosting providers may separately process essential connection and security logs.
Turn metrics off in Settings at any time. This stops future events and clears the browser’s metrics state. Earlier anonymous events cannot be individually identified or removed; they expire within 90 days. Advertising and ad-based play limits remain off.
5. Data Retention
The replay list is limited to your latest 10 games. Shared records may remain while included in an opponent’s latest 10. Account data, ratings and operational records are separate; request deletion through the contact address below.
6. Children's Privacy
The game is intended for an audience that includes children. Children should use it with a parent or guardian. Do not put real names, contact details or sensitive photos in public profiles. Parents and guardians can contact us about data or deletion. Child-privacy requirements must be reviewed before advertising is enabled.
7. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date.
8. Contact
Contact [email protected]
Q-Gambit — Delete account
Sign in to Q-Gambit, then open Settings → Account management → Delete account. Finish your match and pending saves, review the warning and type DELETE to confirm. If you cannot sign in, request deletion at the address below. Never send passwords or verification codes.
Delete your account, rating, photos, friends and progress on this device. Shared replays are erased; opponents keep anonymous win/loss records only. This cannot be undone. Your Google account and copies on other devices are not deleted. Signed-in progress and appearance choices also sync to the server. Account deletion erases this cloud save as well.
Completed deletion cannot be undone. Opponents keep their ratings. Backup copies expire under the hosting provider’s retention schedule; stored copies on other devices and downloads cannot be erased remotely.
For an ID/password account, verify a recovery email in account settings while signed in before using password recovery. Unverified addresses cannot reset passwords. Recover Google or Discord access through that provider.