Privacy Policy

1. Overview

Xiangqi Arena is operated from Singapore and follows the Singapore Personal Data Protection Act (PDPA). We extend the same rights to every player, wherever you live.

This policy covers the website at https://www.xqarena.com and its API.

2. What we collect

We keep the service's data collection to what running it requires:

• Account: your email address, your password (stored only as a one-way hash, never in readable form), and your display name.
• Profile choices: country, avatar image, language, and theme, if you set them.
• Play records: your games and moves, results, ratings, and puzzle and learning progress.
• Membership status: your plan plus Stripe customer and subscription identifiers. Card details never reach our servers.
• Security records: sign-in sessions (with IP address and browser identifier) and short-lived server logs (with IP address).
• AI assistant conversations: what you type to the site assistant or the game coach and the replies, kept up to 30 days for visitors and 90 days for signed-in players, to run the feature and review abuse.

That is the full list. There is no hidden telemetry.

3. What we never do

Some things are off the table:

• We never sell, rent, or trade your personal data.
• We run no advertising trackers and build no profile of you across other sites. The only analytics scripts we load are Google Analytics and PostHog, and section 5 says exactly what each receives.
• We send no marketing email.
• We share nothing with data brokers.

4. Language suggestion

On your first visit we check your IP address against a country database hosted on our own servers to suggest a site language. The lookup happens in memory: the result is not stored and your IP address is not sent to anyone else for this.

This site includes GeoLite2 data created by MaxMind, available from maxmind.com.

5. Cookies, local storage and analytics

We set one essential cookie: a session token that keeps you signed in. It is HTTP-only and is not readable by scripts. Preferences such as theme, language, and board settings live in your browser's local storage.

The cookies we set ourselves are the session token above and PostHog's analytics identifier (its names begin with ph_, with a copy in local storage). Google Analytics and Google AdSense set their own, described here and in section 6.

We use Google Analytics to see how many people visit and which pages they use. It sets its own cookies (their names begin with _ga) to tell one visit from another, and it receives the page you are on, the rough location your IP address suggests, and basic device and browser details. Google processes this as our analytics provider, under its own terms.

We also use PostHog, a product-analytics service, to see how the site's features are used - which pages are visited, what gets clicked, and steps such as signing up or logging in. It receives basic device and browser details and the rough location your IP address suggests, and it stores a random identifier in a cookie and local storage to tell one visit from another. If you are signed in, that activity is linked to your account id and display name - never your email address - so we can see how features serve real players. It does not record your screen, and your games and moves are never sent to it. PostHog, Inc. processes this in the United States as our analytics provider, under its own terms.

We deliberately send both analytics services the page path only, never the query string, so a link carrying a password-reset token or a redirect target is stripped before anything is reported. If you would rather not be counted, block cookies for this site - that covers both - or install Google's opt-out browser add-on for Google Analytics alone. Nothing on the site stops working if you do.

6. Advertising

Members see no ads. Free accounts see ads from Google AdSense, and upgrading to any paid plan removes them everywhere.

Google serves those ads and sets its own advertising cookies under its own policies, which we do not control. We do not give Google your name, your email address or your games; it sees the page an ad appears on and what your browser reports, in the same way any site running AdSense does.

If you are in the EEA or the UK, Google's consent message asks before personalised advertising is used, and you can change that choice at any time from the same message. Ads never appear on the game board, inside a puzzle you are solving, or during a timed run.

7. Payments

Payments are processed by Stripe. Your card details go directly to Stripe and never touch our servers; we keep only your plan and the Stripe identifiers needed to manage your subscription. See stripe.com/privacy for how Stripe handles data.

8. How we use your data

We use the data above to:

• Run games, matchmaking, ratings, and leaderboards.
• Enforce fair play and rate limits.
• Provide membership features and manage billing.
• Keep accounts secure and sessions working.
• Diagnose problems using short-lived logs.

In legal terms: we process data to provide the service you signed up for, out of legitimate interest in keeping play fair and the service secure, and with your consent where the law requires it.

9. What is public

Xiangqi Arena is a place of public competition. The following are visible to everyone:

• Your display name, avatar, country, and plan flair.
• Your ratings and leaderboard standings.
• Your games, including moves and results, live and in the archive.
• Your puzzle and storm bests.

Your email address is never public.

10. Who we share data with

Only the processors the service is built on:

• Amazon Web Services: hosting, in the Singapore region.
• Stripe: payment processing.
• Authorities: only when the law requires it.
• Google: analytics as described in section 5, and advertising as described in section 6.
• PostHog: product analytics as described in section 5.

Google appears twice for two separate purposes: analytics, and advertising with its own cookies. Neither receives your name, your email address or your games. PostHog receives the product analytics described in section 5 - including your account id and display name when you are signed in, never your email address or your games.

11. Retention and deletion

Account data is kept while your account is active. Sign-in sessions expire on their own, and operational logs are kept only briefly.

To delete your account, contact us. We will close it and remove your personal data within 30 days.

Finished games are part of your opponents' histories and of the site's public record; when we delete an account, we remove or de-identify the personal details attached to them.

12. Security

All traffic is encrypted with TLS. Passwords are stored only as one-way hashes. Data lives in access-controlled infrastructure in AWS Singapore.

No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires.

13. Your rights

You can ask us at any time to:

• Show you a copy of the personal data we hold about you.
• Correct it.
• Delete it.
• Withdraw a consent you gave earlier.

Contact us as described below and we will respond within 30 days. You can also complain to the Personal Data Protection Commission of Singapore or the data protection authority where you live.

14. Children

The service is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

15. Where your data lives

Our servers are in the AWS Singapore region. If you use the site from elsewhere, your data is processed in Singapore.

16. Changes to this policy

Updates are posted on this page with the date above. Material changes will be announced on the site.

17. Contact

For any privacy question or request, including access and deletion, reach the site operator at support@xqarena.com. This is also the service's data protection contact.