Privacy policy
Last updated: 31 October 2026
This English translation is provided for information only; in case of discrepancy, the French version prevails.
Data controller
The personal data of CocoChess players is processed by SILADEL, 7 chemin des Coquelicots, 81990 Cambon, France. For any question about your data or to exercise your rights, write to [email protected].
Data processed
| Data | When | Nature |
|---|---|---|
| First name, last name, email address | account creation | required for an account |
| Guest account: assigned name (“Invité” and a number) | looking for an opponent without an account | created automatically, without an email address |
| Password | account creation, change | required; only its hash (Argon2id) is kept, never the password |
| Username, country, badge, avatar (library or uploaded image) | profile | optional |
| Settings: board appearance, messages, friend requests, challenges | profile | optional |
| Online games: opponents, moves, result, time control, dates; games marked as favourites | games played | needed for online play; favourites: optional |
| Games against a bot (signed in): bot, moves, result, time control, help, dates; favourites | finished game | “My stats” |
| Elo ratings and statistics | rated games | calculated by the service |
| Private messages, friends, friend requests, blocked players | social features | optional |
| Lichess account: ID, username, country and ratings | account linking | optional |
| Google account: Google ID, email address, first name and last name | signing in with Google | optional |
| Messages to support: email address, subject, message | “Help & support” form | optional |
| Technical data: IP address, date, actions performed on the account, pages and files requested, browser | each visit | technical |
CocoChess collects no payment data and no audience measurement data, and uses no advertising. A game against a bot is played in your browser: it is sent to the server only once finished, and only if you are signed in to your account, for your “My stats” space. Without an account, it stays in your browser.
A guest is seen under their assigned name, with the “guest” tag, and their online games are visible like any others, live and in replay.
What other players, and visitors without an account, can see: your username (or your first name followed by the initial of your last name), your avatar, your country, your badge, your ratings, your statistics, your presence (online, in a game) and your online games, live and in replay. Your email address and your full name are never shown.
Purposes, legal bases and retention periods
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Account creation and management, sign-in | identity, email, password, sessions | performance of the terms of use | as long as the account exists; session: 30 days at most |
| Playing as a guest | assigned name, games, session | performance of the terms of use | guest account and its games deleted automatically after 30 days of inactivity; games against a member kept for that member, under the name “Invité supprimé” (deleted guest) |
| Service emails: address confirmation, sign-in codes, change notices | performance of the terms of use | links and codes: deleted 7 days after they expire; sending records: 30 days | |
| Online games, ratings, history and statistics | games, ratings | performance of the terms of use | no time limit to date: the history is part of the ratings and of the opponents' history |
| “My stats” space: games against a bot | games against a bot finished while signed in | performance of the terms of use (feature requested by the player) | as long as the account exists |
| Private messages and social features | messages, friends, requests, blocks | performance of the terms of use | messages: deleted automatically after 90 days; friends and blocks: until removed |
| Linking a Lichess account | Lichess ID, username, country and ratings | performance of the terms of use (feature requested by the player) | until unlinked |
| Signing in with Google | Google ID, email address of the Google account | performance of the terms of use (feature requested by the player) | until unlinked or the account is deleted; sign-in in progress: 15 minutes at most |
| Support and reports | email, subject, message | legitimate interest: answering requests | copy on the server deleted 90 days after it is sent to the team |
| Security, prevention of abuse and cheating, diagnostics | IP address, account actions, refused moves | legitimate interest: protecting the service and the players | action log and refused moves: 90 days |
| Backups | the whole database | legitimate interest: restoring the service after an incident | 7 daily and 4 weekly backups, about 5 weeks |
Recipients and service providers
Your data is neither sold nor rented. It is accessible to the CocoChess team as needed, and to the following service providers for what concerns them:
- OVH SAS: hosting of the server and the database;
- Cloudflare, Inc.: transmission and protection of traffic between your browser and the website (IP address, pages and files requested). As Cloudflare is a company established in the United States, data may be transferred outside the European Union;
- Mailjet: sending the service's emails (email address and message content) and forwarding messages from the “Help & support” form to the team;
- Lichess (lichess.org), only if you link your account: you authorise access on the Lichess website, which sends us your ID, username, country and ratings;
- Google (Google Ireland Limited), only if you sign in with Google: you identify yourself on Google's page, which sends us your Google ID, your (verified) email address, your first name and your last name. We receive neither your Google password nor access to your Google account. As Google belongs to a group established in the United States, data may be transferred outside the European Union.
Cookies and browser storage
CocoChess uses no audience measurement or advertising cookies. The items below are strictly necessary for the service you request: they therefore do not require your consent.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| co_refresh | cookie, restricted to sign-in | keep you signed in and renew your session securely | 30 days at most, deleted on sign-out |
| co_oauth | cookie | secure the linking of a Lichess account | 10 minutes |
| co_oidc | cookie | secure signing in with Google | 10 minutes |
| co_google | cookie | complete signing in with Google (single-use ticket) | 15 minutes at most |
| chess.settings | local storage | last bot chosen and colour | until deleted |
| chess.game | local storage | game in progress against a bot, resumed on the next visit | until the end of the game |
| chess.pendingBotGames | local storage | game against a bot finished and waiting to be sent to your account (connection interrupted) | until it is sent |
| chess.online | local storage | time control and colour chosen for online games | until deleted |
| chess.board | local storage | appearance of the board and pieces | until deleted |
| chess.music.muted | local storage | music muted or not | until deleted |
| chess.coi-reload | session storage | technical reload of the page, only once, if the browser requires it for the chess engine | until the tab is closed |
Local storage stays in your browser and is not sent to the server. You can clear it at any time from your browser settings; the game then returns to its default settings.
Your rights
You have the right to access, rectify and erase your data, the right to restrict processing, the right to object to processing based on legitimate interest and, for the data you provided, the right to data portability. These rights are exercised under the conditions laid down by the General Data Protection Regulation: some data may have to be kept, for example for the security of the service or to comply with a legal obligation.
You can change most of your data yourself from the “Profile” window. For any other request, including the deletion of your account, write to [email protected] from your account's email address. We reply within one month.
If you consider that your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
Security
Traffic with the website is encrypted (HTTPS). Passwords are stored as hashes and never in plain text; the email address is confirmed before you can play online; each session can be closed from your profile; the number of sign-in attempts and of certain actions is limited. Access to the server and to the backups is restricted to the team.
Minors
CocoChess does not check the age of its players. A parent or guardian can ask for a minor's account to be deleted by writing to [email protected].
Changes to this policy
The date of the last update is shown at the top of this page. This policy is updated as soon as any processing changes.