Privacy notice

This notice covers the Falling Chess website and Godot browser preview. Mobile apps remain in development and need release-specific disclosures. Last updated: 6 September 2026.

Data we use and why

Website delivery and security

Cloudflare receives network and request information, including IP addresses, to deliver the website and protect its services. The landing loads no advertising or analytics scripts. We self-host its font and images.

Local gameplay

The game saves settings, local scores and progress on your device. It also stores the analytics preference and a random installation identifier. A local identifier can exist before you opt in, but the game does not send optional gameplay events without consent. There are no player accounts or cloud saves.

Optional gameplay analytics

Gameplay analytics starts off. If you opt in, the Godot client sends PostHog approved gameplay and performance events, such as mode selection, run results and loading timings. Events include installation, session and run identifiers, app version, platform and device-class context. These identifiers can link activity from one installation; they are pseudonymous, not anonymous.

The current game labels the control “Anonymous analytics” in Options. Turn it off to stop future optional collection and purge queued optional events. This does not erase events that a server has received. Playing does not require analytics consent.

The client event schema excludes initials, email addresses, free-form messages, precise location, advertising identifiers and authentication tokens. The adapter disables PostHog person-profile creation and GeoIP enrichment. Providers still receive network information when handling requests.

Online multiplayer and service metrics

Choosing Find Opponent starts a temporary guest session. Cloudflare game services process a random guest identifier, temporary credentials, queue and match identifiers, board state, moves, scores and connection details to pair players, validate actions and support reconnection. Your opponent sees the shared match state.

When server analytics is configured, the multiplayer service also sends PostHog queue outcomes, match results and connection or validation metrics with request, queue, match or match-scoped participant identifiers. These server events operate independently of the client’s optional-analytics switch. They do not create an account or player history. We must validate the necessity and legal basis of these metrics before public release; the switch is not a promise to stop operational server processing.

Public leaderboard

If you submit a qualifying score, Cloudflare stores and publishes the score, your chosen three-letter initials and submission timestamp. Use initials you are comfortable sharing. The score API also uses your IP address in a temporary rate-limit record to prevent repeated submissions. Solo play does not require you to submit a score.

Support

If you contact Sliday, you choose which contact details and message to provide. Do not send passwords, guest credentials, authorization tokens or payment details. The external contact service’s privacy notice also applies.

Cookies and device storage

The static landing does not set application cookies or read browser storage. Your browser may cache its files. Once you open the game, Godot uses browser-backed local storage, including IndexedDB, for game files, settings, progress and the analytics preference. This storage is distinct from advertising cookies.

We do not add marketing cookies, tracking pixels, session replay or a third-party consent platform to this landing. Cloudflare may use security mechanisms according to its configuration. Before release, we must check the deployed site for provider cookies and disclose any that appear.

You can turn optional analytics off in the game’s Options and remove local game data through your browser’s site-data settings. Clearing site data can erase progress and settings and may prevent recovery of a guest session. It does not delete leaderboard entries or other server records. If you want help locating server data, contact us before clearing your local identifiers.

Legal bases for release review

Where GDPR applies, the proposed bases are consent for optional gameplay analytics (Article 6(1)(a)); providing the game services you request, including matchmaking and score submission (Article 6(1)(b)); and legitimate interests in protecting service security and preventing abuse (Article 6(1)(f)). We must confirm these bases against the final operator, terms and deployment. We must also assess server metrics separately rather than classify all analytics as essential.

Declining optional analytics leaves play available. Online matching needs connection and match data; publishing a score needs a submitted score and initials. We use automated game rules and matchmaking, not decisions about you with legal or similarly significant effects.

How long data remains

• Local data: remains until you clear it, reset the relevant setting or your browser removes it. Queued optional events leave local storage after delivery or consent withdrawal, subject to the queue’s limits.
• Leaderboard: the service keeps the current top ten. An entry can remain until a higher score displaces it or an operator removes it; the code has no fixed time-based expiry.
• Score rate limits: the API sets a 120-second expiry on IP-based counters after a write.
• Guest multiplayer: credentials have a maximum six-hour lifetime. The code schedules completed queue-ticket removal after five minutes and keeps minimal replay-prevention records for up to six hours after the terminal event. Match-room cleanup also has a six-hour deadline from match start. These limits do not cover separate provider logs or delivered analytics.
• PostHog, hosting logs and support: we have not verified the deployed retention, backup or deletion schedules. We must set and disclose those periods or justified retention criteria before public launch.

Providers and international transfers

Cloudflare supplies hosting, game services and leaderboard storage. PostHog receives configured analytics. Other players can view public leaderboard entries and their own shared match. This browser preview does not collect payments, run an email signup or enable purchases.

Depending on account settings and provider operations, providers may process information outside your country or the EEA. We have not confirmed the production PostHog region or the operator’s transfer arrangements. Before public launch, the operator must verify processor agreements, subprocessors and applicable transfer safeguards, then explain how you can obtain details. A link to a provider policy does not establish those arrangements.

Read Cloudflare’s privacy policy and PostHog’s privacy policy.

Children and changes

The current preview has no age-verification or parental-consent flow. Before a child-directed or family release, we must confirm the intended audience and apply the relevant child-privacy requirements. Do not provide a child’s personal details through a score entry or support message unless needed to resolve a privacy concern.

We will update this notice when the data practices change and seek fresh consent where required. Continuing to play does not grant consent to new optional tracking.