Privacy Policy

1. Who is responsible

Kazuhiro Labs, based in Kuwait, is the controller of your personal data. Contact us about privacy at support@gunjin.net.

2. What we collect

Playing as a guest: a randomly generated guest name, an avatar colour, a session cookie, and the games you play with their moves and results.

With an account: your username, email address and password. Passwords are stored only as a salted scrypt hash, so nobody, including us, can read them. Optionally a short bio and an avatar colour. We also keep your ratings, game records, friends list, how many Game Reviews you have used, and which version of these terms you accepted and when. If you turn on two-step sign-in, we keep the key your authenticator app uses and your recovery codes, the codes only as a one-way hash.

Games and chat: the moves and result of each game are stored so you can replay and review them. Chat messages, from players and from spectators, are kept only in the server's memory while the game room exists and are deleted within about two hours after the game ends. When a player reports their opponent from a game, the players' chat of that game is saved with the report.

Payments: if you buy VIP, Gumroad, our online reseller and the merchant of record, takes your payment and charges any tax due. Gumroad collects your payment details and billing country itself and is responsible for them under its own privacy policy. We never see or store your card details. The checkout link carries a private code so that Gumroad's notice of your payment reaches the right account. That notice includes the email you gave Gumroad, but we keep only the membership's reference, your plan and when your membership ends.

Technical data: your IP address is used briefly, in memory only, to keep the site secure and to limit abuse such as repeated sign in attempts. We do not store it in our database. Our hosting provider may keep standard server logs, including IP addresses, for up to 30 days for security.

Settings saved in your browser: preferences such as board theme, piece style, language and sound are stored in your own browser and are not sent to us.

Error reports: if the site breaks in your browser, it sends us the error message, the kind of page and your browser name and version, without your account or IP address, so we can fix it. These are kept for up to 30 days in our server logs.

Safety records: reports you send and reports about you, with the reason, any note, the game and its chat, the players you have blocked, and a log of what the staff do on your account, such as a suspension. A reported player is never told who sent the report. Games you leave without finishing are counted from your game records to pause matchmaking for a while.

3. Why we use it and our legal basis

To provide the game, your account, ratings, friends, Game Review and VIP, because this is necessary to perform our agreement with you.

To keep the site secure, prevent cheating and abuse, and fix problems, because we have a legitimate interest in running a safe and fair game.

To send password reset emails and essential messages about your account or membership, as part of our agreement with you. That includes a security email whenever your password or sign-in settings change, so you would notice if someone else made the change. We do not send marketing emails.

To show personalised advertising, only if you give consent. You can withdraw consent at any time with Privacy choices at the bottom of the site.

To keep payment and tax records, because the law requires it.

4. What other players can see

Your username or guest name, avatar colour, ratings, record, recent games, bio, whether you are online and your place on the leaderboard. Finished games, including the moves, can be viewed by anyone with the game link. Your email address is never shown.

5. Who we share it with

We use a small number of service providers who process data for us under contracts that require them to protect it: our hosting provider, which runs the servers and stores the database, Gumroad, our reseller for VIP, for payments and tax, Resend for sending password reset emails, Cloudflare Turnstile to check that new accounts are made by people if it is switched on, Plausible Analytics to count visits without cookies or personal data if it is switched on, and Google AdSense for advertising if ads are switched on.

We may disclose data if the law requires it or to protect the safety of our players. We do not sell or rent personal data.

6. International transfers

Some providers may process data outside your country, including in the United States. Where data leaves the UK or the European Economic Area, we rely on adequacy decisions such as the EU to US Data Privacy Framework or on the European Commission's Standard Contractual Clauses.

7. How long we keep it

Account data is kept until you delete your account. Guest profiles that have not played a game are deleted after 30 days without a visit. A guest who signs up chooses whether their games and results move to the new account. If they start with a clean record instead, the guest profile is deleted. Sign in sessions end after 30 days of inactivity. Password reset links expire after one hour.

Reports, with any chat attached, are deleted one year after the staff close them. Blocks last until you remove them or delete your account. The log of staff actions is kept so that every staff decision can be checked later.

When you delete your account we delete your profile, ratings, friends, blocks, sessions and review history, and remove your name from reports you sent. Finished games stay in your opponents' history, but your account is unlinked from them. Payment records are kept for as long as tax law requires, usually up to seven years.

8. Your rights

You can ask to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw consent you have given. You can download all your data and delete your account yourself in Account settings, and change your advertising choice with Privacy choices.

For anything else, email support@gunjin.net. We answer within one month. If you are unhappy with our answer, you can complain to your data protection authority, for example the authority in the EU country where you live or the Information Commissioner's Office in the UK.

9. Children

Gunjin Shōgi is not intended for children under 13. In the European Economic Area, players under 16, or the lower age set by their country, need a parent's permission to create an account. If we learn that an account belongs to a child under 13, we delete it.

10. Security

We protect data with encrypted connections, hashed passwords and session tokens, optional two-step sign-in, which our staff must use, secure cookies, rate limits on sign in and sign up, strict browser security rules and regular backups. No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.

11. Cookies

See our Cookie Policy for the cookies and browser storage we use.

12. Changes

We will update this policy when our practices change and show the date of the latest version at the top. Important changes will be announced on the site.