1. Introduction and acceptance
These Terms of Service ("Terms") govern your use of Clockrook, an online chess service that lets people play against a computer, against each other on the same device, in rooms, in casual online games and in ranked games, and that publishes rankings and player profiles (the "Service").
The Service is operated by its developer, an individual, as a non-commercial test and study project ("Clockrook", "we", "us"). There is no company behind it.
By ticking the box on the registration form and creating an account, you confirm that you have read these Terms and the Privacy Policy and that you agree to be bound by these Terms. If you do not agree, do not create an account.
2. Account registration and eligibility
To play online you need an account. When you register you must provide a username, an e-mail address and a password. The information you give must be accurate, and you must keep your e-mail address up to date.
The minimum age to use the Service is 14 years. If you are below the age of majority in your country (18 in Brazil), you may use the Service only with the permission and supervision of a parent or legal guardian, where the law requires it.
You may hold one account. Usernames must be 3 to 24 characters and may contain only letters, numbers, dashes and underscores. We may refuse or change a username that impersonates another person, is offensive, or misleads other players.
3. Your responsibilities
You are responsible for what happens under your account. You agree to:
- follow these Terms and the laws that apply to you;
- provide truthful registration information;
- treat other players with respect; and
- tell us promptly if you believe your account has been used without your permission.
4. Account and password security
Choose a password that is at least 8 characters long and that you do not use anywhere else. Keep it private and never share it, including with people who say they work for Clockrook. We will never ask you for your password.
You can see the devices that are signed in to your account and sign any of them out. Sign out of shared devices when you finish playing.
We store passwords only as a one-way hash, which means we cannot read them. We apply technical measures to protect the Service, but no online service can be guaranteed to be free of vulnerabilities, interruptions or attacks, and we do not promise otherwise.
5. Fair play and anti-cheating
Every game must be played by the person who owns the account, using their own thinking. The following are not allowed in any online game, and in particular in ranked games:
- using a chess engine, bot, database, another person or any other outside help to choose moves;
- using scripts, extensions, automation or modified clients to play or to hide cheating;
- manipulating the clock, the connection or the game state;
- arranging results with another player, including "win trading", or deliberately losing to change ratings; and
- creating or using several accounts to gain an advantage.
To protect fair play, the Service examines how games are played, such as move timing, and asks the browser of a player in a ranked game to describe its environment, for example whether it appears to be controlled by automation software. These checks are not perfect, and a clean result does not prove that a player is honest. The Privacy Policy explains what is processed.
When our checks indicate a breach, we may void a game, adjust or reset a rating, pause a player's access to ranked play for a period, or take other action described in section 10.
6. Prohibited conduct
You must not:
- harass, threaten, insult or discriminate against other people, or use hateful, sexual or illegal content in your username, room name or chat;
- impersonate another person or pretend to speak for Clockrook;
- try to access another person's account, or access data you are not authorised to see;
- probe, scan or test the Service for vulnerabilities, or interfere with its operation, without our written permission;
- send automated or excessive requests, or use bots to create accounts, join queues or rooms, or collect data from the Service;
- try to bypass limits, restrictions, suspensions or security measures; or
- use the Service for any unlawful purpose.
If you find a security problem, please report it to us at the contact address in section 15 instead of exploiting it.
7. Online gameplay and matchmaking
You can play against a computer or on one device without a connection to other players, and you can play online in rooms, in casual matches and in ranked matches. Online games use a real-time connection to our servers. The server, not your browser, decides whether a move is legal, runs the clocks and records the result.
Matchmaking pairs players by mode, time control and, in ranked play, rating. In ranked play we may avoid pairing accounts that appear to share a network address or a device. If you wait in the ranked line for a while, you may be offered a game against a computer opponent of your level; such games are labelled, count differently for ratings, and are not counted in the human leaderboards.
If you lose your connection during a game, you have a limited grace period to return. If you do not, the game may end as abandoned and may count as a loss. Connection problems on your side are your responsibility.
Rooms may be public or private. Anyone who has the code of a room may be able to watch its game. Do not share a room code with people you do not want to watch.
8. Rankings and player profiles
Ranked games change your rating and place you in a league. Your username, rating, league, results, statistics and, if one is set, your country are shown publicly on leaderboards and on your player profile, and some of this information is visible to other players during games. Do not use a username that reveals information you want to keep private.
Ratings, leagues and positions are a feature of the Service. They are not property, have no monetary value, and may be adjusted, recalculated, reset or removed, for example after a fair-play decision, the correction of an error or a change in the rating system.
9. Chat and player communication
Players in an online game can exchange short text messages. Chat is for the game: be respectful, and do not post personal information, harmful links, spam or anything prohibited by section 6. Messages are limited in length and frequency, and invisible or direction-changing characters are removed.
Chat is not private from us. We process messages in order to deliver them and may use them to investigate reports and abuse. We are not responsible for what other players say, and we do not monitor chat continuously.
10. Account restrictions and termination
If we reasonably believe that you have breached these Terms, that you put the Service or other people at risk, or if the law requires it, we may warn you, void games, adjust ratings, restrict features (such as ranked play), or suspend or close your account, with notice where practical and without notice where necessary to protect players or the Service.
You may stop using the Service at any time, and you may delete your account from your account area after confirming your password. Deleting an account removes the profile data linked to it as described in the Privacy Policy; some technical records may remain for the reasons and for the time explained there. Sections that by their nature should survive termination, such as sections 5, 11 and 14, continue to apply.
If you believe a restriction was applied by mistake, contact us at the address in section 15 and explain the circumstances.
11. Intellectual property
The Service, including its software, design, graphics, sounds, text and trademarks, belongs to its developer or its licensors and is protected by intellectual property law. We give you a limited, personal, non-exclusive, non-transferable and revocable permission to use the Service in accordance with these Terms.
You must not copy, modify, distribute, reverse engineer or create derivative works from the Service, except as the law allows. The rules of chess and chess moves are not owned by anyone.
You keep any rights you have in the content you submit, such as a room name or a chat message. You give us a non-exclusive permission to store, display and transmit that content as needed to run the Service, for example to show your room name in the room list and to deliver your messages to your opponent.
12. Service availability and changes to the Service
We try to keep the Service available, but we do not promise that it will be uninterrupted, error free or available at all times. We may suspend it for maintenance, security or other reasons, and a game may be interrupted or lost because of a technical problem.
We may add, change or remove features, modes, leagues and rating rules, and we may stop providing the Service. Where a change materially affects you, we will try to give reasonable notice.
13. Privacy and personal information
Our Privacy Policy explains what personal information we process, why, for how long, and what rights you have. It is a separate document: accepting these Terms is not a consent to every kind of processing, and where the law requires your consent for something specific, we will ask for it separately.
14. Disclaimers and limitation of liability
The Service is provided "as is" and "as available". To the extent permitted by applicable law, we give no warranties other than those that cannot be excluded, and we are not liable for indirect or consequential losses, for the loss of ratings or game results, or for interruptions, errors or the actions of other players.
Nothing in these Terms excludes or limits any right or liability that cannot be excluded or limited under the law that applies to you, including your rights as a consumer where they exist.
15. Changes to these Terms, applicable law and contact
We may update these Terms, for example when the Service or the law changes. Each version has a number and an effective date, shown at the top of the document. If a change is material, we will tell you in the Service and, where required, ask you to accept the new version before you continue to use the affected features.
These Terms are governed by the laws of the Federative Republic of Brazil. Disputes will be handled by the Brazilian courts; where you are a consumer, by the courts of the place where you live. This does not remove any mandatory consumer-protection rights that you have where you live.
To contact us about these Terms: lchavesdesousa@gmail.com (e-mail only; this test project has no public postal address).
1. Introduction and who is responsible
This Privacy Policy explains how personal information is processed when you use Clockrook, an online chess service (the "Service"). It describes what the Service does today; it does not promise more than that.
The controller of your personal information is the individual developer who operates Clockrook as a non-commercial test and study project; no company registration number applies. No data protection officer has been appointed: the same person handles privacy matters. Contact: see section 20.
We process personal information in line with the laws that apply to the Service, including, where applicable, the Brazilian General Data Protection Law (Lei nº 13.709/2018, "LGPD"). Brazilian law is the one we follow; other laws may also protect you depending on where you live. This policy was written by the developer and has not been reviewed by a lawyer.
4. Sign-in, sessions and tokens
When you sign in or register, we create a session for that device. For each session we store a hash of a secret refresh token (not the token itself), when the session started and was last used, and the IP address, User-Agent, device description, device hash and approximate location from which it was created. This lets you see your signed-in devices, sign any of them out, and lets us detect a stolen token: if a refresh token is reused, or an access token is used from a different device, we end the session.
We keep a history of security activity for your account: registration, successful and failed sign-ins, token refreshes, sign-outs, ended sessions and detected token reuse or theft. Each entry contains the time and the IP address, User-Agent, device description, device hash and approximate location of the request. For a failed sign-in with an unknown account we store only a hash of the e-mail address that was typed. You can see your recent activity in your account.
The browser keeps a short-lived access token in memory only. The refresh token is kept in your browser's session storage, which the browser clears when the tab is closed.
5. Approximate location
If the operator has installed an offline IP-to-location database, we use it to derive the country, region and city that your IP address most likely belongs to. The lookup is done on our own server; your IP address is not sent to a third party for this purpose. If no such database is installed, the location is recorded as "unknown". We do not collect GPS or precise location, and we do not ask your browser for location permission.
The approximate location is stored with your sessions, your security activity and the access log, and is used to show you where your account was used and to help detect suspicious access.
When you join the online or ranked waiting line, the country derived from your connection may be saved as your country for the regional leaderboard, if you have not already chosen one. A country that is saved this way is shown publicly next to your name on leaderboards and on your profile. You can set or change your country in the ranked page. Choosing a country yourself replaces the automatic one at any time.
6. Games, rankings and profiles
To run games, we store the moves and clocks of online games, who played which colour, the result and its reason, the time spent on each move and how the move was made (for example by mouse or keyboard), your rating, wins, losses and draws, league and points, and your history of games. Games against the computer are marked as such.
Your username, rating, league, statistics, game history and country (if set) are public: anyone can see them on leaderboards and on your player profile, without signing in. Rooms that are not marked private are listed publicly with the host's username and rating; anyone who has the code of a room, public or private, can see the room and may be able to watch its game.
7. Chat and real-time communication
Online games use a WebSocket connection to our servers. For this connection we use a short-lived, single-use pass tied to your session and IP address, and we process your user number, your username and the messages and game actions you send (moves, resignation, draw offers, chat and heartbeats).
Chat messages and game events are stored in a real-time log so that they can be delivered, replayed to a reconnecting player and used to handle abuse reports. The application removes entries of this log that are older than about 24 hours. Chat text is not written to our diagnostic logs.
8. Fair play and anti-cheating
In ranked games we check how games are played and ask the page, from time to time, to describe its browser environment: for example whether it reports being controlled by automation software, whether it is a headless browser, whether the declared browser matches the User-Agent, whether the clock has been altered, and how moves were input. We record the findings of these checks (a type, a weight, small technical details, the match and your IP address) in an integrity record, and we keep a count of restrictions applied to your account. These records can lead to a game being voided or to ranked play being paused for a period, as described in the Terms of Service. Decisions are made automatically by the application based on these rules. If you think a decision is wrong, contact us (section 20) and ask for it to be reviewed by a person.
In the ranked waiting line we also keep your IP address and device hash for as long as you wait, to avoid pairing two accounts that appear to share a connection or device.
9. Cookies and browser storage
We use only what is needed to run the Service. We do not use advertising or analytics cookies, and we do not load third-party scripts or trackers.
- Session cookie (named "sid", or "__Host-sid" over HTTPS): created by our website for forms and anti-forgery protection. It is not readable by scripts, is not sent on cross-site requests, ends when you close the browser, and the server also expires it after inactivity (about 30 minutes) and after a maximum lifetime (8 hours).
- Language cookie ("lang"): remembers the language you chose; it lasts one year.
- Local storage: a random device identifier (see section 3) and your sound on/off choice.
- Session storage: your refresh token, cleared when the tab is closed.
These items are strictly necessary for the Service or for a setting you chose. You can delete them in your browser settings; if you delete the device identifier it will be recreated on your next visit.
10. Why we use your information and our legal bases
The list below gives each purpose and the legal basis we rely on. These legal bases are our own assessment.
- Creating and running your account, letting you sign in and play, keeping rankings and game history: performance of the contract with you (the Terms of Service).
- Keeping accounts and the Service secure: detecting stolen tokens and suspicious access, rate limiting, blocking abuse and attacks, and keeping security logs: our legitimate interest in protecting the Service and its users, and compliance with legal obligations where they apply.
- Fair play: examining how games are played and the browser environment in ranked games: our legitimate interest in keeping competition fair.
- Deriving an approximate location from your IP address: our legitimate interest in security and in telling you where your account was used. The country shown on leaderboards is described in section 5.
- Answering your requests and handling disputes: legal obligations and our legitimate interest.
We do not rely on your consent for the processing described in this policy. Accepting the Terms of Service and acknowledging this policy during registration is not a consent to all processing. If we introduce processing that needs your consent, we will ask separately and you will be able to refuse or withdraw it without losing your account unless the processing is necessary for the feature you ask for. We do not sell your personal information and we do not use it for advertising.
11. Sharing, hosting and service providers
We do not share personal information with advertisers, analytics companies or data brokers, and the Service does not send personal information to third-party services. Other players and visitors see the public information described in sections 2, 5 and 6, and your opponent sees your username and chat messages during a game.
The Service is hosted on a virtual private server rented from Hostinger, with servers in Brazil. Those providers may process personal information on our behalf under our instructions. We may disclose information where the law requires it, to respond to valid legal requests, or to protect the rights, safety and security of users and the Service.
12. International transfers
Whether your information is transferred outside your country depends on where the Service is hosted: the server and its backups are in Brazil, so we do not transfer your information to another country. The Service itself does not send personal information to services in other countries.
13. How we protect information
We protect the Service with measures that include: password hashing with a modern algorithm; short-lived access tokens and rotating refresh tokens that are stored only as hashes, with detection of reuse; the ability to end any session immediately; protection against cross-site request forgery and a strict content security policy; limits on request rates and sizes; validation of everything the server receives; server-side checks of every game action and of who may see which game; and logs from which passwords and tokens are removed.
Information is stored in a database on our servers, which is not publicly reachable by web address. Traffic between your browser and the Service is encrypted with TLS (HTTPS). A firewall exposes only the web ports and administrative access by SSH key or password; application files, secrets and the database are readable only by the system account that runs the Service. Daily backups of the database are kept in a private folder on the same server for 14 days. Storage and backups are not encrypted by the Service itself.
No system is completely secure. We cannot guarantee that unauthorised access will never occur. You can help by using a strong, unique password and by signing out of devices you do not control.
14. How long we keep information
We want to be accurate about this. The following describes what the application does today; it is not a promise of deletion at a given time.
- Account information (username, e-mail, password hash, rating and statistics, game history): kept while your account exists.
- Real-time chat and game events: removed automatically after about 24 hours.
- Match records and recorded moves: kept as part of the game record while the accounts of the players exist. They are deleted together with the account.
- Sessions and refresh-token records, including their IP address, User-Agent, device data and approximate location: kept while the session is valid; records of ended or expired sessions are currently not removed automatically and have no defined expiry date. We plan to delete them 90 days after they end, but that cleanup is not implemented yet.
- Security activity history (sign-ins, failures, token events): currently has no defined expiry date. We plan to delete entries 12 months after they are created, but that cleanup is not implemented yet.
- Integrity (fair-play) records, with the IP address: currently have no defined expiry date. We plan to delete them 12 months after they are created, but that cleanup is not implemented yet.
- API access logs and security and error logs, which contain IP addresses and, in access logs, user numbers: kept in files and deleted automatically after 90 days.
- Temporary technical records (rate-limit counters, single-use tickets, waiting-line entries, web session files): are cleaned up by the application or expire, although some files may remain until cleaned. Web session files are removed by a scheduled task once they are 8 hours old.
We acknowledge that keeping technical information indefinitely is not automatically justified. The operator will decide, and publish here, a retention period for each category above that is proportionate to its purpose. Until then, the entries marked above are retained without a fixed period.
15. Deleting your account
You can delete your account from your account area after confirming your password. Deleting it removes your account record and, through the database, the data linked to it: your sessions and refresh-token records, statistics, game history, matches, queue entries, integrity records and policy acceptance records.
Some information is not removed by this action today: security activity history entries are kept but are no longer linked to your account (they keep the IP address, device and approximate location data stored with them, and a hash of the e-mail typed in failed sign-ins), access and security logs that mention your IP address or user number remain in log files, backups (if any) are not changed, and your username may remain in the game history of opponents as the name of the player they met. Log files are deleted after 90 days and backups after 14 days. Until the retention cleanup mentioned above exists, you can ask us to delete or anonymise the remaining records. We keep information longer only where a law requires it.
16. Your rights
Under the LGPD, and under similar laws elsewhere, you may have the right to:
- confirm that we process your personal information and obtain access to it;
- correct incomplete, inaccurate or outdated information;
- request anonymisation, blocking or deletion of unnecessary or excessive information, or of information processed unlawfully;
- request portability of your information;
- obtain information about the entities with which we share your information;
- be informed about the possibility of refusing consent and about the consequences of refusing, and withdraw consent where processing is based on it;
- object to processing carried out under a legal basis other than consent if you believe it does not comply with the law;
- request a review of decisions made solely by automated means that affect your interests; and
- lodge a complaint with the data protection authority (in Brazil, the Autoridade Nacional de Proteção de Dados, ANPD).
Today you can view your account details and security activity, change your username, e-mail, password and country, sign out of devices, and delete your account yourself. For any other request, such as a copy of your information, contact us (section 20). We may need to verify your identity before we act, and we will never disclose information to someone who cannot show that it concerns them. We aim to answer within 15 days of receiving your request.
17. Children and teenagers
Chess is played by people of all ages, and we do not assume that all users are adults. We do not ask for your age or date of birth. The minimum age for the Service and any requirement for a parent's or guardian's consent are set out in the Terms of Service. The Service is meant for people aged 14 or older. If you believe a child under 14 has an account, contact us and we will delete it.
If you are a parent or guardian and believe that a child has given us personal information without the permission required by law, contact us (section 20) and we will act on your request. Because chat and usernames are visible to other players, we encourage children not to share personal information.
18. Security incidents
If a security incident puts your personal information at relevant risk or harm, we will assess it and, where the law requires, notify the data protection authority and the people affected, describing what happened, which information is involved, the risks, and the measures taken. We will do this within the time the applicable regulation sets, and without unjustified delay.
19. Changes to this policy
We may update this policy when the Service, the law or our practices change. Each version has a number and an effective date shown at the top of the document, and earlier versions are kept so that we can show which version applied to you. When a change is significant, we will tell you in the Service before it takes effect. A change to this policy does not by itself ask for your consent, but we will ask for it when the law requires.