Privacy Policy

Hypercarry Chess is operated by Chia Meng Hioke (“Hypercarry Chess”, “we”, “us” or “our”).

This Privacy Policy explains how Hypercarry Chess collects, uses, discloses, stores and otherwise handles personal data when you access or use Hypercarry Chess and its related services.

For privacy questions, requests or complaints, you may contact:

Data Protection Contact / DPO: Chia Meng Hioke
Email: privacy@hypercarrychess.com

1. Scope

This Privacy Policy applies to Hypercarry Chess, including its website, user accounts, player profiles, games, customisation features, user uploads, feedback systems, AI-powered features and related services.

Third-party services that you access independently, including Google, Discord and external websites linked from Hypercarry Chess, may have their own privacy practices and policies.

2. Minimum Age

Hypercarry Chess is intended only for users aged 13 or older.

If you are aged 13 to 17, you must have permission from a parent or legal guardian to use Hypercarry Chess and should use the Service with appropriate parental or guardian guidance or supervision.

Hypercarry Chess does not intentionally seek to collect personal data from children below 13.

Where age eligibility is collected, Hypercarry Chess uses an age-band attestation, such as whether a user is aged 13–17 or 18 or older, rather than requiring a full date of birth solely for age verification.

Users aged 13–17 may also be asked to confirm that a parent or legal guardian has given them permission to use the Service.

If we become aware that a person below 13 is using Hypercarry Chess, we may restrict or terminate their access and take appropriate steps concerning associated personal data.

3. Personal Data We Collect

Depending on how you use Hypercarry Chess, we may collect or process the following categories of information.

Account and authentication information

This may include:

• email address;
• username or display name;
• internal account identifiers;
• public Hypercarry Chess UID;
• password hash;
• email-verification and password-reset information;
• login and activity timestamps;
• authentication-session information;
• Google or Discord account identifiers where OAuth is used;
• OAuth profile information such as name or avatar where provided by the relevant service;
• account roles and permissions; and
• records relating to account security.

Hypercarry Chess stores password hashes rather than plaintext passwords.

OAuth access tokens used during authentication are not intended to be retained as permanent Hypercarry Chess account credentials unless this changes in the future.

Age and legal acknowledgement information

We may store records showing:

• your selected age band;
• confirmation of parent or guardian permission where applicable;
• the version of the Terms of Service you accepted;
• the version of this Privacy Policy you acknowledged;
• when the relevant acknowledgement occurred; and
• the part of the Service through which the acknowledgement was provided.

These records are maintained so that Hypercarry Chess can determine which terms and notices applied to an account at a particular time.

Profile information

Information that you choose to add to your profile may include:

• profile picture or avatar;
• gender;
• birthday month and day;
• biography;
• social links;
• displayed titles;
• achievements; and
• other profile customisations.

A birthday entered for profile purposes is separate from the age-band information used for eligibility.

Gameplay information

We may collect or store information generated through gameplay, including:

• games and game identifiers;
• participating players;
• moves and positions;
• game configuration and custom rules;
• results;
• timestamps;
• gameplay events;
• bot or AI interactions;
• game messages;
• titles, achievements, unlocks and progression; and
• related game or technical information.

Preferences and customisations

We may store information concerning:

• selected chess pieces;
• boards;
• backgrounds;
• cursors;
• music;
• playlists;
• presets;
• interface preferences; and
• other settings associated with your account or browser.

User-uploaded content

Depending on the feature, you may upload:

• profile pictures;
• chess-piece assets;
• boards;
• backgrounds;
• cursors;
• music;
• feedback images or videos; and
• other supported user content.

We may also store information relating to an upload, such as:

• original or generated filename;
• file type;
• MIME type;
• file size;
• checksum;
• storage path;
• upload timestamp;
• moderation status;
• reports concerning the asset; and
• account ownership or attribution information.

Uploaded files may themselves contain personal information or embedded metadata. You should avoid including information that you do not wish to provide to Hypercarry Chess or, where the feature permits public sharing, to other users.

Feedback and support information

When you provide feedback or contact us, we may collect:

• your message;
• feedback category or subject;
• contact email if supplied;
• ratings or reviews;
• attachments;
• information about the page or game associated with the feedback;
• browser, viewport, timezone or technical context;
• follow-up communications; and
• internal notes or work items created to address the feedback.

Feedback may in some cases be submitted without a registered Hypercarry Chess account.

Technical and security information

Hypercarry Chess and its infrastructure providers may process information including:

• IP address;
• browser or user-agent information;
• session identifiers;
• hashed security identifiers;
• timestamps;
• request information;
• rate-limiting information;
• security events;
• error information; and
• server or infrastructure logs.

Where practical, Hypercarry Chess uses hashed rather than raw identifiers for certain security and rate-limiting functions.

4. How We Use Personal Data

We may collect, use and disclose personal data where reasonably necessary to:

• create and manage user accounts;
• authenticate users;
• verify email addresses;
• provide password-reset functionality;
• maintain login sessions;
• provide games and gameplay features;
• maintain game records and history;
• operate player profiles;
• maintain user settings and customisations;
• provide titles, achievements and progression;
• store, display and moderate user-uploaded content;
• provide AI-powered features;
• provide customer support;
• process feedback;
• generate internal work items from feedback;
• conduct analytics and understand use of the Service;
• count visitors and understand guest-to-account activity;
• diagnose bugs and technical issues;
• prevent cheating, fraud and abuse;
• detect unauthorised access;
• enforce the Terms of Service and other applicable rules;
• investigate complaints or security incidents;
• maintain the reliability and security of Hypercarry Chess;
• comply with applicable legal requirements;
• establish, exercise or defend legal rights; and
• perform other purposes that are notified to you where required.

We seek to use personal data only for purposes that are reasonably related to operating, protecting and improving Hypercarry Chess or that have otherwise been appropriately notified.

5. Public Profiles and Information Visible to Other Users

Hypercarry Chess contains social and profile features through which information may be visible to other users or members of the public.

At the date of this Privacy Policy, certain profile information may be publicly accessible, including information such as:

• username;
• public UID;
• profile picture;
• gender, where supplied;
• birthday month and day, depending on the available privacy setting;
• biography;
• social links;
• selected titles;
• role or profile indicators; and
• approved user-uploaded customisation assets.

You should therefore treat information placed in publicly visible profile fields as information that may be viewed by other people.

Hypercarry Chess may introduce or expand profile-privacy controls. Where such controls are available, their effect will be described in the relevant interface.

Game history, internal account information, email addresses and administrative information are not intended to be made publicly available merely because a profile exists.

If you deliberately make information or an uploaded asset publicly available, other people may independently save, copy, share or reproduce it. Hypercarry Chess cannot guarantee deletion of copies independently created by other users or third parties.

6. Cookies and Browser Storage

Hypercarry Chess uses cookies and browser-storage technologies to operate the Service.

Authentication

Hypercarry Chess uses an authentication cookie to maintain logged-in sessions.

Authentication session tokens are designed to use security protections including HTTP-only access and server-side token hashing.

Visitor analytics

Hypercarry Chess currently uses a first-party visitor identifier, including through the hypercarryVisitorId cookie and LocalStorage.

This identifier is used for purposes such as:

• counting unique visitors;
• understanding site usage; and
• linking activity performed as a guest with activity after the same visitor logs into an account.

The visitor identifier may remain in the browser for approximately one year unless removed or replaced.

This identifier is pseudonymous and should not be treated as fully anonymous merely because it does not itself contain your name or email address.

Preferences and local state

Hypercarry Chess also uses LocalStorage and SessionStorage for purposes such as:

• interface and visual preferences;
• selected customisations;
• music settings;
• temporary runtime identifiers;
• remembering dismissed prompts;
• feature-unlock states; and
• local reader or interface state.

Some items last only for a browser tab or session, while others may remain until removed by Hypercarry Chess, the browser or the user.

Hypercarry Chess does not currently use a third-party behavioural advertising network.

7. AI-Powered Features

Hypercarry Chess uses services provided by OpenAI for AI-powered functionality, including features such as:

• game commentary;
• direct chess-related chatbot interactions;
• move or position assistance; and
• internal work-item generation from user feedback.

Depending on the feature, information sent to OpenAI may include:

• chess position or FEN information;
• move history;
• game configuration and custom rules;
• commentary context;
• user-entered chatbot messages;
• recent conversation context;
• feedback subject or message;
• information about the page or context associated with feedback; and
• limited information about feedback attachments, such as attachment count or MIME type.

Hypercarry Chess does not intentionally attach your email address, username, Hypercarry Chess UID or internal numeric account ID to ordinary OpenAI prompts.

However, free-form text that you enter may itself contain personal information. You should therefore avoid providing sensitive or unnecessary personal information through AI-powered features.

Uploaded image, video or customisation-file contents are not presently intended to be sent to OpenAI through these features.

Hypercarry Chess configures relevant OpenAI Responses API requests with storage disabled where supported. This does not necessarily mean that OpenAI retains no information whatsoever. OpenAI may process or retain information in accordance with the API data controls, security requirements and account configuration applicable to Hypercarry Chess.

Hypercarry Chess may also retain AI-related information locally as part of game messages, game records, generated work items, troubleshooting records or other functionality.

AI-generated content can be inaccurate, incomplete or inappropriate and should be treated accordingly.

8. Email and Brevo

Hypercarry Chess uses Brevo to send transactional email.

Brevo may receive:

• your email address;
• sender and recipient information;
• email subject;
• email body; and
• verification or password-reset links contained in the message.

Hypercarry Chess currently uses these emails for purposes such as:

• email-address verification; and
• password resets.

Hypercarry Chess does not currently send marketing emails.

If marketing communications are introduced in the future, users will be provided with a separate, optional choice to opt in where appropriate.

Marketing consent will not be required merely to create or retain a Hypercarry Chess account.

A user who has not actively opted in will not be treated as having opted in merely because they accepted the Terms of Service or acknowledged this Privacy Policy.

9. Google and Discord OAuth

Hypercarry Chess supports authentication through Google and Discord.

When you choose an OAuth provider, the provider may supply information to Hypercarry Chess.

For Google, this may include information associated with the requested openid, email and profile scopes, such as:

• Google account identifier;
• email address and verification status;
• display name; and
• profile picture.

For Discord, this may include information associated with the requested identify and email scopes, such as:

• Discord account identifier;
• email address and verification status;
• username or global display name; and
• avatar information.

Hypercarry Chess uses this information primarily to authenticate or link your account.

Google and Discord separately process information associated with your use of their services under their own terms and privacy policies.

10. User Uploads and Moderation

Customisation assets and certain other uploads may be shared with other Hypercarry Chess users where the relevant feature supports public sharing.

Hypercarry Chess may:

• inspect uploads;
• place uploads under review;
• restrict access to them;
• respond to reports;
• remove them;
• retain moderation information; and
• take enforcement action against accounts that misuse upload functionality.

You remain responsible for ensuring that you have the appropriate rights and permissions to upload material to Hypercarry Chess.

User-uploaded content is also governed by the Hypercarry Chess Terms of Service and any applicable upload-specific terms.

11. Service Providers and External Services

Hypercarry Chess relies on third parties to provide parts of the Service.

Depending on the feature and technical configuration, these may include:

Render

Render is used for application hosting, database infrastructure and persistent file storage.

As part of providing infrastructure, Render may process application data as well as technical request information such as IP addresses, request headers, URLs and logs.

Cloudflare

Where Cloudflare proxy, network, security or related functionality is enabled for Hypercarry Chess, Cloudflare may process network and request information such as IP addresses, headers, URLs and security-event information.

Brevo

Brevo processes transactional email as described above.

Google and Discord

Google and Discord provide optional OAuth authentication.

OpenAI

OpenAI processes information required to provide Hypercarry Chess's AI-powered features.

Content-delivery providers

Some pages may load technical resources from third-party content-delivery services, including services used to provide JavaScript or CSS libraries.

Those providers may receive ordinary browser-request information such as IP address, browser or user-agent information and referrer information.

We may change service providers as Hypercarry Chess develops. Where a change materially affects how personal data is handled, this Privacy Policy will be updated where appropriate.

12. Overseas Processing and Transfers

Although Hypercarry Chess is operated from Singapore, some third-party service providers may process or store data outside Singapore.

Where personal data is transferred outside Singapore, Hypercarry Chess will take reasonable and legally required steps to ensure that the transferred personal data receives an appropriate standard of protection.

The precise countries in which a service provider processes information may depend on that provider's own infrastructure and configuration.

13. Data Retention

Hypercarry Chess retains different categories of information for different periods depending on their purpose.

For example:

• authentication and security information may be retained for the period necessary to operate and protect accounts;
• verification and password-reset information may expire after its relevant security purpose ends;
• gameplay records may be retained to provide game history, review, analytics and related functionality;
• profile and account information may be retained while an account remains active;
• user uploads may remain while they are used by the relevant feature or until removed;
• feedback and associated internal work records may be retained while reasonably useful for support, development, auditing or dispute handling;
• moderation, security and enforcement information may be retained where reasonably necessary to prevent abuse or enforce restrictions; and
• server and service-provider logs may be retained according to the relevant operational and provider retention settings.

Some gameplay, feedback, upload and locally stored AI-related records do not presently operate under a single automatic deletion period.

Hypercarry Chess will seek to cease retaining identifiable personal data when the purposes for which it was collected are no longer served by its retention and the information is no longer required for legitimate legal, security or operational purposes.

Where appropriate, information may instead be irreversibly anonymised and retained for statistical, analytical or research purposes.

14. Account Deletion

You may request deletion of your Hypercarry Chess account by contacting us at:

privacy@hypercarrychess.com

Where self-service account-deletion controls are made available, you may also use those controls.

Account deletion may be carried out in stages because account information can be linked to gameplay records, uploads, authentication records, feedback, security information and other parts of the Service.

Our intended deletion approach is that:

• normal account access and public-facing account information are disabled as part of processing the deletion request;
• identifying account information is ordinarily deleted or irreversibly anonymised within three months of the deletion request;
• genuinely anonymised gameplay or analytical information may be retained after identifying links have been removed; and
• limited information may be retained for longer where reasonably necessary for security, fraud prevention, enforcement of bans or restrictions, dispute resolution, legal compliance, or the establishment, exercise or defence of legal rights.

A deletion request does not necessarily require immediate removal of information from technical backups. Backup copies may remain until they expire through normal backup cycles, provided they are not returned to ordinary active use except where reasonably necessary.

Where information has been deliberately made public, Hypercarry Chess cannot remove independent copies made by other people outside the Service.

15. Security

Hypercarry Chess uses technical and organisational measures intended to protect personal data against risks such as unauthorised access, collection, use, disclosure, copying, modification or loss.

Measures used by Hypercarry Chess include, where applicable:

• password hashing;
• hashed authentication-session tokens;
• verification and password-reset token expiry;
• session invalidation;
• CSRF protections;
• rate limiting;
• security-related HTTP headers;
• restricted administrative functions;
• role-based access controls; and
• environment-based handling of application secrets.

No online service can guarantee absolute security.

If you believe your Hypercarry Chess account or personal data may have been compromised, please contact us.

16. Administrative and Developer Access

Authorised Hypercarry Chess administrators may access production user information where reasonably necessary to:

• operate the Service;
• provide support;
• investigate bugs;
• maintain security;
• moderate content;
• investigate abuse;
• enforce applicable rules; or
• respond to legal or privacy matters.

Developers should ordinarily work using dummy, synthetic or test data instead of production personal data.

Where production access is genuinely required for troubleshooting, security or another legitimate operational purpose, access should be restricted to what is reasonably necessary.

17. Access and Correction Requests

You may contact us to request:

• access to personal data about you that is in our possession or control; or
• correction of personal data that is inaccurate or incomplete,

subject to applicable law and any permitted exceptions.

We may require reasonable verification of your identity before providing access or making a correction.

Requests may be sent to:

privacy@hypercarrychess.com

18. Withdrawal of Consent and Privacy Choices

Where Hypercarry Chess relies on your consent for a particular collection, use or disclosure of personal data, you may withdraw that consent by giving reasonable notice.

You may contact us at:

privacy@hypercarrychess.com

We may inform you of the likely consequences of withdrawing consent.

Some processing is necessary to operate an account or provide a requested feature. If you withdraw consent to processing that is necessary for that purpose, we may be unable to continue providing the relevant account or feature.

Withdrawal of optional consent, including any future marketing consent, will not by itself require you to close your Hypercarry Chess account.

19. Data Breaches

If Hypercarry Chess becomes aware of a suspected personal-data breach, we will take reasonable steps to:

• investigate it;
• contain it;
• assess the affected information and users;
• remediate the underlying issue; and
• determine whether notification to affected users or relevant authorities is required.

Where notification is required by applicable law, we will make the required notification.

20. Sale of Personal Data and Advertising

Hypercarry Chess does not sell users' personal data.

Hypercarry Chess does not currently use a third-party behavioural advertising network.

If advertising is introduced in the future and materially changes how personal data is collected, used or disclosed, this Privacy Policy will be updated as appropriate.

21. Changes to This Privacy Policy

Hypercarry Chess may update this Privacy Policy from time to time to reflect:

• changes to the Service;
• new features;
• changes in service providers;
• changes in data practices;
• security developments; or
• applicable legal or regulatory requirements.

The current version, effective date and last-updated date will be displayed on the Privacy Policy page.

Where a change materially affects how personal data is collected, used or disclosed, we may provide additional notice or seek consent where required.

Historical policy versions may be retained for record-keeping purposes.

22. Contact and Data Protection Officer

For privacy enquiries, complaints, requests concerning your personal data, or other questions relating to this Privacy Policy, contact:

Chia Meng Hioke
Data Protection Contact / DPO, Hypercarry Chess
Email: privacy@hypercarrychess.com

Hypercarry Chess is currently operated personally by Chia Meng Hioke and is not presently operated through a separate incorporated legal entity.