Privacy policy
Last updated: 5 October 2026
This policy explains which personal data Vetta processes, why, for how long and what you can do about it. It covers Vetta on vettachess.com and in our iOS and Android apps (see The iOS and Android apps). We will update it before new features open (such as school accounts).
Who is responsible
The controller of your personal data is AXIOM TRAIL - FZCO, IFZA Business Park, Building A1, Dubai Silicon Oasis, Dubai, United Arab Emirates. For anything about privacy, write to privacy@vettachess.com.
In short
- You can play without an account. We then keep an anonymous guest profile, with no name and no email address.
- Under 13, there is no account at all: you play against the AI and two players on one device, nothing online, and we never ask for an email address (see Age bands and minors).
- The same policy covers the website and the iOS and Android apps.
- In the European Economic Area, the UK and other countries with similar laws, Google Analytics runs only if you accept it; elsewhere it runs until you opt out. It receives page paths, how you arrived (campaign tags) and a few events about what you do in Vetta, never your name or email address.
- We also keep our own product statistics on our servers, to see how Vetta is used and test improvements: never shared, never for ads, and you can turn them off.
- We do not sell your data and we do not show ads.
- Purchases, once the store opens, are for people aged 18 and over. Payments go through Stripe: we never see your card.
- Ivory, the currency you earn by playing, is kept as a balance and a history of what you earned and spent, for as long as your account exists.
- News and offers by email only if you are 18 or over and ask for them. Every one of those emails lets you unsubscribe in one click.
- Our servers are in the European Union (Paris, France).
- You can download your data or delete your account at any time in Settings. A deleted account is switched off at once and permanently deleted after 30 days, unless you sign in again before then.
What we collect
- Account. Your email address or, if you sign in with Google or Apple, the identifier they give us, the email address they share with us and whether it is verified. With Google we also receive your name and the address of your profile picture; with Apple, your name the first time you sign in, if you share it. We never ask for a password.
- Profile. Your handle, display name, avatar, language, time zone (for the daily streak) and privacy settings, such as who can watch your games and whether people who are not your friends see your handle or your name (see How others see you), and whether your opponents’ chat starts muted in every game. Your ranking settings: whether you are shown in the rankings, the country shown there if you choose one, and when you saw the notice that rated games are public.
- Age. Your year of birth, never the full date, and the age band it puts you in: under 13 (no account), under 14, under 18 or adult (see Age bands and minors). If you confirm a year under 13, only that year is kept with your guest profile.
- Play. Your games against the AI (moves, result, time control, AI level, detected opening and date), ratings, puzzles, lesson and Flow progress, experience points, daily streak and missions, your progress on the weekly calendar (the step you are on, the weeks completed, and the day and reward of your last step), and the boards and pieces you own and equip. If you play as a guest, this data is linked to your guest profile.
- Replay links. If you share a finished game as a link: which game, the link and when you created or stopped it. Anyone with the link sees the final position and the result; only people with a Vetta account see the moves. Names appear only for adults with a public profile. You can stop sharing at any time, and the link stops working at once. Guests (so everyone under 13) and school accounts cannot create links.
- Anonymous games. If a finished game against the AI reaches us without any profile, we store only the game itself (moves, result, level and time control), with no link to a person.
- Blocks. The players you block and when you blocked them. We do not tell the person you block.
- Reports and muting. The reports you make and those made about you, and the online games in which you muted your opponent’s chat. See Reports and muting.
- Waitlist. If you join it: your email address, language, the form you used and the date.
- Technical and security data. Your IP address and browser details (user agent) on every request. For each session: the IP address and browser it started from, the platform (web, iOS or Android) and when it expires. When your profile is created: the country your connection comes from (two letters, derived from your IP address by Cloudflare), the platform and, if there is one, a short tag saying how you arrived (for example, a friend invite). We also record the platforms you use and when you were last active.
- Security log. For sign-ups, sign-ins (including failed ones), sign-in codes and links asked for, sign-outs, requests to delete or keep your account and store checkouts: the action, the time, the IP address, the country it comes from and a coarse label of the browser and system (such as “Chrome on macOS”, never the full user agent). See Security log.
- How you arrived. When you start as a guest or create an account on the web, we keep with it the campaign tags of the link that brought you (such as utm_source or utm_campaign), the first page you opened and the site you came from (domain only), if there were any.
- Analytics and ads measurement, with your consent or until you opt out, depending on your country. See Analytics and Ads measurement.
- Product statistics. How you use Vetta, with your type of device, operating system, language, country at that moment, type of account, age band and random identifiers. See Product statistics.
- Bring your friends. If you create your account from a friend’s invite link: who invited you, when you joined and whether your first game counted. If you invite friends: how many joined and counted (you never see who) and the rewards you received (items, Ivory and vouchers). To prevent fraud we compare, at sign-up, the network and browser of your session with those of the person who invited you, and your email address, in a normalised form, with other accounts.
- Ivory. Your Ivory balance and every entry of it: the amount earned or spent, why (a mission, a first win of the day, a lesson, a new level, a streak, a day of the weekly calendar, a season reward, the Workshop, a correction by us or a reversal after a refund), a reference to what it was for, the balance after it and the date.
- Profile items. The profile images, frames and titles you own (and where they came from: a season, the Workshop, a founder game) and the ones you show. They are shown to other players with your name, like your avatar.
- Purchases. If you buy something once the store is open: see Purchases and payments.
- News by email. Whether you want news and offers by email and, each time you turn them on or off: the date, where (in Vetta, or with the unsubscribe link of an email), the language the choice was shown in, the version of this policy, your IP address and your browser. Also which of those emails we sent you and when.
- Notifications. Your inbox in Vetta (what each notification was about, who caused it and whether you read it), your notification settings and, if you allow push notifications on a device, that device’s push address. See Notifications.
- Emails. The emails we send you and any message you send us.
- In the apps. The same data as on the website, plus, if you allow notifications, your device’s push token, and, depending on your country, Firebase Analytics data. See The iOS and Android apps.
Why we use it and on what legal basis
Where we rely on legitimate interest, you can object (see Your rights). We do not sell your data. Google Ads can measure whether our own ads brought you, as explained in Ads measurement.
Playing without an account
When you start a game without an account, Vetta creates an anonymous guest profile on our servers so that your games and collection can be kept. It has no name and no email address. A token stored in your browser identifies it (see the Cookies policy).
The iOS and Android apps
The Vetta apps for iPhone, iPad and Android are run by the same controller, use the same account and servers as the website, and follow this policy. What is different:
Security log
To protect accounts and prevent fraud, we keep a log of security actions: sign-ups, sign-ins (including failed attempts), sign-in codes and links asked for, sign-outs, requests to delete or keep an account, and store checkouts. Each entry holds the action, the time, the IP address, the country it comes from (from Cloudflare) and a coarse browser label (for example “Chrome on macOS”), never the full user agent. Entries are linked to your account when there is one.
Product statistics
Besides Google Analytics, Vetta keeps its own product statistics: a record of how Vetta is used, to count active players, see what works, fix what does not and compare two versions of a screen (A/B tests). They are separate from Google Analytics and Google Ads: they stay on our servers (Amazon Web Services, Paris), are never shared with or sold to anyone and are never used for advertising.
Analytics
In the European Economic Area (the EU, Iceland, Liechtenstein and Norway), the United Kingdom (with Gibraltar, Jersey, Guernsey and the Isle of Man), Switzerland, Brazil, Canada, South Korea, Turkey, South Africa, India and China, and whenever we cannot tell which country the visit comes from, we use Google Analytics 4 only if you accept analytics in the cookie banner. Until then, nothing is loaded from Google.
Ads measurement
While we advertise Vetta with Google Ads, ads measurement follows the same rule as analytics: in the European Economic Area (the EU, Iceland, Liechtenstein and Norway), the United Kingdom (with Gibraltar, Jersey, Guernsey and the Isle of Man), Switzerland, Brazil, Canada, South Korea, Turkey, South Africa, India and China, and when the country is unknown, only if you accept it in the cookie banner; elsewhere it runs by default and you can opt out. Google Ads then receives that you arrived from one of our ads (the ad click identifier in the link) and that you then created an account or joined the waitlist. For an account, your email address is sent to Google hashed, so Google can match it with the ad click (enhanced conversions). With the same consent, or until you opt out, Google may show our ads again to people who visited Vetta.
Emails
Emails about your account are sent whatever you choose: the sign-in code you ask for (with the link, on the web), a welcome email when you create an account, and account deletion emails (the confirmation link, if you ask for one, and a notice with the date your account will be permanently deleted, and a last one once it is). All our emails are sent through Amazon SES from an @vettachess.com address.
News and offers by email
If you are 18 or over, you can ask us to email you news: new seasons, sets, offers and other Vetta news. We write occasionally. It is optional, and Vetta works the same without it.
Purchases and payments
When the store is open, which we announce first, you can buy collection items and season passes. Purchases are only for people aged 18 and over with an account (see Purchases in the Terms of use).
Who we share it with
We use these providers. They process data on our behalf and following our instructions, except that Google and Apple are also responsible for the account you have with them to sign in, and Stripe for its own legal duties (see Purchases and payments).
How others see you and shared links
People who are not your friends see you by your handle everywhere in Vetta: opponents in quick play or through a link, spectators, visitors of your profile, the rankings, game histories read by others, and the links below. They see your display name only if you are 18 or over and choose Show my name in Settings › Privacy › How others see you. Your friends see your display name; accounts under 18 and school accounts are always shown by their handle, also to friends during a game.
Rated games
Rated games follow automatic rules that keep them fair (see also Fair play):
Reports and muting
In an online game you can mute your opponent’s chat (their phrases and gestures), for that game from their menu or the mute button beside their clock, or for every game with Mute chat in every game in Settings. Their messages are then not shown to you, but they are still stored with the game like any chat message, so our moderators can read them if the player is reported. The muted player is not told. Chat messages are kept for 30 days.
Notifications
Vetta tells you about what concerns you: a friend challenged you or accepted your challenge, a friend request, a game found, a rematch offer, your daily reward or streak, a season starting or ending, a report you made having been reviewed and, only if you ask for them, offers from the store. Guest profiles get them too, except under 13: no notifications at all. In the apps, push notifications go through Apple or Google (see The iOS and Android apps).
International transfers
Our servers and database are in the European Union (Amazon Web Services, Paris).
How long we keep it
- Account data: while your account exists. When you delete it, it is switched off at once and erased 30 days later (see When you delete your account).
- Rankings: your place on the rating rankings is recalculated from your account data every 10 minutes; experience points among friends are read from your account when the page is opened, not stored again. Hiding from the lists or deleting your account removes you at once.
- Sessions: a session stops working after 90 days (365 days for guest play, 7 days for staff). Signing out deletes it.
- Sign-in codes: a 6-digit code, single-use, valid for 10 minutes and for at most 5 tries; asking for a new one cancels the previous one. We store only a one-way hash of each code (keyed with a secret of ours), with the email address it was sent to and the date, and delete these records after 2 days.
- Sign-in and deletion links: single-use and valid for 15 minutes (sign-in) or 1 hour (deletion). We store only a one-way hash of each link, with the email address it was sent to and the date. Signing in to an account waiting to be deleted gives your browser a code to keep it: single use, valid for 15 minutes, stored the same way and never emailed.
- Security log: 90 days for each entry; erased with your account (see Security log).
- Guest profiles and anonymous games: no automatic deletion date yet (see Playing without an account).
- News by email: your choice and its history while your account exists (see News and offers by email).
- Ivory and profile items: your balance, its history and your profile items while your account exists; they are erased with it.
- Purchases: 10 years after each purchase, also after you delete your account, then without any link to it (see Purchases and payments).
- Waitlist: until you remove yourself (one click in the opening email) or ask us to, or until the list is no longer needed for its purpose.
- Usage limits: counters kept in our server’s memory for one hour at most.
- Server logs: requests (IP address, date, address requested and browser) are logged for a limited time, for security and troubleshooting.
- Analytics: see Analytics.
- Product statistics: raw events for 25 months, then only aggregate figures that identify no one; the install identifier in your browser is replaced every 13 months (see Product statistics).
- Chat in online games: 30 days. Reports: as long as moderation needs them, unlinked from a deleted account (see Reports and muting).
- Notifications: 90 days in your inbox. A device’s push address until you turn notifications off there, sign out there, the push service drops it or you delete your account (see Notifications).
When you delete your account
When you delete your account in Settings (or with the deletion link we can email you), it is switched off at once: you are signed out everywhere, and other players no longer see your profile, nor find you in friends lists, rankings or invites. We email you the date it will be permanently deleted, 30 days later.
Your rights
You have the right to access your data, correct it, erase it, restrict or object to its use, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time; this does not affect what was done before.
Age bands and minors
Vetta has three age bands, from the year of birth you tell us. We keep only the year. Because the year alone does not tell us whether your birthday has passed, we count you in the younger band until 1 January of the year after the one in which you reach the age.
Delete your account
You can delete your Vetta account, and the data that goes with it, at any time, from the website or from the iOS or Android app:
Security
We protect your data with encrypted connections (HTTPS), store session and link tokens only as one-way hashes, and limit staff access to what each person needs; staff sessions expire after 7 days. We keep a security log of sign-ins and other sensitive actions for 90 days. No system is completely secure: if a breach puts your data at risk, we will tell you and the authorities as the law requires.
Automated decisions
We do not take decisions about you based solely on automated processing that have legal effects on you or affect you in a similarly significant way. Some protections work automatically: the age bands (no account under 13, and the protections for minors), the usage limits and Turnstile check, which can briefly block a request, and the rules of Rated games, which can play a game as casual or make you wait a few minutes before searching again. When rated play opens, games may be flagged automatically for fair play, but a person always reviews a flag before any action, and you can appeal.
Changes to this policy
We will publish any change here with a new date and version. If a change affects how we use your data, we will tell you in Vetta or by email before it applies.
Contact
privacy@vettachess.com · AXIOM TRAIL - FZCO, IFZA Business Park, Building A1, Dubai Silicon Oasis, Dubai, United Arab Emirates.