Privacy Policy

Last updated: September 2026

Playing without an account

You can play without signing in. Connecting offers “Continue as guest”, and a guest is identified only by a random, opaque token that carries no account. For a guest we handle:

• A display name you choose when entering the lobby, not tied to any identity
• Game state: board positions, move history, time-control clocks
• Lobby presence: which players are online and available for invites

If you sign in

Signing in with Max Health is optional and exists so that a rating and a match history can mean something. It is handled over OAuth against the Max Health identity provider, and we then store:

• An account record with an internal id and the verified email address used to identify you
• The identity link to your Max Health account, and a session for as long as you stay signed in
• Your claimed handle, your ELO rating, and your finished games
• OAuth authorization codes and refresh tokens, which are stored hashed and encrypted at rest

You can play as a guest indefinitely and never create any of the above.

Analytics

We count page views with our own first-party analytics. It sets no cookies and uses no local storage, so there is nothing to consent to. Your IP address and user agent are never stored: they are mixed into a keyed digest whose salt rotates every day, which means the same visitor is a different value tomorrow and the value cannot be reversed or used to follow anyone over time.

Game analysis from other sites

When you ask for analysis of a chess.com or Lichess handle, we request that player’s publicly available games from that site’s API. We send only the handle you asked about. We do not connect to your account on those sites and never ask for credentials to them.

Data storage & retention

Live games and lobby presence are held in Cloudflare Durable Objects and cleaned up automatically:

• Stale players are removed from the lobby after 5 minutes of inactivity
• Pending invites expire after 2 minutes
• Abandoned games are cleaned up after 30 minutes

Account records, ratings and finished games persist until you ask us to delete them. Write to the address below and we will remove your account and its games.

What we never collect

• No passwords. Authentication happens at the Max Health identity provider, never here
• No payment details; the service is free
• No health data of any kind
• No advertising, no third-party trackers, and no sale or sharing of data with advertisers
• Nothing is used to train machine-learning models

Third-party services

The application runs on Cloudflare Workers, which processes requests under its own privacy terms. Sign-in goes to the Max Health identity provider. Game analysis may call the public chess.com or Lichess APIs as described above. No other third party receives your data.

Children’s privacy

The service is not directed to children under 13, or the equivalent minimum age in your jurisdiction, and we do not knowingly collect their personal information.

Changes to this policy

We may update this policy to reflect changes in the application. The “last updated” date above will be revised accordingly.

Contact

Max Health Inc.
8 The Green Ste B, Dover, DE 19901, US
Email: hello@maxhealth.tech

Governing law

This policy is governed by the laws of the State of Delaware, United States.