Privacy Policy (legal version)
Last Updated: October 20, 2026
This Privacy Policy describes how HESTIAS CREATIONS LLC collects, uses, discloses and retains personal information in connection with Hestia Games. A plain-language version, organized in the same numbered sections, is published alongside it. The two versions are intended to have the same meaning. In the event of any inconsistency or ambiguity, the interpretation more protective of the user's privacy shall prevail.
1. Scope and Controller
This Privacy Policy applies to the website at games.hestiascreations.com, the associated applications and the related services (collectively, the "Service"). The Service is operated by HESTIAS CREATIONS LLC, an Oregon limited liability company ("Hestia's Creations," "we," "us" or "our"), which determines the purposes and means of processing the personal information described in this Privacy Policy. Capitalized terms not defined here have the meanings given in our Terms of Service.
2. Summary of Commitments
(a) We collect only the personal information reasonably necessary to provide the Service.
(b) We do not display advertising, and we do not use third-party tracking technologies, analytics services or advertising identifiers.
(c) We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under California law and comparable state laws.
(d) You may delete your Account at any time through the Service.
3. Use of the Service Without an Account
3.1 The free games operate on your device. Game progress and preferences are stored in your browser's local storage on that device and are not transmitted to us, except where an Account holder elects under Section 4 to store copies of game progress with the Account. A cached copy of the games is stored on your device to permit offline use.
3.2 Our web server automatically records technical log data for each request, consisting of the IP address, the requested resource, the user-agent string and a timestamp. We process this data solely to operate, maintain and secure the Service, and delete it within fourteen (14) days of collection.
4. Personal Information Collected From Account Holders
4.1 When you create and use an Account, we collect and process the following categories of personal information, for the purposes stated:
| Category | Purpose |
|---|---|
| Identifiers: email address | Authentication; delivery of renewal reminders required by law; service notices |
| Age attestation: confirmation of age 13 or older, and its date | Compliance with the Children's Online Privacy Protection Act ("COPPA"). Month and year of birth are processed transiently to determine eligibility and are not retained |
| Identifiers: username | Identification of the User to other Users and Household members |
| Session token, stored in a first-party cookie | Maintaining an authenticated session for up to ninety (90) days |
| Commercial information: plan, Membership dates and status, and payment processor customer identifier | Administration of the Membership and determination of Retained Releases |
| Household associations | Administration of shared Memberships. No address information is collected |
| Complimentary Membership records, including the stated reason | Administration of complimentary Memberships |
| Records of consent to automatic renewal | Compliance with California Business and Professions Code § 17602, which requires retention for three (3) years or one (1) year following termination of the Membership, whichever is longer |
| Copies of game progress, only where the User elects to store them with the Account | Restoring game progress on the User's other devices. Deleted upon withdrawal of the election |
| Online chess data: game records, ratings, fair-play reports made by or about the User, weekly challenge results, and preferences, including reminder settings and an optional country designation | Operation of online chess and enforcement of fair-play rules |
| Friend connections, friend requests and the User's friend code | Displaying weekly challenge results among Users who have each agreed to the connection |
| Weekly challenge results in all games, and reactions given and received | Operation of weekly challenge leaderboards |
| Reports concerning usernames, made by or about the User | Moderation of usernames. The identity of a reporting User is not disclosed to the reported User |
4.2 We do not collect passwords, payment card numbers, legal names, postal addresses, telephone numbers, dates of birth, precise geolocation, contact lists or advertising identifiers.
5. Payment Information
Payments are processed by Stripe, Inc. and its affiliates ("Stripe"). Payment card data and billing information are collected directly by Stripe and are not received or stored by us. Stripe provides us with the payment status, plan and billing dates associated with your Membership. Stripe's processing is governed by its privacy policy, available at stripe.com/privacy.
6. Communications
We send transactional communications, including authentication codes, automatic renewal reminders, payment receipts (sent by us or by our payment processor on our behalf) and notices concerning your Account or Membership. Users of online chess may receive turn reminders, which may be disabled in chess settings. We do not send marketing communications. Any future marketing communications will be sent only to Users who opt in.
7. Information Visible to Other Users
7.1 The following information is visible to other Users: your username; your online chess game records and results; your chess ratings; and your position on leaderboards and in weekly challenges. Your best weekly challenge result in each game is visible to your Friends and Household members, and to all Users only in games for which our server verifies the complete game record. Reactions to your results are visible to your Friends and Household members. The identity of a User who reports a username is not disclosed.
7.2 A country designation is displayed only if you elect to display one.
7.3 Members of a Household can view the usernames of the other members of that Household.
7.4 Email addresses and Membership details are not disclosed to other Users.
8. Service Providers
8.1 We disclose personal information to the following service providers, which process it on our behalf and solely to provide their services to us:
| Service provider | Service | Personal information processed |
|---|---|---|
| Hetzner Online GmbH (Germany) | Server hosting | All personal information described in Section 4 |
| Stripe, Inc. (United States) | Payment processing | Payment and billing information; email address |
| Google LLC, Google Workspace (United States) | Email delivery | Email address and the content of emails we send |
8.2 If you purchase a Membership through Google Play, the Apple App Store or another third-party platform, that platform processes your payment information under its own privacy policy.
9. Cookies and Similar Technologies; Do Not Track
The Service uses a single, strictly necessary first-party cookie to maintain an authenticated session. We do not use advertising, analytics or third-party cookies, and we do not track Users across third-party websites or online services over time. Accordingly, the Service does not alter its practices in response to Do Not Track signals or the Global Privacy Control, because no tracking occurs to which such signals would apply.
10. Other Disclosures
We disclose personal information only:
(a) to the service providers identified in Section 8;
(b) where required by law, regulation, subpoena, court order or other valid legal process;
(c) where we believe in good faith that disclosure is necessary to protect the safety of any person, or to detect, prevent or address fraud, security incidents or technical issues; and
(d) in connection with a merger, acquisition, reorganization or sale of all or part of the Service, provided that the recipient is bound by this Privacy Policy, and that we notify affected Users by email before their personal information becomes subject to a different privacy policy.
11. Children's Privacy
The free games may be used by children of any age without an Account and without the collection of personal information. The Service does not knowingly collect personal information from children under thirteen (13). The registration process uses a neutral age screen. If a prospective User indicates an age under thirteen (13), no Account is created, and the email address provided is deleted. If we learn that we have collected personal information from a child under thirteen (13), we will delete it promptly. A parent or guardian who believes that we have collected personal information from a child under thirteen (13) may contact us at the address in Section 17.
12. Data Retention
12.1 We retain personal information for the following periods:
| Category | Retention period |
|---|---|
| Authentication codes | Expire ten (10) minutes after issue; deleted within one (1) day of expiry |
| Session cookie and session token | Up to ninety (90) days after the User's last activity |
| Household invitation codes | Seven (7) days |
| Web server log data | Fourteen (14) days |
| Account data | Until the Account is deleted |
| Copies of game progress | Until the User withdraws the election to store them, or the Account is deleted |
| Records of consent to automatic renewal | Three (3) years from the date of consent or one (1) year following termination of the Membership, whichever is longer, after which they are deleted. Upon Account deletion, retained only in association with the payment processor customer identifier, without the email address |
| Backups | Up to thirty (30) days |
12.2 Upon deletion of an Account, we promptly delete the associated email address, username, Membership records, Household association and chess ratings, and instruct Stripe to delete the associated customer record. Records of completed online chess games are retained for the benefit of the other participants, with the deleted User identified only as "deleted player." Stripe retains transaction records as required by applicable law.
13. Your Rights and Choices
13.1 Subject to applicable law, you may: (a) access the personal information we hold about you, through your Account page or by request for a copy; (b) correct inaccurate personal information, including by changing your username on your Account page or requesting a change of email address; (c) delete your personal information by deleting your Account through your Account page; and (d) disable optional communications, including chess turn reminders. Authentication codes and automatic renewal reminders are necessary to the Account and, in the case of renewal reminders, required by law.
13.2 Residents of certain states have rights under state privacy laws. We extend the rights described in this Section to all Users, regardless of state of residence. We will respond to verifiable requests within forty-five (45) days. If we decline a request, you may appeal by replying to our response, and we will notify you in writing of the outcome of the appeal. We will not discriminate against any User for exercising these rights.
14. Security
We protect personal information using reasonable administrative, technical and physical safeguards, including encryption in transit by Transport Layer Security and storage of authentication codes and session tokens only as cryptographic hashes. Access to production systems is restricted to the personnel who operate the Service. In the event of a security breach affecting your personal information, we will notify you as required by applicable law, including Oregon Revised Statutes § 646A.604.
15. Location of Processing
Our servers are located in Germany. Our payment processor and email delivery provider process personal information in the United States. By creating an Account, you acknowledge that your personal information will be processed in those countries.
16. Changes to This Privacy Policy
We will notify Account holders by email at least thirty (30) days before any material change to this Privacy Policy takes effect, and will update the Effective Date above.
17. Contact
Privacy questions and requests may be sent to games@hestiascreations.com. HESTIAS CREATIONS LLC, Oregon, United States.
Portions of this Privacy Policy are adapted from the policies of 37signals LLC (github.com/basecamp/policies), licensed under the Creative Commons Attribution 4.0 International License, and have been modified.