Privacy

What we store about you

• A random identifier created in your browser the first time you arrive, kept in local storage under nine-mills.player.v1. It is not derived from anything about you or your device.
• Your handle, and the date you started playing.
• A two-letter region, for the flag beside your name. It is guessed from your browser's language setting — we do not look up your IP address, so it is often wrong, and nothing depends on it.
• Your rating, your peak rating, how many games you have played, your coin balance, and the list of changes that produced it.
• Every game you finish: the moves, the result, who you played, the time control, and how long each move took.
• If you sign in: your email address, and — for Google or Microsoft — the identifier that provider uses for you, so we recognise you next time. We ask those providers for your address and nothing else: not your contacts, not your calendar, not your files. We do not keep the profile photo they offer.
• If you sign in: a session, so you stay signed in. It is a cookie your browser sends only to this site, and it records the date, your browser's user-agent string and the IP address the request came from — the ordinary record of a login, kept so that a session can be ended if an account is taken over.

Move timing is stored for one reason — it is the main signal for finding somebody running an engine — and it is not used for anything else.

What we do not store

No password — there is none to store, because signing in is a code we email you or a provider you already trust. No IP-based location. No advertising or cross-site trackers. No third-party analytics: today nothing you do here is reported to another company, and if that ever changes this page changes first.

Playing as a guest uses local storage rather than cookies, so there is no email address at all until you decide there should be. Signing in adds one cookie, for the session. Nothing we store is readable by another website, and none of it follows you off this one.

Signing in on a device you have been playing on brings that history with you — the rating and the games move to your account and the guest record is deleted. If the account already had games of its own, we keep those and leave the guest record where it is rather than merging two histories, because there is no honest way to combine them.

What other people can see

Your handle, rating, and finished games are public — a finished game has its own page that anyone can open and replay. That is the point of a rating: it only means something if it can be checked. Your coin balance and the region guess are shown on your own profile.

Deleting your data

Clearing your browser storage abandons a guest account, but it does not delete anything on our side, because we can no longer tell which account was yours. To have it deleted, email hello@ninemills.com from the address you signed in with, or send us your player page link.

When we delete an account we remove the handle, region, rating and coin history. The games themselves stay, with your name replaced, because each one is also somebody else's game and they are entitled to keep their own record of it.

Children

Nine Mills is not intended for children under 13, and we do not knowingly keep data about them. If you believe a child has created an account, email us and we will remove it.

Where the data lives

Nine Mills runs on third-party hosting and a hosted database. While the site is in beta we have not settled on a provider or a region; we will name both here before it leaves beta rather than describe an arrangement that is not yet true.

Changes and contact

Substantive changes move the date at the top of this page. Anything you want to ask goes to hello@ninemills.com. The rules of using the site are on the terms page.