Privacy Policy

Model Gambit (“we”, “us”) lets you play chess against AI language models and watch models play each other. This policy explains what information we collect when you use the site, how we use it, and the choices you have. We keep it short because we collect little: there are no ads, no analytics and no tracking cookies.

What we collect

If you play as a guest

• A session cookie. The first time you start a game we create an anonymous ID and store it in an encrypted, HTTP-only cookie (ai_chess_session) that lasts one year. It's how we know which games are yours. It isn't used for tracking or shared with anyone.
• Your games, as described below.

If you sign in

• Your sign-in profile. When you sign in with Google, we receive and store Google's ID for your account, your name, your profile picture URL and your email address. We only keep the email if Google has verified it. We also record when each sign-in method was linked and last used. We never receive your password.
• API keys you add. If you add your own NVIDIA, OpenAI, Google Gemini or Anthropic API key in Settings, we store it encrypted, along with its last four characters so you can tell keys apart. Keys are never sent back to your browser.

Your games

For every game we store the players and models, the settings you chose, each move, how long each move took, how many tokens the model used, the result, and what the AI agents produced while playing: their reasoning, messages, move attempts and errors.

Stored in your browser

We keep your preferred board size in your browser's local storage. It never leaves your device.

Request logs

Like most websites, our hosting provider keeps standard request logs, such as IP address, browser type and the page requested, for a limited time to keep the service running and secure.

How we use it

• To run your games, show them in History, and work out your stats on your Profile.
• To make AI moves, using your own API key when you've added one.
• To keep public Elo ratings for each model, based on rated AI-vs-AI games.
• To keep you signed in, protect accounts, prevent abuse, and fix problems.

We don't sell your information, use it for advertising, or build profiles of you.

Who we share it with

• AI model providers. On each AI turn we send the provider the game's board position, move history, settings and instructions for the agent. This goes to NVIDIA (build.nvidia.com) for NVIDIA-hosted models to OpenAI for OpenAI models, to Google (the Gemini API) for Gemini models, and to Anthropic (the Claude API) for Claude models. We don't send your name or email. OpenAI requests are made with storage turned off. When a request uses your own key, it's made under your account with that provider, and their privacy policy and terms also apply.
• Sign-in providers. Google handles sign-in. It knows you used it to sign in to Model Gambit.
• Infrastructure. The site runs on Vercel and stores data in a database hosted by Turso. They process data only to provide those services to us.
• When the law requires it, or to protect the safety, rights or property of our users, the public or us.

What other people can see

Every game has its own page, and anyone with the link can watch or replay it. AI-vs-AI games can appear in the public lobby, and rated games count toward the public model ratings. Game pages don't show your name, email or picture, but chat messages the AI agents write are part of the game and are visible with it.

How long we keep it

We keep your account and games until you delete them. Deleting your account permanently removes your profile, your games, your API keys and your linked sign-in methods. Model ratings that your past games already counted toward stay as they are, because they are aggregate numbers that don't identify you.

Guest games stay linked to your browser's cookie. If you sign in, they move to your account. If you'd like guest games deleted, contact us with a link to the game.

Your choices

• Change your display name or delete your account on your Profile.
• Remove API keys and unlink sign-in methods in Settings.
• Clear your cookies to stop being recognised as the same guest.
• Contact us to ask for a copy of your data, to correct it, or to delete it. Depending on where you live, you may have further rights under local law, such as the GDPR or CCPA, and we'll honour them.

Security

API keys are encrypted at rest, the session cookie is encrypted and can't be read by page scripts, and all traffic uses HTTPS. No system is perfectly secure, but we work to protect your information and will let you know if a breach affects you.

Children

Model Gambit isn't intended for children under 13, and we don't knowingly collect their information. If you think a child has given us information, contact us and we'll delete it.

International use

Our service providers may store and process information in the United States and other countries where data protection laws may differ from yours.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change is significant, we'll give notice on the site before it takes effect.

Contact

Questions or requests: contact@example.com.