Privacy Notice
Last updated 2 August 2026
Tip Chess is a chess game. It needs to know almost nothing about you, and this page is all of what it does know. No tracking, no advertising, no analytics, and nothing sold or shared.
This game sets no cookies. Not one. It keeps five small values in your browser's local storage so you stay signed in - all five are listed below, and you can clear them yourself. None of them track or profile you, which is why there is no cookie banner to click through.
Who is responsible
Tip Chess is operated at tipchess.com by Nimiq Labs Ltd, a private limited company registered in the United Kingdom under company number 11553320, at Kemp House, 128 City Road, London EC1V 2NX, United Kingdom. We are the data controller for everything on this page. Email info@nimiq.com.
What we store, and why
On our server
One record per player. It holds:
- Your Nimiq address - this is your account. It carries your rating and name to any device you sign in from, draws your identicon, and is where a thank-you goes.
- Your display name - whatever you typed, up to 20 characters, changeable at any time in Settings.
- A public key, and a note that you proved the address - when your wallet signs our sign-in challenge we keep the key it signed with, so nobody else can claim your address, rating or thank-yous.
- Any other accounts your wallet reports - Nimiq Pay pays from whichever account is active, so a thank-you often arrives from an address you never signed in with. The list answers one question: was that you who paid?
- Your record - rating, games, wins, draws, losses, the total received in thank-yous and how many.
- Two timestamps and two random identifiers - when the record was made and when you were last seen; a player id, and a secret that lets your device reconnect without asking your wallet to sign again. The secret is only ever sent back to you.
We also keep which players have finished a game against each other and when, so a thank-you between two people who really played can be recognised, and the hashes of thank-yous already counted, so none is counted twice.
While you are connected
Your IP address is processed for as long as the game is open - that is how our moves reach you - and appears in ordinary server logs, which also record sign-ins and finished games and so contain display names and Nimiq addresses. We build no profile from them.
Your opponent never learns your IP address. Every move goes through our server rather than directly between the two of you. An earlier version opened a direct browser-to-browser connection, which is faster but hands each player's public IP to the other as an unavoidable part of setting it up. That was removed for this reason, and there is no setting to turn it back on.
On your device
Five values in local storage. That is not a cookie - it is never attached to a request and no other site can read it - but it is still storage on your device, so here is all of it:
chess.walletConsent- when you agreed to this notice, so you are not asked again every visit.chess.playerId- your player id.chess.playerSecret- the reconnect secret.chess.playerName- your display name, so the box is filled in next time.chess.verifiedAddress- the address this device has already proved.
All five keep you signed in. Clearing your browser's site data for tipchess.com removes them; your record on the server is untouched, and signing in with the same wallet picks it up again.
On the Nimiq blockchain
A thank-you is paid by Nimiq Pay and recorded on the Nimiq blockchain: sending address, receiving address, amount, time, and your message if you wrote one. That record is public, worldwide and permanent.
Nobody can delete it - not you, not us, not Nimiq. Treat anything you type into a thank-you as published, and send only from an address you are content to have publicly tied to this game.
What we never have
- Your private keys or recovery phrase. They stay inside Nimiq Pay and are never exposed to a Mini App. The game cannot move your funds and could not be made to.
- Your balance or transaction history. We look up single payments to confirm a thank-you arrived. We never read your account.
- Your email, phone number, real name, date of birth or location. None of it is asked for and there is nowhere to enter it.
- Anything from other sites. No advertising identifiers, no fingerprinting, no cross-site tracking. Even the typeface is served from our own server, so loading the page tells nobody else you were here.
Who else sees it
Your opponent
When a game starts, each player is sent the other's display name, rating, number of games and Nimiq address. The address has to be shared - without it there is no identicon and nowhere for a thank-you to go. Your IP address is not.
Anyone at all
The support leaderboard is public and needs no sign-in. It lists
the top 25 players who have received a thank-you, showing each one's display name,
Nimiq address, total received, number of thank-yous, rating and win/draw/loss
record. It is also readable as plain data at /api/leaderboard. If you
would rather not appear under a name that identifies you, change your display name
in Settings - the leaderboard follows it.
A block explorer
To confirm a thank-you really happened, our server checks the chain rather than taking a player's word for it. By default that check goes to the public explorer API at api.nimiq.watch, which sends it your Nimiq address and the transaction hashes being checked. It happens shortly after you finish a game, whether or not any thank-you was sent, because the server has to look in order to find out. Nothing about your display name, rating or device is sent.
Our hosting provider
The game and its data are hosted on Railway, which processes them on our instructions alone. Its servers may sit outside the UK and the EEA; those transfers rely on the UK Addendum and the EU Standard Contractual Clauses.
Nobody else
Nothing is sold or shared for advertising. We disclose data only where the law requires it.
Cookies, analytics and tracking
There are none. No cookies of any kind, no analytics, no advertising, no tracking pixels, no third-party scripts, and no fonts or resources loaded from anyone else's server. There is nothing to consent to and no preferences to manage, which is why you were never shown a banner.
If that ever changes we will ask first, in plain words, and you will be able to say no and carry on playing.
Why we are allowed to hold it
Under the UK GDPR and the EU GDPR our lawful bases are:
- Performing our contract with you - your address, name, rating and record are what an account is. There is no rated game against another person without them.
- Our legitimate interests - keeping the service running and secure, and keeping the leaderboard honest. This covers the sign-in proof, the record of who played whom, and the on-chain checks.
- Your consent - for what you choose to publish about yourself, such as a display name or a message on a thank-you. Consent is also what the sign-in screen asks for before any of this starts.
You are never profiled, and nothing here makes an automated decision with a legal or similarly significant effect on you.
How long we keep it
- Your player record - until you ask us to delete it, so coming back after a break finds your rating where you left it.
- Who played whom - this only matters while a thank-you can still be sent, which is ten minutes after a game.
- Counted transaction hashes - kept indefinitely; forgetting one would let a thank-you be counted twice.
- Server logs - only as long as our hosting provider retains them.
- Blockchain records - permanent, and outside anyone's control.
Your rights
If you are in the UK or the EEA the GDPR gives you the rights below. We will honour a request from anyone, wherever they are.
- See what we hold about you, and get a copy.
- Correct it if it is wrong.
- Have it deleted. We remove your player record - address, name, keys, rating, record and all - and your leaderboard row goes with it. What we cannot delete is the blockchain, and we cannot restore the record afterwards.
- Restrict or object to how we use it.
- Take it elsewhere, in a machine-readable form.
- Withdraw consent at any time, without affecting anything done before.
- Complain to a regulator - in the UK the Information Commissioner's Office (ico.org.uk), in the EEA your national authority. We would rather you came to us first, but it is your right either way.
Email info@nimiq.com with your Nimiq address or display name so we can find your record. We answer within 30 days, at no charge.
Children
Tip Chess is not intended for children under 13, and playing requires a Nimiq Pay wallet, which has its own age requirements. We do not knowingly hold a child's data; if you believe we do, email info@nimiq.com and we will delete it.
Changes
If we change this notice the date at the top changes with it. If a change is significant - a new recipient of your data, or a new purpose - you will be asked to read and accept it before you next play, rather than having it slipped past you.