1. What this policy covers
Cookies are small files a website stores on your device. Websites also use similar technologies — browser local storage, session storage, pixels and software development kits — which do the same job in a different way. This policy covers all of them, and uses "cookies" as shorthand.
It sits alongside our Privacy Policy at /legal/privacy, which explains what we do with personal data generally.
Users are hereby requested to read this policy, along with our Terms & Conditions and our Privacy Policy, before answering the cookie banner. A user under 18 is advised to seek their parent's or guardian's guidance before proceeding any further.
One thing worth knowing up front: most of what C4Chess itself stores on your device is not a cookie at all. It is browser local storage, which stays on your device and is not attached to requests sent to our servers. We have listed it here anyway, because what matters to you is what is being kept on your machine, not the technical name for it.
2. Strictly necessary — always on
These keep the service working and secure. They cannot be switched off, and they are not covered by the consent banner because the service cannot be provided without them.
Your sign-in session (stored by our authentication provider under a key beginning "sb-"): keeps you signed in between page loads and refreshes your session. Lasts until you sign out or the session expires.
"c4chess_cookie_consent_v1": stores your answer to the cookie banner — accepted or declined. Without it we would have to ask you on every page. Persists until you clear your browser storage.
"c4chess_guest_token" and "c4chess_guest_display_name": a random identifier and display name that let you play or solve puzzles without an account. Not linked to a name or email. Persists until you clear your browser storage.
"c4chess_account_blocked" (session storage): carries a message explaining why a sign-in was refused. Cleared when the browser tab closes.
Security and load-balancing cookies set by our hosting provider in the course of serving the page.
3. Functional preferences stored at your request
These are not switched on in advance and they are not a category you have to accept. Each one is created only when you choose the setting it remembers — pick a board theme and we store the board theme — and it is used for nothing else. They stay in your browser and are not transmitted to us or to anyone else. They are listed so you know what is on your device.
"c4chess_language" (portal language), "c4chess_portal_theme" (light or dark), "c4chess_portal_mode" (academic or play view), "c4chess_appearance" (board theme, piece set and background), "c4chess_play_settings" and "c4chess_bot_setup_v1" (how you like games set up), "c4chess_spoken_feedback" (whether spoken feedback is on, for accessibility), "c4chess_chessdaily_voice" (article read-aloud voice), and "c4chess_portal_tour_v1" (whether you have seen the welcome tour).
For guests, "c4_guest_xp_total_v1" and related keys hold progress locally so a guest can keep their XP and course progress without an account.
Clearing your browser storage removes all of these. Nothing breaks; the platform simply forgets your preferences.
4. Optional — analytics
Only set if you accept optional cookies. Until then the Google Analytics tag is not on the page at all, so nothing is set and nothing is sent.
Google Analytics 4 (property G-V8S30EV4MN) sets "_ga" and "_ga_V8S30EV4MN", which hold a randomly generated identifier used to recognise a returning browser. Google's current default lifetime for these is up to two years.
What is measured, and what is deliberately not sent to Google, is set out in section 9 of our Privacy Policy. In short: pages and a small set of named events; never your name, email, account ID, messages, homework, games, or the text of anything you search for.
Advertising signals — advertising storage, advertising user data and advertising personalisation — are denied for everyone except a user who has declared 18 or over and accepted optional cookies, which is the one case where personalised advertising requires them. They are a single browser-wide setting shared by Analytics and advertising, so for that group they are granted for both. For everyone else analytics data is not used to build an advertising profile.
5. Optional — advertising
No advertising is running on C4Chess as at the last-updated date, and no advertising cookie is being set. This section describes what will apply if and when advertising launches, so the disclosure is in place first.
If advertising launches it will be Google AdSense, which typically sets cookies such as "__gads" and "__gpi" to control how often an advertisement is shown, to measure fill, and to detect invalid traffic. These would be set only after you accept optional cookies. If you decline, the only storage AdSense uses is Google's invalid-traffic detection, which guards against click fraud and is not used to select what you are shown or to build any profile of you.
Advertising on C4Chess will be non-personalised, with Google's Tag for Age Treatment configured as "child" on the request and Google's restricted-ad settings used to prevent interest-based advertising and remarketing, for every user except one who has declared 18 or over. That is the default and it is what anyone gets who has declared under 18, whose declaration is too old to settle the question, or who has not answered at all. A non-personalised advertisement may still be selected using contextual information, such as the content of the page and a coarse location, as permitted by Google's documentation and applicable law. A user who has declared 18 or over may see personalised advertising instead; section 10 of the Privacy Policy explains what that means.
Nothing withholds advertising entirely. What your choices change is the kind of advertisement: your cookie answer decides between limited and ordinary serving, your declared age band decides between personalised and non-personalised, and enrolment makes no difference either way.
If you decline optional cookies you see limited advertising: chosen from the page, never from you, with no advertising cookie set and no profile involved. Section 10 of the Privacy Policy sets this out in full, including why we serve it rather than showing nothing.
6. What loads before you accept, and what does not
Analytics does not load before you accept. The tag is not written into our pages; it is injected by our own code, and only after your acceptance has been recorded. Before that point no analytics request is made and no analytics cookie is set.
Advertising is the exception, and we would rather be precise about it than let you assume otherwise. The advertising tag does load before you answer, and after you decline — but only in Google's limited mode, which sets no advertising cookie, reads nothing from your device except invalid-traffic detection, and picks the advertisement from the page rather than from you. Accepting optional cookies is what moves it to ordinary serving. This is about the optional tags specifically — features you actively use, such as an embedded video, are covered in section 8.
Optional tags are also suppressed on pages whose address could carry a sign-in or password-reset token, regardless of consent, so a credential cannot reach a third party in a URL.
No analytics or advertising tag loads when the site is running on a local development host, so our own testing does not enter your figures or ours.
7. Cookies and children
Our platform is used mainly by children, and that changes what is acceptable here.
No user whose declared age band is under 18 — and nobody who has not answered, or whose answer is too old to rely on — is followed across other websites, profiled for advertising, or shown personalised advertising. That includes children under 13, who see contextual advertising only. A user who has declared 18 or over may see personalised advertising; that is what the age question is for, and section 10 of the Privacy Policy explains it.
Analytics is the honest exception to how simple the rest of this page is, so we will not round it off. Where you have accepted optional cookies, Google Analytics 4 gives your browser a randomly generated identifier that persists between visits and records which pages and features were used. We do not send it your name, email, account ID, messages, homework, games, or the text of anything you search for. For a child — anyone whose declared band is under 18, and anyone whose age we cannot place — every advertising signal is denied, so for a child it cannot feed an advertising profile. Whether that should run on signed-in pages at all, on a platform used by children, is under review — section 11 of the Privacy Policy sets out our thinking. Declining is a single click and costs you nothing here.
Section 9(3) of the Digital Personal Data Protection Act, 2023 prohibits tracking, behavioural monitoring and targeted advertising directed at children, and the Act treats everyone under 18 as a child. We decide this per visitor from the declared age band, and the child-safe configuration is the DEFAULT: it is what anyone gets who has not declared, who has declared under 18, or whose declaration has aged past the point where it settles the question. Only a standing declaration of 18 or over turns it off.
Where a child holds an account, a parent or guardian can change the cookie choice from the same place the child can — portal → Settings → Account → Analytics cookies.
8. Other domains that see your browser
Loading a page can involve fetching a file from somewhere else, and whoever serves that file sees your IP address and browser information. These are listed for transparency; they are not tracking cookies.
The most significant entry on this list is the one we removed. The typefaces used across the site were previously fetched from Google Fonts on every page load, which meant Google saw the address of every visitor to every page before anyone had agreed to anything. They are now served from our own domain, and fonts.googleapis.com and fonts.gstatic.com are no longer permitted to be contacted at all by the security policy this site sends to your browser.
jsDelivr — serves the chess piece artwork for some board themes.
flagcdn.com — serves country flag images.
YouTube, through its privacy-enhanced player (youtube-nocookie.com) — used in the video library. It sets no cookie until you press play.
LiveKit — receives your media stream while you are in a live class.
Our own hosting and database providers, in the course of serving pages and data.
9. Your choices, and how to change your mind
When you first arrive, a banner asks whether you accept optional cookies. Declining is a single click, on the same footing as accepting. No analytics loads until you accept. Advertising loads either way, but declining keeps it in the limited mode described in section 5 — no advertising cookie, nothing read from your device, and the advertisement chosen from the page rather than from you.
You can change your answer at any time in the portal, at Settings → Account, where "Analytics cookies" sits towards the end of the section. If you are browsing as a guest, the same control is on the Settings page itself — a guest has no account section, and putting the only way to withdraw consent behind creating an account would mean consent that cannot be withdrawn. Turning it off stops reporting immediately in that page, without a reload or a sign-out. If you have C4Chess open in more than one tab, the other tabs apply your new choice when they next load.
Consent you cannot withdraw is not really consent, which is why that switch exists as a permanent control rather than only as a one-time banner.
Your browser can also block or delete cookies and clear local storage. Clearing our storage will bring the banner back and will reset your preferences. Blocking strictly necessary items will stop parts of the service from working, including staying signed in.
Google offers a browser add-on that opts you out of Google Analytics on every site, if you would rather set this once for the whole web.
10. Changes and contact
We may update this Cookie Policy — in particular if advertising launches, or if we add or remove a provider. Each version carries a version identifier and a last-updated date, and the current version is always at /legal/cookies.
Where a change requires consent, we will ask again rather than assume your previous answer carries over.
Questions about anything on this page: privacy@c4chess.com.