We keep plays, not people.

Without a Playbook

Nothing you draw leaves your browser: without a Playbook, Save to Playbook only offers to start one and sends nothing. The board keeps your unsaved drawing in this browser's own storage so a refresh does not lose it; Clear the board removes it.

With a Playbook

A Playbook is opened by a private random key. We store only a one-way hash of the key, never the key itself. The key sits in a secure cookie in your browser and after the # in your Playbook link (the part of a link that browsers do not send to the server, so it never reaches our logs).

For each saved play we store: its name, the surface, the markers (kind and a 1-2 character label), their positions in each step, the kinds of move, the step notes, and when it was saved. If you turn on a view-only link we store its random code until you turn it off.

What we never ask for

No account, name, email, phone number, photo or location. Nothing on the site asks for personal data about players, children above all. Play names and step notes are free text for the play itself: please use positions and numbers there, not players' names. They refuse text shaped like an email address, phone number or web address.

Limits and logs

To stop abuse we count requests per day against a salted hash of your internet address (never the address itself); those counters are deleted after about 3 days. The web server keeps standard access logs (address, time, page) as every website does. There are no analytics services, no tracking cookies and no outside fonts. The only script from another site is the adengine.us banner described under Advertising, which also counts one page view per page as a daily total.

Advertising

Four public pages (home, Guide, Pricing and About) show one banner ad from AdEngine (adengine.us), the small ad network run by WeldonPC, the company behind Chalkstep. For now the ads are for WeldonPC's own services. The board, your Playbook, view-only play links (the pages players are sent to), this page, Terms and error pages never show an ad.

To show an ad, your browser loads a script from adengine.us, asks it for one banner, loads the banner image, and reports once that the page was viewed and once that the banner was shown. Like any website, adengine.us receives your internet address, your browser type and the address of this site with those requests.

• No cookies, no profile. AdEngine sets no cookies, gives you no ID and does not track you from site to site.
• How your internet address is used. adengine.us looks up the approximate city for your internet address in a location database kept on its own server (nothing is sent to anyone else), so that ads meant for one area are shown only there. It also uses the address to count each ad view or click only once and to leave out robots and WeldonPC's own office traffic. The address is not stored with the counts; the temporary entries made from it expire within six hours and are cleared from the server within two days.
• What is kept. Daily totals only: page views for this site, and views and clicks for each ad. The adengine.us web server also keeps a standard access log (internet address, time, address requested, referring site, browser) for security; it is deleted on a rolling schedule.
• Clicking an ad passes through adengine.us, which counts the click, and then opens the advertiser's site, which has its own privacy policy.
• Nothing about you is sold or shared. The ad request names only this site and the banner size: your plays never leave Chalkstep.

Cookies

Two, both set by this site only. A security cookie, __Host-cs_csrf, holds a random code that blocks forged form posts; it is set on every page and identifies no one. The Playbook cookie, __Host-cs_key, holds your Playbook's key and is set only when you start or open a Playbook.

How long

A Playbook nobody has opened for 400 days is deleted with its plays, unless a Chalk Pass is running. You can delete your Playbook yourself at any time from its page. The site's database backups (nightly, and before and after each update) are kept on the server for 14 days and then deleted; WeldonPC's whole-server backups may also hold a copy until those backups are replaced.

Payments

None today: the site is in preview. When the Chalk Pass goes on sale, PayPal will handle the payment and we will store only PayPal's subscription reference, the plan and its end date against your Playbook.

Contact

Chalkstep is run by WeldonPC.com; use the contact details there.