Chess Critters — Privacy Policy

1. At a glance

• You can play without giving us your name, email or phone number. All chess games, the computer opponent and the daily puzzles run on your phone, even offline.
• To keep your progress safe, the game creates a game account for you (Firebase Authentication). If you use Google Play Games, that account is linked to your Play Games profile so the same account comes back on any phone.
• Your coin balance and everything you buy are saved to your game account on our servers, so they are restored automatically if you reinstall the game or move to a new phone. The same goes for your level, streak, missions, achievements, statistics and settings.
• We show ads through Google AdMob. In the EU/EEA, UK and Switzerland we ask for your consent first, and in US states with privacy laws you can opt out of the “sale/sharing” of your data. You can change your choice at any time in Settings → Shop & ads → Ad privacy choices.
• We never sell your personal data, and we never collect the advertising ID for analytics.
• You can delete your account and data at any time in Settings → Delete my account and data, or by email.

2. Data on your phone

The game stores the following on your device (in app-private storage that other apps cannot read):

• Your settings (language, theme, sound, animations, notifications).
• Your progress (level, XP, statistics, streak, daily challenge history, missions, achievements, equipped cosmetics) and a copy of your coin wallet.
• A saved, unfinished game so you can resume it.
• A short list of hashed purchase tokens (to avoid processing the same purchase twice) and a queue of actions made while offline, which is sent to our servers when you are back online.

This data is excluded from Android cloud backups; your game account is the backup. Uninstalling the app deletes the local copy.

3. League and nicknames

If you solve the Daily Challenge while online, your result is added to the worldwide Chess League. Other players can see:

• your nickname (or an automatic name like “PlayerAB12” if you have not chosen one), avatar, frame and level;
• your score, the date and the puzzle you played.

Nicknames must be unique, contain 3–16 letters, numbers or underscores, and can be changed twice every 7 days. Please do not use your real name or any personal information as a nickname. The League shows the last 7 days; your own entries older than 30 days are removed the next time you submit a score, and all of them are deleted with your account.

Leaderboards and achievements in Google Play Games are handled by Google under your Play Games profile settings.

4. Invites

Each account has an invite code and link (for example https://chess-critters-game.web.app/i/ABC1234). When a friend installs the game through your link:

• Google Play passes the invite code to the newly installed game (Google Play Install Referrer). If the game is already installed, the link opens it directly.
• To stop the same phone from claiming invite rewards again and again, the game computes a one-way SHA-256 hash of the device's Android ID on the phone and sends only that hash. The original Android ID never leaves the device and cannot be recovered from the hash.
• You (the inviter) see the nickname and avatar of friends who joined with your link and the date they joined.

5. Sharing

When you tap Share (a win, a solved puzzle, your streak or your League rank), the share picture is created on your phone. You decide whether it shows your name (“Show my name”). It is passed to the app you choose (for example a messaging app); we do not upload it. The share text includes your invite link.

6. Google Play features

• Google Play Games Services: if you are signed in, the game uses your Play Games player ID and name to sign you in, show leaderboards and achievements, and keep a backup copy of your progress in Play Games Saved Games. Google's own privacy policy applies to your Play Games profile.
• Google Play Billing: payments are processed entirely by Google. We never see your card or payment details. We receive the purchase details we need to deliver your item (product, order ID, purchase token, purchase state).
• In-App Review and In-App Update: Google shows these dialogs; we don't receive your review content.
• Firebase App Check with Play Integrity: Firebase checks that requests come from the genuine game on a genuine device, to prevent cheating and fraud. This uses an integrity verdict from Google, not your personal data.

7. AdMob ads

Chess Critters is free and shows ads from Google AdMob:

• Rewarded ads are always optional — you choose to watch one for double coins, a free hint, a free undo or an extra daily attempt.
• Interstitial ads appear only between games (never during play), never in your first minutes with the game, and not too often. Buying “Remove Ads” turns them off.

AdMob may collect your device's advertising ID, IP address, approximate location (from IP), device and app information, and ad interactions in order to show, measure and limit ads and prevent fraud. Ads are personalized only if you have given consent where the law requires it. All ads are limited to family-friendly content (maximum rating PG).

• EU/EEA, UK and Switzerland: we show Google's consent form (Google User Messaging Platform) before any ad is requested.
• US states with privacy laws: you can choose “Don't sell or share my personal information”.
• Change your choice at any time: Settings → Shop & ads → Ad privacy choices. You can also reset or delete your advertising ID in your Android settings.
• We have opted out of the Android Privacy Sandbox Topics, Attribution and Custom Audiences APIs for ads in this game.

8. Purchases and cloud wallet

Your coins and items are stored in your game account on our servers (Google Cloud Firestore), not only on your phone:

• Coin balance, owned items (skins, boards, effects, frames), consumable items (hints, undos, streak freezes) and the Google Play products you own.
• Every purchase is checked against Google Play's digital signature before anything is granted, then recorded once by its purchase token (so it can never be granted twice); its order ID, product, account and time are kept.
• Coins earned in the game (wins, puzzles, missions, daily rewards, rewarded ads, invites) are saved to your account with daily limits and one-time checks to prevent abuse.
• Because of this, your coin balance and purchases are restored when you reinstall the game or use a new phone — sign in with the same Google Play Games account. One-time purchases (like Remove Ads) can also always be restored through Google Play.
• If a one-time purchase (such as Remove Ads) is refunded or revoked by Google Play, the items it gave are removed.

9. Analytics and crash reports

• Firebase Analytics records how the game is used (for example: game started/finished, level, daily challenge solved, screens viewed, items bought with coins, purchase product/price/currency) together with an app-instance ID and your game account ID. Advertising-ID collection is disabled and analytics data is not used for ad personalization.
• Firebase Crashlytics collects crash and error reports (stack trace, device model, OS version, app version, game account ID) so we can fix bugs.

10. Notifications

• Daily reminder: at most one local reminder per day about your daily puzzle, streak or missions. It is scheduled on your phone; no data is sent to do this. Turn it off in Settings → Notifications.
• Sales & news: occasional messages through Firebase Cloud Messaging, sent to everyone who subscribed in a given language. This uses a push token for your device. Turn it off in Settings → Notifications.

11. Permissions

The game does not use your camera, microphone, contacts, photos, files or precise location.

12. Service providers

We use these providers, who process data on our behalf or as independent controllers under their own terms:

• Google LLC / Google Ireland Ltd. — Firebase (Authentication, Cloud Firestore, Hosting, App Check, Analytics, Crashlytics, Cloud Messaging), Google Play (Billing, Games Services, Install Referrer, In-App Review/Update), AdMob and the User Messaging Platform. Data may be processed in the United States and other countries where Google operates, under Google's Standard Contractual Clauses. See Google's Privacy Policy and how Google uses information from apps that use its services.
• GitHub hosts this policy page.

We do not sell personal data and do not share it with anyone else, except where required by law.

13. Retention

• Game account, wallet, progress, settings, profile and invite data: until you delete your account.
• League entries: up to 30 days after your last daily result, and until you delete your account.
• Purchase records: up to 7 years, for tax, accounting, refund and fraud obligations. After account deletion they are kept only in pseudonymous form (no longer linked to you).
• Hashed device IDs used for invite fraud prevention: kept so a device can receive the invite gift only once. The hash cannot be turned back into your Android ID or linked to your name.
• Crashlytics reports: 90 days. Analytics events: 14 months.
• Data on your phone: until you uninstall the game or clear its data.

14. Security

Data is encrypted in transit (HTTPS/TLS) and at rest on Google Cloud. Security rules let each player read and write only their own data, each purchase can be recorded only once, and paid items can only be added together with a verified purchase record. Requests are protected with Firebase App Check (Play Integrity). No system is perfectly secure, but we work to protect your data and will notify you and authorities of breaches where required.

15. Your choices and rights

• Delete your account and data: Settings → Delete my account and data (immediate), or email us / follow these steps if you no longer have the game.
• Ad choices: Settings → Shop & ads → Ad privacy choices.
• Notifications: Settings → Notifications.
• Leave the League: don't submit daily results online, or delete your account.
• Depending on where you live (for example under the GDPR, UK GDPR, CCPA/CPRA and other laws) you may have the right to access, correct, delete or receive a copy of your data, to object to or restrict processing, to withdraw consent, and to complain to your data protection authority. Email us to exercise these rights; we reply within 30 days. We will not discriminate against you for exercising them.

16. Legal bases (EU/EEA and UK)

• Contract: running the game, your account, cloud save, delivering purchases, the League and invites.
• Consent: personalized ads and the related use of the advertising ID; Sales & news notifications. You can withdraw consent at any time.
• Legitimate interests: security and fraud prevention (App Check, purchase verification, invite abuse checks), crash reports and aggregated analytics to improve the game, and non-personalized ads that fund the free game.
• Legal obligation: keeping purchase records.

17. Children

Chess Critters is intended for players aged 13 and older and is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has given us personal data, contact us and we will delete it.

18. Changes

We may update this policy. We will change the effective date above and, for important changes, tell you in the game before they apply.

19. Contact

Moonbyte Labs
Email: moonbytelabs.support@gmail.com