Privacy Policy

This Privacy Policy explains how Software Kit SRL ("we", "us") collects, uses, and protects personal data when you use Deploy Chess (the "Service"). It applies to the mobile applications, the website at deploy-chess.com, and our backend services.

We are the data controller for the personal data described below. We process personal data in accordance with the EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, and Romanian implementing legislation (Law no. 190/2018).

01What we collect

Category	Data
Account	Email address, authentication provider (email, Google, or Apple), Firebase user ID, Nakama user ID, chosen username, account creation timestamp.
Gameplay	Game records: opponent identifier, color played, time control, deployment placements, full move list, result, duration, deployment evaluation score, and timestamps. Player ratings (Glicko-2 rating, deviation, volatility) per time control and per phase.
Technical	Device type, operating system, app version, language, approximate region (derived from IP), session and connection metadata, IP address (transient).
Diagnostics	Crash reports and stack traces (via Firebase Crashlytics), aggregated usage analytics (via Firebase Analytics, where enabled).

We do not collect payment information, contact lists, precise location, photos, microphone, or camera data. The Service does not contain advertising and we do not sell personal data.

02How we use it

We process personal data for the following purposes and lawful bases:

• Service delivery — authenticating you, running matches, computing ratings, displaying game history, providing replays. Lawful basis: performance of a contract (Art. 6(1)(b) GDPR).
• Fair play and abuse prevention — detecting cheating, collusion, and abusive accounts; enforcing our Terms. Lawful basis: legitimate interests in protecting the integrity of competitive play and the safety of users (Art. 6(1)(f) GDPR).
• Reliability — diagnosing crashes and improving stability via Firebase Crashlytics. Lawful basis: legitimate interests in keeping the Service functional (Art. 6(1)(f) GDPR).
• Communication — responding to your support and privacy requests. Lawful basis: performance of a contract / legitimate interest / legal obligation, depending on the request.
• Legal compliance — keeping records as required by law, responding to lawful requests from authorities. Lawful basis: legal obligation (Art. 6(1)(c) GDPR).

03Who we share with

We do not sell or rent personal data. We share limited data with the following processors and third parties, only to the extent necessary to provide the Service:

• Google Ireland Limited — Firebase Authentication, Crashlytics, and Analytics. Data is processed on Google infrastructure and may be transferred to the United States.
• Apple Inc. — Sign in with Apple, where you choose that sign-in method.
• Akamai / Linode (operating Deploy Chess servers) — our self-hosted Nakama backend runs on a Linode (Akamai) virtual server.
• chess-api.com — used to evaluate the position at the end of the deployment phase. We send only the FEN string of the position; no user identifier is shared.
• Other players — your username, color played, time control, game moves, deployment, result, and ratings are visible to your current opponents and shown in shared game history. Email addresses and authentication identifiers are never shown to other players.
• Authorities — where required by law, court order, or to protect the rights and safety of users.

04International transfers

Some of our processors (notably Google) may process personal data outside the European Economic Area, including in the United States. Such transfers are covered by the EU-U.S. Data Privacy Framework, by the European Commission's Standard Contractual Clauses, or by other valid transfer mechanisms recognised under GDPR.

05Retention

• Account data — kept for as long as your account exists. If you delete your account, we delete your account record and anonymise associated game data within 30 days, except where retention is required by law.
• Game records — retained as part of the public game archive for as long as the Service operates. After account deletion, your username in those records is replaced with an anonymised label.
• Crash and diagnostic logs — kept for up to 90 days.
• Backups — encrypted backups may persist for up to 30 days after deletion before being overwritten.

06Your rights under GDPR

If you are in the European Economic Area, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your personal data ("right to be forgotten").
• Restrict or object to processing based on our legitimate interests, including profiling for fair-play enforcement.
• Receive a copy of your data in a structured, commonly used, machine-readable format (data portability).
• Withdraw consent at any time where processing is based on consent — without affecting the lawfulness of prior processing.

To exercise any of these rights, email admin@markosoft.ro. We will respond within one month, as required by GDPR. For verification we may need to confirm your identity before fulfilling the request.

You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) or with the supervisory authority in your country of residence.

07Security

We apply technical and organisational measures appropriate to the risk, including TLS in transit, encrypted backups, server-authoritative game logic to prevent client-side tampering, principle-of-least-privilege access for operators, and credentials stored as one-way hashes by our authentication providers. No system is perfectly secure; if we become aware of a personal-data breach affecting you, we will notify you and ANSPDCP as required by law.

08Children

The Service is not intended for children under 13. We do not knowingly collect personal data from children under that age. If you believe a child has provided us with personal data, please contact us and we will delete the data.

09Cookies and similar technologies

The Deploy Chess web app stores authentication tokens and game preferences in your browser's local storage so that you remain signed in across sessions. We do not use advertising cookies. Firebase Analytics, where enabled, may set cookies to measure aggregate usage; you can disable analytics in your device settings.

10Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date above and, for material changes, give notice in the app or by email. Continued use of the Service after the change takes effect constitutes acceptance of the updated policy.

11Contact