Privacy Policy

Chess40 · Version 0.9 (draft for legal review) · Last updated: 20 October 2026

This Privacy Policy explains how Tibrcode Software Development ("Tibrcode", "we", "us") handles personal data when you use Chess40, our chess game for Android, iOS and the web at chess40.com (together, the "Service").

The short version

• You can play Chess40 without an account. Your settings, progress and games stay on your device.
• Chess40 is free and supported by ads from Google. Where the law requires it, we ask for your consent before ads are personalised.
• An account is optional. It is only needed to invite a friend to play online, and you can delete it at any time from inside the app.
• We do not sell your personal data.
• Questions? Write to support@tibrcode.com.

1. Who we are

The controller responsible for your personal data is Tibrcode Software Development, Abu Dhabi, United Arab Emirates. Email: support@tibrcode.com (privacy requests, support and legal notices).

2. Data we process

2.1 Playing without an account

Your settings (such as language and motion), your progress, and the games you play against the computer or on one device are stored only on your device. We do not receive them. Uninstalling the app or clearing the site's data removes them.

2.2 Advertising

Chess40 shows one banner ad provided by Google: Google AdMob in the apps and Google AdSense on the website. To deliver, limit, measure and secure ads, Google and its partners may process:

• device and advertising identifiers (such as the Android advertising ID, or the iOS IDFA if you allow tracking), and cookies or similar technologies on the web;
• your IP address and an approximate location derived from it;
• device, browser and app information (model, operating system, language, app version);
• information about the ads shown and your interactions with them.

Personalised ads are shown only where permitted. In the European Economic Area, the United Kingdom and Switzerland they are shown only with your consent, collected through a Google-certified consent tool. Otherwise you may see non-personalised or limited ads, which still use some data for frequency capping, aggregated reporting and fraud prevention. To learn how Google uses information from sites and apps that use its services, see policies.google.com/technologies/partner-sites.

2.3 Optional account (online play)

If you create an account to invite a friend, we process:

• the identifier provided by Sign in with Apple or Sign in with Google, and the email address the provider shares with us (Apple may give us a private relay address);
• your nickname and avatar (chosen from our built-in designs; photos cannot be uploaded);
• your online games (moves, results, time controls and timestamps), the invitations you create, and the players you report or block.

2.4 Playing online as a guest

If you join a friend's game without an account, we create an anonymous session and process your nickname and the data of that game.

2.5 Support

If you email us, we process your message, your email address and any details you include. The in-app "Contact support" template adds your app version, platform and screen size, which you can review and edit before sending.

2.6 Technical and security data

Our hosting and backend providers process IP addresses and technical logs to deliver the Service, keep it secure and prevent abuse. When the app checks for updates, it downloads a small public file from chess40.com; this request carries no personal identifiers beyond the technical data that any internet request contains. If crash reporting is enabled, we receive crash and performance diagnostics that are not linked to your identity, and you can turn it off in Settings.

3. Why we use data, and our legal bases

4. Who we share data with

We share data only with providers that help us run the Service, under contracts that protect your data:

• Google (AdMob and AdSense) for advertising. For some processing Google acts as an independent controller.
• Supabase for accounts and online play.
• Vercel for hosting the website.
• Apple and Google for sign-in and app distribution.
• Sentry for crash reporting, only if it is enabled.

We may also disclose data where the law requires it, to protect rights and safety, or as part of a merger or acquisition (we will tell you first). We do not sell personal data. Where personalised advertising counts as "sharing" under US state laws, you can opt out (see section 8).

5. International transfers

Our providers may process data outside your country, including in the United States and the European Union. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or adequacy decisions.

6. How long we keep data

• Data on your device: until you delete it or uninstall the app.
• Account data and online games: while your account exists. They are deleted within 30 days of deleting your account, and backups are overwritten within a further 30 days.
• Guest sessions: deleted after 90 days of inactivity.
• Server logs: up to 30 days, unless needed to investigate abuse.
• Support emails: up to 24 months.

7. Children

Chess40's content is suitable for all ages, but the Service is intended for people aged 13 and over. Online accounts require you to be at least 13, or the minimum age of digital consent in your country (up to 16 in some EU countries). We do not knowingly collect personal data from children below these ages. If you believe a child has given us personal data, contact us and we will delete it.

8. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict its processing, and to withdraw consent at any time. You can also complain to your local data protection authority.

• Delete your account: Settings → Account → Delete account, or at chess40.com/account/delete.
• Ad choices: Settings → Privacy → Ad choices (reopens the consent form where it applies).
• Device settings: on Android you can delete or reset your advertising ID; on iOS you can turn off "Allow Apps to Request to Track".
• California and other US states: you can ask to know, delete or correct your personal data, and opt out of the "sale" or "sharing" of personal data for targeted advertising. We will not treat you differently for using these rights.

To use any of these rights, email support@tibrcode.com. We reply within 30 days, or within the period your local law sets, and we may need to verify the request.

9. Security

We use encryption in transit (HTTPS), access controls and row-level security in our database, and we keep the data we collect to a minimum. No system is perfectly secure. If a breach affects your data, we will notify you and the authorities where the law requires.

10. Regional information

This policy is designed to meet, among others, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the Saudi Personal Data Protection Law, the EU and UK GDPR, the Swiss Federal Act on Data Protection, US laws including COPPA and the CCPA/CPRA, Brazil's LGPD, Canada's PIPEDA and India's DPDP Act 2023. Where your local law gives you additional rights, those rights apply.

11. Changes to this policy

We may update this policy. We will change the version and date at the top, and tell you in the app before any material change takes effect.

12. Contact

Tibrcode Software Development · Abu Dhabi, United Arab Emirates · support@tibrcode.com

See also: Terms of Use · Help & Support