Privacy policy

Who we are

Castlei is developed by Ian Andwati, an individual developer (“we”, “us”). For privacy questions or requests write to andwatiian@gmail.com.

The short version

• Your games, studies, drills and statistics are stored on your device.
• An account is optional. You only need one for cloud backup.
• Crash reports, performance timings and usage analytics are anonymous, on by default, and each can be switched off in Settings.
• We never collect your positions, moves, comments, game titles or the contents of your files as analytics or crash data.
• We do not sell your data, show ads, or use it for advertising.
• This website uses analytics cookies only if you accept.

Data that stays on your device

Games and their variations, comments and annotations, engine analysis results, repertoires and drill schedules, puzzle history, statistics, installed puzzle packs, and your preferences are stored in a local database in the app's private storage. We do not receive this data unless you use cloud backup, export a file, or share a diagnostics report yourself. Uninstalling the app removes it from your device.

Reminder notifications (due drills, the daily puzzle, an unfinished game) are scheduled on your device. They send no data to us.

Your account (optional)

If you choose to sign in, we use Firebase Authentication (Google) with Sign in with Google. We receive the identifiers Google provides for the account you pick: a unique account ID, your email address, your display name and your profile picture address. We use them to sign you in, to keep your cloud backups private to you, and to answer your requests. You can sign out or delete your account at any time (see Delete your account).

Cloud backup (only if you sign in)

When you tap Back up now, or when automatic backup runs after you unlock Castlei Plus, the app uploads a backup archive to Cloud Firestore. The archive contains the data listed under “Data that stays on your device”: your games with their variations and comments, analysis results, repertoires, drill schedules, training history, the list of installed puzzle packs, and your preferences. It does not contain your email address.

The archive is stored in your own private area, in a Google data center in the United States (multi-region), and can only be read or deleted by your account through security rules. We keep your latest copy (up to five versions with Plus). Backups are removed when you delete them, when older versions are replaced, and when you delete your account. They are encrypted in transit and at rest by Google.

Crash reports, performance and usage analytics

To fix problems and improve the app we use Google Firebase services. Each one has its own switch in Settings → Privacy and diagnostics, and each is on by default.

• Crash reports (Firebase Crashlytics): the technical details of a crash or handled error, such as the stack trace, an error type and a short, scrubbed message, the app and engine versions, the device model and operating system version, and a Firebase installation ID. Error messages are cleaned of board positions (FEN), PGN headers and file paths before they are sent.
• Performance monitoring (Firebase Performance Monitoring): timings such as app start, engine search speed, import and backup durations, network request durations and frame rendering, with device and network characteristics (device model, operating system, app version, network type, approximate country).
• Usage analytics (Firebase Analytics): which screens and features are used and game outcomes as broad categories (for example win, loss or draw, difficulty level, game length range, whether hints were used), together with a Firebase installation ID, device and app details, and an approximate location derived from your IP address (the IP address itself is not stored). We do not use advertising identifiers, and ad personalisation is disabled.
• Announcements (Firebase Cloud Messaging and In-App Messaging): if enabled, the app registers with Firebase to receive occasional announcements, using a messaging registration token and the Firebase installation ID. You can turn announcements off in Settings → Notifications.
• Remote settings (Firebase Remote Config): the app periodically downloads configuration values (for example engine time limits); this involves your IP address and a Firebase installation ID.

This information is not linked to the content of your games and we do not use it to identify you. Crashlytics data is kept for 90 days; the other services keep data for the standard periods set by Firebase, after which it is deleted automatically.

This website

When you visit this website we do not set analytics cookies unless you choose Accept in the banner. If you accept, we use Google Analytics (through Firebase) to count visits and see which pages and links are used. It records the pages you view and the links you click, your approximate location (country or city, derived from your IP address, which is not stored), the browser, device and language, and how you arrived (for example from a search or another site). It sets two cookies, _ga and _ga_*, which last up to 13 months and contain a random identifier. We do not use Google Signals, advertising features or ad personalisation, and we do not combine this data with the Castlei app or with anything that identifies you.

If you decline, or your browser sends a Global Privacy Control or Do Not Track signal, no analytics script is loaded. You can change your choice at any time with Analytics settings in the footer of every page. Declining or withdrawing deletes the analytics cookies it set. The legal basis is your consent. Like any web host, Firebase Hosting keeps standard server logs (such as IP address and requested page) for security and operation.

Diagnostics reports you choose to send

Settings → Privacy and diagnostics → Diagnostics shows a snapshot of what Castlei knows on your device: app and operating system versions, which switches are on, counts of games and drills, and a short list of recent scrubbed events. It contains no games, positions, comments, titles, names, email address or file names. Nothing is sent unless you tap Send diagnostics and choose where to share it, for example by email to us.

Purchases (Castlei Plus)

When Castlei Plus becomes available, the purchase is handled by Google Play. Google processes your payment and we do not receive your card or payment details. The app will receive confirmation of whether the purchase is active on your Google account so it can unlock the feature.

How we use data and why

• To provide the app and the features you ask for (sign-in, cloud backup, restore). Basis: performing our agreement with you.
• To keep the app working and improve it (crash, performance and usage data). Basis: our legitimate interest in a reliable app, and your consent where the law requires it; you can withdraw it any time with the switches in Settings.
• To answer your messages and requests. Basis: legitimate interest and legal obligations.

Who we share data with

We use Google LLC (Firebase and Google Play) as a service provider to run the features above. Google processes data on our behalf under its own terms and privacy policy. We do not sell personal data and we do not share it with advertisers or data brokers. We may disclose data if the law requires it.

Data processed by Google may be stored and processed in the United States and other countries where Google operates. Where required, transfers rely on the safeguards Google provides.

How long we keep data

Data on your device stays until you delete it or uninstall the app. Cloud backups and your account are kept until you delete them. Crash, performance and analytics data are deleted automatically after the Firebase retention periods described above. Messages you send us are kept as long as needed to deal with your request.

Your choices and rights

You can switch off crash reports, performance monitoring, usage analytics, announcements and reminders in Settings, sign out at any time, and delete your account and cloud backups from within the app.

Depending on where you live (for example under the EU and UK GDPR, the Kenya Data Protection Act, or California privacy law) you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, to withdraw consent, and to complain to your data protection authority. To use these rights email andwatiian@gmail.com from the address linked to your account. We may need to confirm it is you.

Children

Castlei is not directed at children under 13 (or the higher age required where you live), and we do not knowingly collect their personal data. If you believe a child has signed in, contact us and we will delete the account.

Security

Data is encrypted in transit, cloud backups are protected by per-account security rules, and we keep access to Firebase limited. No system is completely secure, so we encourage you to keep your own exported backups.

Changes to this policy

We may update this policy as the app changes. The effective date above shows the latest version, and we will tell you in the app about significant changes.

Contact

Ian Andwati
andwatiian@gmail.com