Legal

Privacy Policy

Effective date: October 26, 2026

This Privacy Policy explains what information Chaal processes, why, and the choices you have. It applies to the Chaal Android app, the browser version at /play/ and this website (together, the “service”).

1. Who we are

Chaal is a chess learning and playing game developed and operated by Tanvir Mahin (“we”, “us”), published on Google Play under the developer name inovit-bd. You can reach us at tanvirmahin24@gmail.com.

2. Information we process

2.1 Nickname, avatar and language

You choose a nickname, an emoji avatar and a language (English, Bangla or Hindi). Your nickname and avatar are visible to other players in games, on the leaderboards and in their game history. Your language decides which language the game shows you.

2.2 Player ID and access token

When you sign up, our server gives you a Player ID (a number) and a secret access token that signs you in. The token is stored on your device; our server stores only a SHA-256 hash of it.

2.3 Games

For each finished game against a bot or a person we store the date, the kind of game (bot, friend or Quick Match, rated or not), both players' nicknames and avatars, the result, how it ended and the moves (as PGN). We use them for your stats and recent games. Pass & play games on one phone are not stored.

2.4 Progress

We store, with your Player ID: the stars you earned in each lesson; the puzzles you tried and whether you solved them; your daily puzzle results (the day, whether you solved it and how long it took); your puzzle rating and game rating; your gold and the board themes and piece sets you own; your XP and level; your learning streak; how many free hints you used today; and the day you last collected the free daily gold. We use this to run the course, the puzzles, ratings, rewards and leaderboards.

2.5 Leaderboards

The in-game leaderboards list top players by game rating, puzzle rating, level and today's fastest daily-puzzle solves, with each player's nickname, avatar and supporter badge.

2.6 Live gameplay data

While you play online, our server processes room codes, Quick Match searches, moves, clocks, draw offers and preset emoji reactions. There is no free-text chat. Live data stays in memory and is discarded when the room closes; finished games are stored as described in 2.3.

2.7 Technical data

To deliver the service we process your IP address and connection metadata. Our game server does not write IP addresses to its logs. Traffic passes through Cloudflare, and the server runs on a rented virtual server; these providers may keep standard access and security logs for a limited time (typically up to 30 days).

2.8 Friends and invites

If you use friends, we store your friend connections, requests and blocks. Friends see your nickname, avatar and online status and can invite you to a game while you're online. Invites are not stored.

2.9 Purchases

The Android app offers Premium (a one-time purchase: no ads, unlimited hints, every board and piece set, 5,000 gold and a supporter badge) and gold packs. Google Play handles the payment; we never see your card or bank details. We store the receipt's purchase token, order number, product and time with your Player ID, and your Premium status. Nothing can be bought in the browser.

2.10 Google Play Games

In the Android app you can use Google Play Games achievements and leaderboards, which go to Google under the Google Privacy Policy. You can also connect your Chaal account to Google Play Games (the app asks before a purchase) so it comes back if you reinstall or change phones. For that we receive and store only your Play Games player ID; we don't receive your email address, Google account details or Play Games friends.

3. Ads

Chaal is free and paid for by ads. Without Premium you may see a full-screen ad at a natural break (after a finished game, a lesson or a few puzzles, at most once every three minutes), and you can choose to watch rewarded ads for free daily gold, extra hints or to double a win's gold. The ads come from Google, which collects and uses information as described in the Google Privacy Policy and How Google uses information from sites or apps that use its services. We don't pass your Player ID, nickname or game data to Google's ad services.

In the Android app (Google AdMob): the Google Mobile Ads SDK collects your advertising ID and app set ID, your IP address (from which Google may estimate an approximate location), ad and app interactions, and diagnostic information, for advertising, analytics and fraud prevention.

In your browser (Google AdSense): Google and its partners use cookies and similar technologies to serve and measure ads, including ads based on your visits to this and other websites.

Your choices: where the law requires it (for example the EEA, UK and Switzerland, and some US states), Google's consent message asks for your choice, and Ad privacy choices in Settings lets you change it. On Android you can reset or delete your advertising ID or opt out of personalised ads in your device settings, and you can turn off personalised ads in Google's ad settings. Premium turns ads off completely.

4. Information stored on your device

The app (or your browser) stores your access token and your preferences: language, sound, vibration, board theme and piece set, coordinates, move dots, the clock you last picked, the bot colour you like, the time of the last ad and the version you last saw. Google's ad and consent tools may store information too. Clearing the app's data removes this from your device but does not delete your account (see section 10).

5. Information we don't collect

We don't collect your email address, phone number, real name, contacts, precise location, photos, files or payment details. Chaal has no analytics SDK of its own.

6. How we use information

Only to run your account; run lessons, puzzles and games; match you with friends and Quick Match opponents; show your stats, ratings, streak and leaderboards; keep your gold and items; credit purchases and rewards; show Google's ads to players without Premium; and keep the service secure and fair (for example against cheating or rating abuse).

7. Legal bases (EEA and UK)

Contract, to provide the game you asked to use (account, lessons, puzzles, games, progress, purchases). Consent, for ads where the law requires it; you can withdraw it in Settings. Legitimate interests, to keep the service secure and fair and to fund it with non-personalised ads; you can object (section 10).

8. Sharing

We don't sell your personal data for money. We disclose it only to our service providers (Cloudflare and our server host), to Google for ads (players without Premium) and for the Google Play features you choose to use, or where the law requires it. Other players see what section 2.1, 2.5 and 2.8 describe.

9. How long we keep information

Account, games and progress: until you delete your account. Friend connections: until removed or either account is deleted. Purchase records: until you delete your account. Live gameplay data: until the room closes. Infrastructure logs: up to about 30 days. Ads data: kept by Google under its policy.

10. Deleting your account and your rights

In the app: Settings (⚙️) → Delete account. It's immediate and permanent. By email: write to tanvirmahin24@gmail.com with your Player ID (shown in Settings); we handle requests within 30 days. See Delete your account.

Deleting your account removes your nickname, avatar, Player ID, token hash, lesson stars, puzzle and daily-puzzle results, ratings, gold, items, streak, purchase records, the link to Google Play Games and every device's sign-in, and your friend connections. Games you played against other people stay in their history with your name removed.

Depending on where you live, you may have the right to access, correct or delete your data, object to processing, and withdraw consent. Email us with your Player ID. In the EEA or UK you can also complain to your data protection authority. US states (including California): we don't sell personal information for money; Google's personalised ads may count as “selling” or “sharing” under some laws, and you can opt out with the choices in section 3 or by getting Premium. We won't discriminate against you for using your rights.

11. Android permissions

INTERNET (to play and for Google's services), VIBRATE (haptics), BILLING (purchases), ACCESS_NETWORK_STATE (to retry when you're back online), and permissions added by the Google Mobile Ads SDK: AD_ID, ACCESS_ADSERVICES_* (Android's Privacy Sandbox), WAKE_LOCK and FOREGROUND_SERVICE.

12. Security

Data travels encrypted (HTTPS and secure WebSockets) and access tokens are stored only as hashes. No system is perfectly secure, but we work to protect your information.

13. Children

Chaal is not directed to children under 13, and we don't knowingly collect personal data from children under 13. If you believe a child under 13 is using Chaal, email us and we'll delete the account.

14. International transfers

Our server and providers may process data outside your country. Where required, we rely on appropriate safeguards such as the providers' standard contractual clauses.

15. Changes

We'll post any changes on this page and update the date above; for significant changes we'll also tell you in the game.

16. Contact us

Tanvir Mahin · tanvirmahin24@gmail.com