Privacy Policy

HiddenFlame ("we", "us", or "our") develops and operates SoftChess, a chess-puzzle game for Android and iOS. SoftChess is a single-player game: you solve mate-in-N puzzles on boards of varying size and shape, work your way up a level map, and play timed warm-up and sprint runs.

For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), HiddenFlame acts as the Data Controller for the limited analytics data described in this policy.

Contact: softchess@multitools.ovh

No Account, No Personal Details

SoftChess does not ask for and does not collect your name, e-mail address, phone number, date of birth, photos, contacts, location, or any advertising identifier. There is nothing to register and nothing to log in to.

Data Stored On Your Device Only

The game keeps a small number of files in its own private storage area on your device. They are never uploaded to us:

• Progress — levels cleared, pieces earned, which level you are standing on, the day's remaining warm-up lives, sprint runs and boss fights.
• Settings — the colour theme, the language, sound on or off, board zoom, and whether analytics sharing is enabled.
• Reminder time — if, and only if, you have turned the daily reminder on, the hour and minute you chose are stored locally and handed to your phone's own notification scheduler.

Uninstalling the app, or clearing its data in your system settings, removes all of it. We hold no copy.

Anonymous Usage & Analytics Data

If analytics sharing is enabled, the game sends anonymous product analytics to PostHog (EU cloud). Events describe what the game did, never who you are:

• App version, engine version, platform (Android / iOS), device model, screen size, and whether the build is a debug build.
• Selected theme and interface language, so we can see which ones are actually used.
• Session totals — puzzles played and solved, runs started and ended, screens opened.
• Progression milestones (e.g. "25 levels cleared") and the identifier of a level failed repeatedly in one session, which is how we find puzzles that are unfairly hard.
• Settings changed — for example switching theme, language, or sound.

Events are tagged with a random identifier that the installation generates for itself on first send. It is not derived from your hardware, your account or any device or advertising ID, and it cannot be recomputed or linked back to you by us or by anyone else. Reinstalling the app produces a new, unrelated identifier.

Feedback You Choose To Send

The Settings panel contains an optional feedback form. If you fill it in and press Send, your answers are submitted as a survey response through the same analytics channel, under the same anonymous identifier. Whatever you type into it is up to you — please do not include personal details you would rather not share. If analytics sharing is switched off, the form tells you so and sends nothing; the e-mail address in section 12 is always available instead.

Data You Do Not Have To Provide

All of the above is optional. Analytics can be turned off from the Settings panel at any time, and the game is fully playable with it off — nothing is locked behind it.

We do not sell your data. We do not use it for targeted advertising, and we do not build profiles about individual players.

Under the GDPR, we rely on the following legal bases:

• Legitimate Interests (Art. 6(1)(f)): Anonymous analytics let us see which levels are too hard, which devices struggle, and what to fix next. The data is not personal to you, cannot be traced back to you, and can be switched off — we have balanced our interest against your rights and concluded the processing is proportionate.
• Consent (Art. 6(1)(a)): Sending feedback and enabling the daily reminder are things you explicitly opt into. You may withdraw either at any time, in the app or in your device settings, without affecting processing already carried out.
• Legal Obligation (Art. 6(1)(c)): We may retain limited records where Polish or EU law requires it.

Because there is no account, no contract-based processing of personal data takes place: the game runs entirely on your device.

SoftChess is a chess-puzzle game suitable for a general audience. It contains no chat, no user-to-user communication, no user profiles, and no advertising network.

If you believe a child has nevertheless provided personal information to us — for example by typing it into the optional feedback form — write to remove-softchess@multitools.ovh and we will delete it promptly.

SoftChess uses a deliberately short list of third-party services:

PostHog (Analytics)

We use PostHog Cloud, EU region, for product analytics. PostHog is operated by PostHog, Inc. and acts as a Data Processor for us. It receives the anonymous events described in section 2 and nothing else: no name, no e-mail address, no device identifier, no advertising identifier, and no contents of your device. See posthog.com/privacy.

Apple App Store & Google Play Store

Downloading the app, and any purchase you make through it, is handled by Apple or Google under their own privacy policies. We never receive your payment card details, billing address or store account credentials — only the anonymous confirmation that an entitlement is active.

Push Notifications

The optional daily reminder is scheduled by your own device's operating system. No push service, no server and no third party is involved, and no notification token is created or transmitted.

Your game data — progress, settings and reminder time — never leaves your device. There is no SoftChess server holding a copy of it.

Anonymous analytics events are sent to PostHog's European Union cloud region and stored there. Where any processing by PostHog, Inc. takes place outside the European Economic Area, it is covered by Standard Contractual Clauses as required by GDPR Art. 46.

All data in transit is protected using TLS 1.2 or higher.

• Progress and settings — kept on your device for as long as the app is installed. Uninstalling or clearing the app's data removes them immediately and permanently.
• Analytics events — anonymous events are retained for up to 24 months and then deleted or aggregated beyond recovery.
• Feedback messages — kept for as long as needed to act on them, and no longer than 24 months.
• Legal compliance records — retained as required by applicable Polish and EU law (typically up to 5 years).
• Anything you ask us to delete — erased within 30 days of a deletion request sent to remove-softchess@multitools.ovh. See How to Request Deletion.

As a data subject in the EU/EEA, you have the following rights:

• Right of Access (Art. 15): Request a copy of any data we hold that relates to you.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to Erasure / "Right to be Forgotten" (Art. 17): Request deletion of that data.
• Right to Restriction of Processing (Art. 18): Request that we limit how we use it.
• Right to Data Portability (Art. 20): Receive it in a machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests — which you can also exercise directly, at once, by turning analytics sharing off in the Settings panel.
• Right to Withdraw Consent: Turn the reminder off, or stop sending feedback, at any time.

A note on identification (Art. 11): because analytics events carry only a random identifier and no personal details, we normally cannot connect them to a particular person. Where we are unable to identify you, we may not be able to act on an access, portability or erasure request — but you can achieve the same result yourself: switching analytics off stops all further collection, and uninstalling the app removes everything held on your device.

How to Request Deletion of Your Data

To have any data associated with you deleted, send an e-mail to our dedicated deletion address:

Write "Delete my data" in the subject line. So that we can find the right records, please include whatever of the following you have — none of it is required, and we will never ask you for personal details we do not already hold:

• The installation identifier, if you know it. It is the only key that links analytics events to your copy of the game, and it is kept in the app's own private data folder — write to us and we will explain how to read it on your device.
• The approximate date and text of any feedback message you sent us, if you want that deleted.
• The platform you play on (Android or iOS).

We confirm receipt and complete the deletion within 30 days, and we tell you what was deleted. Deletion covers the anonymous analytics events held under that installation identifier and any feedback message you sent us. Where you cannot supply the identifier, we will say so plainly rather than claim to have deleted something we could not find — the events carry no other detail that could point to you, and section 9's note on Art. 11 explains why. There is nothing else for us to delete: SoftChess has no account, and your progress and settings are held only on your own device — you remove those yourself by uninstalling the app or clearing its data in your system settings.

The request is free of charge. If you would rather stop further collection immediately, without writing to anyone, turn analytics sharing off in the Settings panel — that takes effect at once.

For every other request — access, rectification, restriction, portability or objection — contact softchess@multitools.ovh. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority. In Poland, this is the Urząd Ochrony Danych Osobowych (UODO) at uodo.gov.pl.

We implement appropriate technical and organisational measures to protect data against unauthorised access, alteration, disclosure, or destruction. These include:

• Encrypted transport for everything sent (TLS 1.2+)
• Data minimisation by design — the app collects no personal data, so there is none to lose
• Local save files written atomically, so an interrupted write cannot corrupt your progress
• Access controls limiting who on our side can reach the analytics project
• Regular security reviews

No method of transmission over the internet is 100% secure. If you spot a security problem in SoftChess, please tell us at softchess@multitools.ovh.

We may update this Privacy Policy from time to time to reflect changes in the app or in applicable law. When we make material changes, we will notify you in the app or on this page at least 14 days before the change takes effect. The "Effective Date" at the top of this page always reflects the current version.

Continued use of SoftChess after the effective date constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle data, please contact us:

• General & privacy enquiries: softchess@multitools.ovh
• Data deletion requests: remove-softchess@multitools.ovh — see How to Request Deletion

We aim to respond to all privacy-related enquiries within 30 days. For urgent matters concerning potential data breaches or misuse, please mark your message as urgent.

If you are not satisfied with our response, you have the right to lodge a complaint with the Polish data protection authority, uodo.gov.pl.