Privacy Policy

Effective Date: March 16, 2026  ·  Last Updated: March 16, 2026

This Privacy Policy explains how Biyaherong Chess App ("we", "our", or "us") collects, uses, and protects your personal information when you use our mobile application and website. By using our services, you agree to the practices described in this policy.

1. Information We Collect

We collect the following information when you register and use the app:

• Account information: Name and email address (via email/password registration or Google OAuth).
• Gameplay data: Puzzle attempts, puzzle ratings, streak records, analysis sessions, and tournament participation.
• Chess rating: Your ELO-based chess rating, updated as you solve puzzles.
• Profile information: Optional bio text and social connections (followers/following).
• Device data: Standard request metadata (IP address, device type) collected automatically by our server.

2. How We Use Your Information

• To provide and improve the chess coaching features (puzzles, analysis, AI coach).
• To personalise puzzle difficulty based on your chess rating.
• To display leaderboards and streak rankings.
• To authenticate your account and keep it secure.
• To respond to support requests or feedback.

3. Third-Party Services

We integrate with the following external services to deliver our features:

• Google OAuth (via Laravel Socialite): Used for "Sign in with Google". Google may collect data per their Privacy Policy.
• Google Gemini AI: Our AI Coach feature sends your chess questions to Google Gemini (gemini-2.5-flash) to generate responses. No personally identifiable information is included in AI prompts beyond the chess question itself.
• Lichess Explorer API: Used to look up master chess games for a given board position. Requests are proxied through our server — your identity is not shared with Lichess.
• Pusher: Used for real-time event delivery within the app. Pusher may process connection metadata per their privacy policy.

4. Authentication

You may register using an email address and password, or authenticate via Google OAuth. Passwords are hashed using bcrypt and are never stored in plain text. API access tokens (Laravel Sanctum) are stored on your device in AsyncStorage and are used to authenticate mobile app requests.

5. Data Storage

• Server-side: Account data, gameplay records, and analysis sessions are stored in a PostgreSQL database hosted on our secure server at biyaherongchesscoach.com.
• Client-side: Your auth token, premium status, and local usage counters are stored in AsyncStorage on your device only. This data does not leave your device except as part of API requests to our server.

6. Data Retention

We retain your account data for as long as your account is active. If you delete your account (via the in-app Delete Account option or by emailing us), your personal information and all associated data are deleted immediately from our servers. There is no grace period. See our Account Deletion page for full details and step-by-step instructions.

7. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate information via your Profile Settings in the app.
• Delete your account and associated data by contacting us.
• Withdraw consent for data processing where consent is the legal basis.

To exercise any of these rights, please contact us at the email address below. We will respond within 30 days.

8. Cookies

Our website uses a single session cookie to maintain your login state on the web dashboard. We do not use advertising, tracking, or analytics cookies. No cookie consent banner is required for a single strictly necessary session cookie under applicable law.

9. Children's Privacy

Our service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can delete it promptly.

10. Philippine Data Privacy Act Compliance

We are committed to complying with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations. As a personal information controller, we implement reasonable technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. Continued use of the app after any changes constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

---

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: