Chess Run Privacy Policy

Last updated: 20 October 2026 · Version 1.0

1. Summary

• You can play Chess Run without an account. Your game progress stays on your device.
• We do not use advertising IDs, do not track you across apps or devices and do not sell personal data.
• Detailed game diagnostics are off by default. They are available to adults only and require your explicit consent. Uploading them requires a second, separate consent.
• Parental access, purchase verification and diagnostic uploads run on our own server in Germany.
• Real-money purchases and ads are disabled in the current version. We will update this policy before enabling them.
• You can withdraw consent at any time in the settings and exercise your rights at help@morithm.de.

2. Controller

The controller responsible for processing personal data in connection with Chess Run is:

Mohammed Sayed Mahmod, trading as morithm studio
Kalbacher Hauptstraße 1
60437 Frankfurt am Main
Germany
Email: help@morithm.de

No data protection officer has been appointed because the legal requirements for one are not currently met. Please send all privacy requests to help@morithm.de.

3. Scope

This policy applies to the Chess Run mobile app for Android and iOS, to the Chess Run web pages at https://morithm.de/chess-run/ and to support requests by email. It does not apply to the webmail service at webmail.morithm.de, nor to services provided by Apple or Google, which have their own privacy policies.

Providing personal data is not required by law or contract. You can play the full game for free without giving any optional information. Only the respective extra feature (for example parental access or diagnostic upload) is then unavailable.

4. Data on your device

The app stores the following data only locally on your device. It is not sent to us:

• game progress, stars, hearts, crowns, consumables (Superslam, Revive), personal best runs, collection and task progress
• language, sound, haptics and display settings
• your consent choices with version and time
• your age group and the time you declared it (see section 5)
• if parental access is set up, a session key in protected device storage (Android Keystore or iOS Keychain, this device only)
• if purchases are enabled, a random delivery key in protected device storage that prevents duplicate deliveries

The purpose is to provide the game. The legal basis is Art. 6(1)(b) GDPR (providing the service you use). Access to your device storage is strictly necessary for this (Section 25(2) no. 2 German TDDDG). Local data is removed when you uninstall the app, unless your operating system keeps its own backup. We currently do not offer cloud sync.

5. Age declaration

On first launch you can enter your date of birth. You can skip this step. The app only derives an age group from it (under 13, 13 to 17, adult or unknown) and stores the group and the time of the declaration locally. The date of birth itself is neither stored nor transmitted.

The age group determines which features are offered: under 13 and for unknown age, purchases, ad videos and game diagnostics stay off. Teenagers need separate parental permissions for purchases and videos; game diagnostics stay off for them. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 8 GDPR and our legitimate interest in protecting minors (Art. 6(1)(f) GDPR). The self-declaration is not age verification.

6. Optional game diagnostics on your device

Detailed game diagnostics are switched off by default. Adults can switch them on in a dedicated dialog or in the settings. We use them to balance levels fairly, find difficult spots and improve performance on different devices.

When diagnostics are on, the app stores locally:

• moves, piece choices, full game states, level and run results
• decision times and pauses, UTC time, local hour and weekday
• device model, operating system and version, processor, graphics chip and memory (RAM) where available
• frame rate, loading time and memory measurements
• game events and events of voluntary reward videos (once ads are enabled)

We do not record names, email addresses, advertising IDs, serial numbers, location data, parental sessions or purchase receipts. The data is nevertheless not automatically anonymous, because combinations of values can allow conclusions about a person.

At most 60 MiB are kept locally for at most 14 days. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Switching diagnostics off stops recording and deletes the local diagnostic files. You manage any copies you export yourself.

7. Sharing diagnostics with us

Only if you additionally and separately agree to sharing does the app send new diagnostic events to our server over HTTPS. Events recorded earlier are not uploaded retroactively.

• Data: the diagnostic events listed in section 6 plus a randomly generated diagnostic credential that links your sessions. The server only stores a hash of this credential. The data is pseudonymous.
• Purpose: game and performance analysis, balancing and bug fixing. The data is not used for advertising, personalised prices or hidden difficulty changes, and it is not shared with advertising companies.
• Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
• Retention: raw data is deleted automatically 30 days after receipt; the deletion job runs every hour. If your device is offline, at most 5 MiB wait locally for at most 14 days.
• Withdrawal: when you turn sharing off, uploads stop immediately and the app requests deletion of your server data. If you are offline, the app retries the request on the next active launch. A hash of the revoked credential is kept without any game data as a block marker so that late transmissions are rejected. If you uninstall the app before deletion succeeds, the automatic 30-day limit still applies.

Web server access logs are switched off for this upload path. Your IP address is processed technically to establish the connection, but it is not stored and not used as an identifier.

8. Parental access

You set up parental access only yourself and voluntarily. We then process:

• the parent's email address and a confirmation email with a one-time code
• separate permissions for purchases and for voluntary ad videos
• a PIN, one-time codes and session keys, each only as a secured hash, never in plain text
• time-limited, hashed counters to prevent abuse

The purpose is the parental control for purchases and videos that you request. The legal bases are Art. 6(1)(b) GDPR (providing the requested feature) and Art. 6(1)(f) GDPR (protecting minors and preventing abuse).

One-time codes expire after 10 minutes, sessions after 30 days and abuse counters after 24 hours. The parent account remains until you delete it. You can delete it in parental settings with your PIN; the account, sessions and pending confirmations are removed immediately. Alternatively, we will help you via our data deletion page. Uninstalling the app does not delete a parent account automatically.

The email address and self-declaration do not prove age or parental responsibility. We do not send marketing emails.

9. Purchases

Real-money purchases are disabled in the current version. When we enable them, the following applies:

• Apple (App Store) or Google (Google Play) process the payment as independent controllers. We do not receive payment data such as card numbers.
• Our verification server receives the product, the purchase receipt and, where applicable, a signed store account proof. It verifies the purchase with Apple or Google and stores the transaction ID, product, verification environment, verification times, refund events and hashed proofs.
• A hash of your random delivery key prevents the same purchase from being delivered more than once. It is not used for advertising or diagnostics.

The legal bases are Art. 6(1)(b) GDPR (performance of contract), Art. 6(1)(c) GDPR (commercial and tax record-keeping obligations) and Art. 6(1)(f) GDPR (fraud prevention). We keep transaction data for as long as statutory retention periods require (up to 10 years under Section 147 German Fiscal Code and Section 257 German Commercial Code) and delete it afterwards.

10. Advertising

Ads are disabled in the current version. Google's advertising SDK is technically included in the app package, but it is not started and sends no data.

If we enable ads, there will only be voluntary reward videos that you open yourself. Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) would then process device and advertising data. Before that we will ask for any consent required by law through Google's consent dialog; you can reopen your choice in the settings. There are no videos for under-13s or unknown age, teenagers need parental permission, and minors do not receive personalised ads. We will update this policy before ads go live.

11. Support requests by email

If you write to help@morithm.de, we process your email address, the content of your message and any information you choose to provide. The purpose is to handle your request. The legal basis is Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR for other requests. We delete support messages when they are no longer needed, at the latest 24 months after the last message, unless a statutory retention obligation applies. Please do not send us PINs, passwords or full purchase receipts.

12. These web pages

The Chess Run web pages are static. They use no cookies, no analytics or tracking tools and load no content from third-party servers (no external fonts, scripts or maps). When you visit them, the web server technically processes your IP address to deliver the page. Access logs are switched off for these pages. The legal basis is Art. 6(1)(f) GDPR (secure delivery of the website).

13. Server, hosting and email delivery

Our server services (parental access, purchase verification, diagnostic upload, web pages and email delivery) run on our own server at STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, in a data centre in Germany. STRATO processes the data as a processor under Art. 28 GDPR. The domain morithm.de and its DNS are managed by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. netcup only resolves names and receives no content from our services.

All connections are encrypted with HTTPS (TLS). The services do not log PINs, session keys or purchase receipts. Access logs are switched off for the Chess Run paths. The mail system keeps technical delivery logs with recipient address and time to ensure delivery; these logs are deleted automatically after at most 5 weeks. General web server error logs are deleted after at most 14 days. We do not create additional backup copies of Chess Run server data.

14. Recipients

We do not sell personal data and do not share it for advertising purposes. Recipients may be:

• STRATO AG as hosting processor
• Apple and Google as app store operators, once purchases are enabled (independent controllers)
• Google AdMob, once ads are enabled and you have consented
• the recipient's email provider for confirmation emails and support replies
• public authorities where we are legally obliged

15. International transfers

Our server is located in Germany. We do not ourselves transfer diagnostic, parental or purchase verification data outside the EU/EEA. Apple and Google may also process data in the USA as part of their own services. Both are certified under the EU-US Data Privacy Framework, which is covered by the European Commission's adequacy decision of 10 July 2023; they additionally use standard contractual clauses.

16. Retention overview

• Local game data: until you uninstall or delete it
• Local diagnostics: at most 14 days, at most 60 MiB
• Diagnostics on the server: 30 days, or earlier after withdrawal
• Block marker after withdrawal: hash without game data, for as long as the diagnostics service exists
• Parental one-time codes: 10 minutes; sessions: 30 days; abuse counters: 24 hours
• Parent account: until deleted
• Purchase and transaction data: statutory retention period, up to 10 years
• Support messages: up to 24 months after the last message
• Mail delivery logs: at most 5 weeks; web server error logs: at most 14 days

17. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)), most easily in the app settings.

To do so, write to help@morithm.de. We reply within one month. Diagnostic data is stored pseudonymously. So that we can match it to you, please use the deletion feature in the app or give us the details shown in the app. We do not ask for additional identity documents unless necessary.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Our competent authority is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information)
Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany
https://datenschutz.hessen.de

18. Children and teenagers

Chess Run can be played without any personal data. For children under 13 and for unknown age, purchases, ad videos and game diagnostics are switched off. Teenagers aged 13 to 17 can use purchases and videos only with separate parental permission; game diagnostics stay off for them. We do not build advertising profiles of minors. If you believe we have accidentally processed a child's data, please contact us.

19. No automated decisions

We do not make automated individual decisions within the meaning of Art. 22 GDPR. Level difficulty is fixed and is never secretly adjusted to your behaviour, your record or your willingness to pay. There are no personalised prices.

20. Security

We protect data with encrypted transmission, hashed secrets, protected device storage, disabled access logs for the Chess Run paths, rate limiting and short retention periods. No system is completely secure. Please report security issues to help@morithm.de.

21. Regional information

• USA and California: We do not sell personal information and do not share it for cross-context behavioural advertising. You can request access, correction and deletion; we will not discriminate against you for exercising your rights. We do not knowingly collect personal information from children under 13 for advertising or profiling.
• United Kingdom: The rights above apply under the UK GDPR. You can also complain to the Information Commissioner's Office (ico.org.uk).
• Switzerland: The rights under the Federal Act on Data Protection (FADP) apply. The competent authority is the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
• Brazil: You have the rights under Art. 18 LGPD, including confirmation, access, correction, deletion and withdrawal of consent.
• Other countries: You can also exercise your rights under your local law at help@morithm.de.

22. Changes to this policy

We update this policy when the app, our services or the law change, in particular before purchases or ads are enabled. The current version is always available at https://morithm.de/chess-run/privacy/ and in the app. If a material change requires new consent, we will ask for it again in the app.

If the language versions differ, the German version prevails.

Versions: 1.0 of 20 October 2026 (first published version).