PRIVACY POLICY - STUPID HARD CHESS
Effective date: July 19, 2026
Stupid Hard Chess ("the app") is published by Yazeed Masri, an individual
developer ("I," "me," "the developer"). This policy explains what
information the app collects, why, who it is shared with, and the choices
you have. The app is available for iOS only and is distributed exclusively
through the Apple App Store.
Privacy questions: contact@stupidhardchess.com
1. SUMMARY
- You need an account to play. Signing in with Apple or Google shares your
email address and name with the app's backend.
- Gameplay analytics are anonymous. They are never linked to your account.
- Crash reports are anonymous and scrubbed of personal information.
- The free tier shows ads through Google AdMob. Personalized ads use your
device's advertising identifier only if you allow tracking when iOS asks;
if you decline, you get non-personalized ads and the app works exactly
the same. Pro subscribers see no ads at all.
- Payments are handled entirely by Apple. I never see your payment details.
- Your game history, statistics, and settings stay on your device and are
never transmitted.
- You can delete your account, and all backend data associated with it,
from inside the app at any time.
2. INFORMATION THE APP COLLECTS AND WHY
2.1 Account information (linked to your identity)
When you sign in with Apple or Google, the app creates an account using
Supabase, the app's backend service. The account stores:
- Your email address and name as provided by Apple or Google. If you use
Apple's "Hide My Email," the app receives and stores only the private
relay address Apple generates, never your real address.
- A user ID created for your account.
- Your display name (editable in the app), your Stupid Score and Stupid
Streak (the app's progression numbers), and your account creation date.
Why: signing you in, restoring your score, streak, and display name if you
reinstall the app or switch devices, and supporting account deletion. This
is the only data category linked to your identity.
2.2 Product analytics - anonymous (PostHog)
The app sends anonymous usage events to PostHog, an analytics service. For
example: app opened, tutorial steps completed, sign-in succeeded or failed,
a game started or ended (with its configuration and score change), reveals
used, ads watched, paywall viewed, purchase completed or cancelled.
- Events are identified only by a random anonymous ID generated by the
analytics software on your device.
- No directly identifying information is collected: no email, no name, no
device identifier, and no advertising identifier. (In some jurisdictions
the random ID itself is treated as pseudonymous personal data; see
section 7.3.)
- The anonymous ID is never connected to your account.
Why: understanding how the game is played so difficulty, scoring, and the
overall experience can be improved.
2.3 Crash and error diagnostics - anonymous (Sentry)
If the app crashes or encounters an error, a diagnostic report is sent to
Sentry, a crash-reporting service. Reports contain technical details: the
error and stack trace, your device model and iOS version, the app version,
and a short trail of technical log entries leading up to the error.
- Reports are not linked to your identity, and the app scrubs email-shaped
text from reports before they are sent.
- When the app shows an error screen with a support code, the same code is
attached to the crash report so I can find your report if you contact me.
Why: finding and fixing bugs and crashes.
2.4 Advertising - free tier only (Google AdMob)
The free tier of the app shows ads served by Google AdMob. Google's
software may collect your IP address, device information, and
ad-interaction data (such as which ads were shown and whether they were
tapped), under Google's own privacy policy.
- If you allow tracking when iOS shows the App Tracking Transparency
prompt, AdMob may also use your device's advertising identifier (IDFA)
to serve personalized ads.
- If you decline, no advertising identifier is used and ads are
non-personalized. Nothing else about the app changes.
- Pro subscribers see no ads, and no ad-related data is collected while a
Pro subscription is active.
Why: advertising revenue supports the free tier.
2.5 Purchases and subscriptions (Apple)
The Pro subscription is sold through Apple's App Store using Apple's own
payment system. Apple processes the payment and shares transaction
information with the app (product purchased, transaction identifiers, and
subscription status) so Pro features can be unlocked. Your payment details,
such as card numbers and billing address, stay with Apple and are never
visible to me.
Why: providing and verifying your Pro subscription.
2.6 Data that stays on your device (never transmitted)
The following exist only on your device and are never sent anywhere: your
game records and detailed statistics, saved in-progress games, app
settings, streak reminder state, and permission flags. The optional daily
streak reminder is a local notification scheduled on your device; the app
sends no push notifications and registers no push token. If you delete the
app, this on-device data is deleted with it.
3. THIRD-PARTY SERVICE PROVIDERS
The app shares data only with the service providers needed to run it. Each
receives only what its section above describes, and each handles data under
its own privacy policy:
- Supabase: backend - account sign-in and profile storage (section 2.1)
- PostHog: anonymous product analytics (section 2.2)
- Sentry: anonymous crash and error reporting (section 2.3)
- Google AdMob: advertising on the free tier (section 2.4)
- Apple: Sign in with Apple, App Store distribution, payments (section 2.5)
- Google Sign-In: authentication when you choose Google (section 2.1)
Data is processed and stored on servers located in the United States. For
users in the EEA, the UK, and Switzerland, section 7.4 describes the
safeguards applied to these transfers.
The app does not sell your personal information, and does not share it with
anyone beyond the providers listed above.
4. APP TRACKING TRANSPARENCY (ATT)
Shortly after you first sign in, iOS shows Apple's standard tracking
permission prompt. It appears because Google AdMob may use your device's
advertising identifier for personalized ads (section 2.4); that is the only
thing the permission controls in this app. Declining means ads are simply
non-personalized; every feature of the app works identically either way.
You can change your choice anytime in iOS Settings > Privacy & Security >
Tracking.
5. DATA RETENTION
- Account data (section 2.1) is kept for as long as your account exists.
When you delete your account, the authentication record and profile data
are deleted from the backend.
- Analytics and crash data (sections 2.2 and 2.3) are anonymous and are
retained by PostHog and Sentry under their standard retention policies;
because they are not linked to your identity, they cannot be traced back
to you or to your account.
- Ad data (section 2.4) is retained by Google under Google's policies.
- On-device data (section 2.6) lives and dies with the app on your device.
6. YOUR RIGHTS AND CHOICES
- Delete your account, in the app: Profile > Delete Account. This
permanently removes your authentication record and all profile data from
the backend; it is not just a sign-out. (In-app account deletion is
provided in accordance with Apple's App Store requirements.)
- Control ad personalization: decline the ATT prompt, or change it later in
iOS Settings (section 4).
- Remove all on-device data: delete the app.
- Ask questions or make a request: email contact@stupidhardchess.com.
Depending on where you live, you may have additional legal rights
regarding your personal information (such as access, correction, or
deletion); contact me and I will honor applicable requests. If you live
in the EEA, the UK, or Switzerland, see section 7; if you are a
California resident, see section 8.
7. ADDITIONAL INFORMATION FOR USERS IN THE EEA, UK, AND SWITZERLAND
If you live in the European Economic Area, the United Kingdom, or
Switzerland, this section applies to you in addition to the rest of this
policy.
Data controller: the controller of the personal data described in this
policy is Yazeed Masri (contact: contact@stupidhardchess.com).
7.1 Legal bases for processing
- Account data (section 2.1) and purchase data (section 2.5) are processed
because they are necessary to perform the contract with you (Art. 6(1)(b)
GDPR): signing you in, restoring your progress across devices, and
providing and verifying your Pro subscription.
- Analytics (section 2.2) and crash diagnostics (section 2.3) are
processed under legitimate interests (Art. 6(1)(f) GDPR) in
understanding how the game is played and in keeping the app reliable.
These interests are pursued with data deliberately engineered not to
identify you (section 7.3), and you may object at any time
(section 7.2).
- Personalized advertising (section 2.4) happens only with your consent
(Art. 6(1)(a) GDPR), given through the iOS tracking permission. You can
withdraw consent at any time in iOS Settings > Privacy & Security >
Tracking; withdrawal does not affect the lawfulness of prior processing
and does not change any app feature.
- Non-personalized advertising on the free tier is shown under legitimate
interests (Art. 6(1)(f) GDPR) in funding the free tier.
- Where processing is required to comply with a legal obligation, the
basis is that obligation (Art. 6(1)(c) GDPR).
7.2 Your rights under the GDPR
You have the right to access the personal data held about you and receive
a copy of it; to rectification of inaccurate data (your display name is
directly editable in the app); to erasure (in-app account deletion,
section 6, deletes your backend data permanently); to restriction of
processing; to data portability; to object to processing based on
legitimate interests; and to withdraw consent at any time where processing
is based on consent. To exercise any of these rights, use the in-app
controls described in section 6 or email contact@stupidhardchess.com; I
will respond within the timelines the GDPR requires (generally one month).
You also have the right to lodge a complaint with your local data
protection supervisory authority.
7.3 A note on "anonymous" data
The analytics and crash data described in sections 2.2 and 2.3 carry a
random, device-generated identifier. Under the GDPR's broad definition,
such data may qualify as pseudonymous personal data even though it
contains no name, email, device identifier, or advertising identifier and
is never linked to your account. It is handled with the same care as the
rest of your data and is covered by the rights in section 7.2.
7.4 International transfers
Data is processed and stored on servers in the United States (section 3).
Where personal data of EEA, UK, or Swiss users is transferred to the
United States, the transfer relies on the safeguards in each provider's
data-processing terms: participation in the EU-U.S. Data Privacy Framework
(and its UK and Swiss extensions) where the provider is certified, and/or
the European Commission's Standard Contractual Clauses. You can request
more detail about the safeguard applying to a specific provider by email.
8. ADDITIONAL INFORMATION FOR CALIFORNIA RESIDENTS
This section supplements the rest of this policy for California residents,
using the vocabulary of the California Consumer Privacy Act (CCPA), as
amended by the CPRA. These disclosures are provided, and the rights below
are honored, regardless of whether the CCPA technically applies to an app
of this size.
8.1 Categories of personal information
- Identifiers: email address, name, and account user ID (section 2.1).
Collected from you via Apple or Google sign-in; used for the purposes in
section 2.1; disclosed to Supabase acting as a service provider.
- Internet or other electronic network activity information: pseudonymous
usage events (section 2.2), crash diagnostics (section 2.3), and, on the
free tier, ad-interaction data collected by Google (section 2.4).
- Commercial information: subscription transaction and status information
from Apple (section 2.5).
- Sensitive personal information: none collected.
8.2 Sale and sharing
The app does not sell personal information. If, and only if, you allow
tracking at the iOS prompt, the passing of your device's advertising
identifier to Google AdMob for personalized ads may constitute "sharing"
for cross-context behavioral advertising as the CPRA defines it. To opt
out of sharing: decline the tracking prompt, or turn it off at any time in
iOS Settings > Privacy & Security > Tracking. While tracking is off, no
advertising identifier is shared and ads are non-personalized. The app
does not knowingly sell or share the personal information of consumers
under 16 years of age.
8.3 Your California rights
You have the right to know/access the personal information collected about
you; to delete it (in-app: Profile > Delete Account); to correct
inaccurate information; to opt out of sale or sharing (section 8.2); to
limit the use of sensitive personal information (not applicable; none is
collected); and to non-discrimination for exercising any privacy right:
the app never changes features or pricing based on your privacy choices.
To exercise a right, use the in-app controls or email
contact@stupidhardchess.com; requests are verified by matching the email
address of your signed-in account. You may designate an authorized agent
to act for you; the agent must provide proof of your authorization.
9. CHILDREN'S PRIVACY
The app is not directed at children under 13, and I do not knowingly
collect personal information from children under 13. If you believe a child
under 13 has created an account, contact contact@stupidhardchess.com and
the account will be deleted. Where local law sets a higher minimum age of
consent for data processing (up to 16 in some EEA countries), that higher
age applies in place of 13.
10. SECURITY
Account data is handled by established providers using industry-standard
protections, and connections between the app and its services are encrypted
in transit. No method of transmission or storage is 100% secure, but the
app is deliberately built to collect little: the only identity-linked data
it holds is the account described in section 2.1.
11. CHANGES TO THIS POLICY
If the app's data practices change, this policy will be updated and the
effective date revised. Material changes will be noted in the app or its
App Store release notes. Continued use of the app after a change means you
accept the updated policy.
12. CONTACT
Yazeed Masri, developer of Stupid Hard Chess
Email: contact@stupidhardchess.com