Privacy Policy

What stays on the device

Everything about the game is computed on the phone in your hand and drawn there: which moves are legal, the engine's search, the win-rate curve, the grade given to each move and the written advice that comes with it. The engine was written for this project in C++ and runs inside the app - it does not consult a chess server, and the per-move explanations are assembled from rule and template tables shipped in the package, not from a language model and not from any cloud API.

Your games live in the app's own storage on the device: the score sheet of each game, the last fifty of them, your settings, and the note saying whether you unlocked the deep review for a given game. There is no account to open, no profile to fill in, and no copy of any of it on a server we or anyone else runs.

What that means in practice: a board position, a move list, a saved game, an exported .xq file and a share code never appear in a network request. The five events described under "Crash and usage reporting" count what you did in general terms - how a game opened, how it ended, how long it ran - and nothing in them can be traced back to a position you played.

When the app reaches the network

There are exactly two reasons this build touches a network, and neither of them is a server of ours: the rewarded video that unlocks the deep review, served by Google Mobile Ads (AdMob), and the crash and usage reporting handled by Google Firebase (Analytics and Crashlytics). Everything else - the rules, the search, the review, the archive, the exports - is offline by construction.

The timing is worth stating precisely, because it is what you can actually verify in a packet capture. Firebase begins at launch: opening the app records a session, and the batch goes out when a connection allows it. The advertising component behaves the other way round - it is not asked for anything until you tap "watch the video to unlock", so simply starting a game on a plane costs you an ad request. A crash is written to a queue on the device the moment it happens and is delivered with the next connection rather than at the moment of failure.

Play needs no connection at all. The only feature that does is the deep review, because the thing that pays for it is a video: offline, that one entry point is greyed out and the app says why. Everything else keeps working - the free part of a review included.

The rewarded video

• What it unlocks. Every review opens with the free part: the full move list, a grade against each move, both sides' accuracy and the win-rate curve. Behind one rewarded video sit the per-move advice and the better move for that game. Watch it through and the game is unlocked; the unlock is recorded on your device, so reopening that game does not ask you again. Close the video early and nothing is paid out. If no ad is available at that moment - no fill, a load that ran past fifteen seconds, a device with no route to the network - the app says so on the spot, unlocks nothing, and lets you try again later.
• What is not behind an ad. Nothing else. All three strengths, both colours, two-players-on-one-device, the whole archive, replay, .xq export and import, share codes, report export and every setting are in the download. A game whose deep review you never unlocked still gives you the grade sheet and the curve for all fifty of your saved games.
• Who serves it. The video is chosen, delivered and measured by a third-party ad network, Google Mobile Ads. This app does not host the creative, does not choose which video you see, and does not sell or rent the placement to anybody.
• What that network may process. Under Google's own policy (https://policies.google.com/privacy) its SDK may use your device's advertising identifier together with device and session information to select, deliver and measure ads. Into that request this app puts two things: the ad unit identifier and the app's version. No name, no email address, no account, no contacts, no location, no board and no move list.
• What you control. Android lets you reset or delete the advertising identifier in the system's own ad settings, and Google's Ad Center (https://myadcenter.google.com) is where you review or turn off personalised advertising. Neither choice locks you out of anything here: the video is optional in every game, and declining it costs you no content that the download already gave you.

Crash and usage reporting

Two Google components are bundled in this build: Firebase Analytics, which counts how the game is played, and Firebase Crashlytics - including its NDK half, which is what catches faults in the native core.

• What this app puts in. Five events, and every field in them is a number or a short fixed label about the game. game_started carries the mode (against the computer, or two players on one device) and the strength (casual, amateur, master). game_completed adds who won and why - checkmate, stalemate, perpetual check, threefold repetition, sixty moves without a capture, resignation, agreed draw - and how many moves were played. reward_requested marks the attempt, reward_result its outcome (earned, closed early, no fill, offline, timeout, load failed, show failed), and deep_review_unlocked the length of the game that got unlocked. The two reward events exist because the gate needs measuring: without them we cannot tell "nobody wants the deep review" from "the ad never came back".
• What a crash report holds. If a frame or a routine fails, its message and stack trace are collected, native code included - which matters here because the rules and the search run in the C++ core rather than in the interface layer. The release build is not obfuscated, so that trace names the function that failed. It does not name you.
• What none of these carry. No position, no move list, no saved game, no share code, no exported file, no name, no email address, no telephone number, no contacts, no photographs. Nothing in the app puts a single stone of your game into a report.
• What Google adds on its own. Its SDKs attach their own context to every message: an installation identifier for this copy of the app on this device, a session identifier, the app version, the device model, manufacturer and operating-system version, screen size, processor architecture, memory and free storage, display language, time zone, carrier and mobile country code, timing, and the IP address of the request - from which Google infers an approximate location at city or region level. This app never asks for a location permission and never reports a coordinate. Because the ad runtime brings in the advertising-identifier permission, Google may also use that identifier under its own policy; this app never reads or stores it.
• Where it goes and what you can do. All of it lands in Google's Firebase service, not on a server we run. The developer reads aggregate counts in the Firebase console, keeps no copy, and does not link this data to any advertising account, sell it, or use it for attribution across apps; retention follows Google's rules, set out at https://policies.google.com/privacy and https://firebase.google.com/terms. There is no in-app switch for either component. What you can do is reset or delete the advertising identifier in Android's own ad settings - which costs you the game nothing - or keep the device offline, in which case reports sit in the local queue and never leave. After an uninstall we can delete the records tied to that anonymous installation ID if you write to the address below. A separate development build, whose package name ends in .debug, is registered as its own Firebase app, so test traffic never mixes with production counts.

Permissions and file access

Two permissions are declared by the app itself: INTERNET, which is the rewarded video and the two Firebase components, and ACCESS_NETWORK_STATE, which exists only so that the "watch the video" entry can be greyed out before you tap it on a phone with no route to an ad network, instead of leaving you watching a spinner.

Whatever else you find in the installed package - the advertising-identifier permission, the ad-services permissions, the install-referrer permission that comes with the statistics runtime - was merged in by Google's own libraries and belongs to those SDKs rather than to anything this game does by hand. None of them gates content: whatever their state, every rule, every strength, every saved game and every export works.

The app asks you for no runtime permission at any point. Nothing on Android's dangerous list is requested: no location, no camera, no microphone, no contacts, no call log, no SMS, no calendar, no broad storage access. When you export a game or a report, and when you import an .xq file, the system's own file picker opens and you name the destination or the file each time; the app keeps no standing read over your device's files.

Backups and moving to a new phone

Being exact about this one, because it is easy to get wrong: the app does allow Android's own backup. That means the saved games and settings in the app's private storage can be taken by Google's backup service and restored when you set up a new device or reinstall. The transport and the retention of that backup are Google's, not ours - we neither operate it nor can read what it holds. If you would rather your games did not travel, turn backup off for this app in your device's Google settings; deleting a saved game inside the app removes it from the device, and it is the system's backup that decides whether a copy of it still waits in your Google account until the next restore.

What the app does not do

No accounts, no cloud saves, no leaderboards, no chat, no push notifications, and no cross-app or cross-site tracking performed by this app itself. Outside the ad slot and the Firebase reports - both of which are Google's to process - the app makes no third-party network call. There is no analytics of our own, no server of our own, and no advertising, fingerprinting or location identifier read or written by our code.

Retention and deletion

Everything the app knows about how you play - games, grades, unlock flags, settings - lives in the app's storage on your device. Deleting a saved game in the app removes that record; uninstalling removes the lot, subject to the backup described above. There is no user record on our side to look up, export, merge or hand over, because there is no service that could hold one. The events and crash reports leave your device at the moment they are sent and are then held by Google under its own retention rules; the developer keeps no copy, and since nothing in them names you, no record that we hold can be tied back to your identity.

Children

This app is not directed at children, is not designed or marketed for them, and is not submitted to Google as a child-directed or target-audience-under-ten app. We collect no personal information from anyone, child or adult: there is no account, no nickname, no contact import and no messaging. The device and session information that Google's advertising and statistics SDKs use on their own behalf is handled under those services' own policies, as set out above.

Third-party components

• Google Mobile Ads SDK (com.google.android.gms:play-services-ads 25.5.0, Google LLC) - only for that one rewarded video. Privacy disclosure: https://policies.google.com/privacy
• Firebase Analytics, Firebase Crashlytics and the Crashlytics NDK reporter (com.google.firebase:firebase-analytics, :firebase-crashlytics, :firebase-crashlytics-ndk, all versioned by the Firebase BoM 35.0.2, Google LLC) - usage counts and crash reports, open source under Apache-2.0 but running on top of Google Play services. Terms: https://firebase.google.com/terms
• AndroidX, Jetpack Compose and the Kotlin runtime - platform libraries, no collection of their own.

Everything else in this app is written for the project: the rule core and the search engine, the review analysis and the explanation tables for all three languages, the opening book, the board and piece artwork drawn by code, and the sound effects, which are synthesised on the fly so that no audio asset and no third-party sound pack ships in the package. No external Chinese chess engine's code or binary is included, linked or derived from - the engine is ours.

If a later version adds a third-party component or asset, it will be named here with its licence.

Contact

Operator: Beijing Blue Ocean Xinfan Technology Co., Ltd
Privacy and support email: howoo.bluesail@gmail.com

Please mention "Xiangqi" and what you would like done. You can also reach us through the support link on the app's Google Play product page. We do not ask for unrelated personal details to answer an ordinary question - and since the game holds no server-side record of you, there is usually nothing on our side to act on. What the advertising and statistics components collect is Google's to handle under its own policy.