Privacy Policy

Effective date: 22 July 2026  ·  Last updated: 22 July 2026

This Privacy Policy explains what information the Brilliant Chess mobile application (the “App”) collects, why we collect it, how we use and share it, and the choices and rights you have. Please read it together with our Terms of Service.

The Brilliant Chess app is provided by Sunrise Labs, the trading name of Eleftherios Katiforis, based in Greece (“Sunrise Labs”, “we”, “us”, or “our”). We are the controller of the personal data described in this Policy. You can reach us at [email protected].

1. What we collect (at a glance)

You can use Brilliant Chess as a guest (an anonymous account with an auto-generated name) or by signing in with Google or an email address. The table below summarizes our data practices; each item is explained in the sections that follow.

Category	Examples	Why	Shared?
Account & identity	Username, email (if you sign in), country, timezone	Run your account, sync progress, leaderboards	Not sold; username & country are public in-app
Gameplay	Puzzle/game results, ratings, XP, streaks, game records (PGN)	Provide the game, progression, leaderboards, anti-cheat	Ratings/scores public in-app; games only to opponents or via a share link (see §11)
Purchases	Google Play purchase tokens, order IDs, product, price, subscription status	Deliver purchases & subscriptions	Processed with Google Play
Device & technical	Install identifier, device model/OS, app version, crash logs	Run the App, keep it stable, prevent abuse	Diagnostics processed by Google/Firebase
Advertising	Advertising ID and ad interactions (with your consent where required)	Show ads that keep the App free	Shared with Google AdMob for ads
Usage & analytics	Screens viewed, features used (aggregated/bucketed)	Understand and improve the App	Processed by Google/Firebase
Support & reports	Messages you send us, plus your device model/OS	Answer support requests, review reported content	Not shared externally

We do not operate any chat or messaging between users, and we do not collect your precise (GPS) location, contacts, photos, camera, microphone, or health data. We do not sell your personal data for money.

2. Sources of information

• Directly from you — e.g., the username you choose, your country if you change it, and the content of any feedback, support message, or report you send.
• Automatically from your device — e.g., an install identifier, device/OS information, app version, crash reports, and (with consent where required) usage analytics and advertising identifiers.
• From third parties who help run the service — your sign-in provider (Google or Firebase Authentication) confirms your email and account; Google Play confirms your purchases; and, at sign-up, your approximate country is derived from your network (IP) address at our security edge provider. We use the IP address only transiently and do not store it in our user database (see §3).

3. Information we collect in detail

Account & identity

• Account identifier — a unique ID for your account (from Firebase Authentication).
• Email address — collected only if you sign in with Google or with an email and password. Guest (anonymous) accounts have no email. Your password, if you use one, is handled entirely by Firebase Authentication; we never see or store it.
• Username / display name — chosen by you (guests receive an automatically generated name such as Guest12345678). Usernames are public within the App.
• Country — a coarse, country-level value shown as a flag on your profile. It is detected once at sign-up from your IP address (see below) and you can change it at any time. This is not GPS location and not your device language.
• Timezone — used for daily goals, streaks, and reminders.

Gameplay data

Your puzzle and game activity, including results, puzzle and game ratings, XP and level, streaks, achievements, clan membership, and the move records (PGN) of games you play. Some of this (such as ratings and scores) is visible to other players and on leaderboards; game records are shared only with your opponent or with anyone you give a share link to (see §11). This data is used for progression, matchmaking, and fair-play enforcement.

Purchases & subscriptions

When you buy a subscription or an in-app item, purchases are processed by Google Play. We receive and store the purchase token, order ID, product ID, price and currency, and subscription status (e.g., active, cancelled, expiry) so we can grant and manage your entitlements. We do not receive or store your card or payment-instrument details — those stay with Google.

Device & technical data

• Install identifier — a random identifier generated on your device to synchronize your progress across sessions and devices. It is not a hardware serial number and not an advertising ID, and it resets if you reinstall or clear the App’s data.
• Diagnostics & crash reports — collected via Firebase Crashlytics to keep the App stable (e.g., error reports, and basic device state such as model and operating-system version).
• Device model & OS version — additionally attached to feedback and puzzle reports you submit, so we can reproduce issues.
• Push token — a Firebase Cloud Messaging token so we can deliver the notifications you have enabled (see §9).
• Advertising ID — see §7.

Usage & analytics

Where permitted (and, in the EEA/UK, subject to consent — see §8), we collect aggregated usage events such as screens viewed and features used. Analytics attributes are bucketed (for example, a level range or subscription tier rather than exact figures), and your account identifier is attached to analytics only when you have granted analytics consent.

On-device storage

The App also stores data locally on your device — such as your settings, consent choices, and cached game/puzzle progress — using standard app storage. This stays on your device and is cleared when you delete your account or uninstall the App.

IP address (used, not stored)

Like any internet service, our servers and providers necessarily receive your IP address to deliver the service. We use it transiently — to protect the service against abuse (rate-limiting) and, at sign-up, to derive your approximate country. We do not store your IP address in our user database. Our edge provider (Cloudflare) and other providers may process it as part of routing and security.

What we do not collect

We do not provide user-to-user chat or messaging, and we do not collect precise/GPS location, contacts, calendar contents, photos, files, camera or microphone input, or profile photographs. In-app avatars are decorative game items, not pictures of you. We also do not intentionally collect special-category (“sensitive”) data — such as data revealing your health, religion, ethnicity, political opinions, or sexual orientation — and we ask that you do not put such information in your username or messages to us.

4. How we use information

• Provide, maintain, and synchronize your account, progress, purchases, and gameplay.
• Operate online play, leaderboards, clans, friends, and tournaments.
• Process and manage subscriptions and in-app purchases with Google Play.
• Protect the App and our users — security, rate-limiting, fraud prevention, and fair-play / anti-cheat enforcement (see §6).
• Diagnose crashes and improve reliability and performance.
• Understand and improve the App through analytics (subject to consent where required).
• Show advertising that keeps the App free (subject to consent where required).
• Send notifications you have enabled and respond to your support requests, feedback, and reports.
• Comply with legal obligations and enforce our Terms.

We may also create and use aggregated or de-identified information (which no longer identifies you) for analytics, research, and improving the App.

5. Legal bases (GDPR)

If you are in the EEA or the UK, we rely on the following legal bases:

Purpose	Legal basis
Providing your account, gameplay, sync, and purchases	Performance of a contract (Art. 6(1)(b))
Security, rate-limiting, fraud & cheat prevention, aggregate diagnostics, and improving the App	Our legitimate interests (Art. 6(1)(f))
Personalized advertising, analytics that use device identifiers, and push notifications	Your consent (Art. 6(1)(a)), which you can withdraw at any time
Meeting our tax, accounting, and other legal obligations	Compliance with a legal obligation (Art. 6(1)(c))

6. Automated processing & fair play

We do not use automated processing to make decisions that produce legal or similarly significant effects about you, except that we use automated systems, together with human review, to detect cheating and abuse (for example, engine assistance in online play). Where such systems flag an account, we may restrict play, remove ratings, or suspend the account. You can contest an enforcement decision by contacting [email protected].

7. Advertising and your choices

The App shows ads through Google AdMob to keep it free. Advertising can involve an advertising identifier and information about your interaction with ads.

• EEA / UK: before any advertising or analytics storage is used, we ask for your choices through Google’s consent tool (a certified Consent Management Platform). Until you make a choice, ad and analytics storage remain disabled by default. You can review or change your choices at any time via Privacy Settings in the App.
• Personalized vs. non-personalized ads: if you do not consent to personalized ads, we may still show non-personalized ads, which use limited data.
• Device controls: you can reset or delete your advertising ID, or opt out of ad personalization, in your Android device settings.

For more about how Google uses data for advertising, see Google’s Privacy & Terms.

8. Analytics

We use Firebase Analytics to understand how the App is used so we can improve it. In the EEA/UK, analytics runs under Google Consent Mode with storage disabled by default: until you consent, the SDK sends only limited, cookieless pings that do not use device identifiers or your account ID. If you consent (or where GDPR does not apply), we collect fuller analytics, including aggregated, bucketed attributes linked to your account ID. Analytics never includes your raw personal details, and you can change your choice at any time via Privacy Settings in the App — the same control governs both analytics and advertising storage.

9. Communications & notifications

With your permission, we send push notifications (via Firebase Cloud Messaging) and schedule local reminders on your device. These include gameplay and social alerts (such as friend requests, game challenges, and league results), re-engagement reminders, and daily-goal or streak reminders. You control these:

• In the App: notification categories and daily-goal reminders can be toggled in settings.
• On your device: you can turn off notifications for the App at any time in your Android system settings.

We use your email address only to operate your account (for example, sign-in and account-related messages) and to answer support requests — not for third-party marketing.

10. How we share information

We share personal data only as described here. We do not sell your personal data for money.

• Google / Firebase — Authentication, Cloud Messaging (notifications), Crashlytics (diagnostics), and Analytics act as our service providers/processors. (Firebase privacy, Google Privacy Policy)
• Google AdMob — for advertising; this may involve sharing an advertising identifier as described in §7. (AdMob & data)
• Google Play — processes and verifies your purchases and subscriptions. (Google Privacy Policy)
• Cloudflare — our network/security edge provider, which processes requests (including IP addresses) to route traffic and protect against abuse. (Cloudflare privacy)
• Lichess — for position analysis (cloud evaluation) and endgame-tablebase features, the App may send a chess board position only (in standard FEN notation) to Lichess servers. No account identifier, email, or device identifier is sent with these requests. (Lichess privacy)
• Legal & safety — we may disclose information if required by law or to protect the rights, safety, and integrity of our users and the service.
• Business transfers — if we are involved in a merger, acquisition, or sale of assets, information may be transferred, subject to this Policy.

Some jurisdictions (such as California) define “sharing” or “sale” broadly to include the use of advertising identifiers for personalized advertising. Where that applies, you can opt out as described in §7 and §16.

11. Information visible to others

Brilliant Chess is a social game. The following are public within the App and can be seen by other players (and, where profiles are accessible, by others outside the App): your username, country flag, level and ratings, streaks and scores, cosmetic items (avatars and frames), achievements, clan name, friend count, your premium status, your league and ranking, when your account was created, and your strongest and weakest puzzle themes. Leaderboards display your username, rank, and score.

The game records of games you play are not published on your public profile: an online game is visible to your opponent, and to anyone you give a share link to. Please keep public visibility in mind when choosing a username — do not use personal information you do not want to be public.

12. International transfers

We and our providers (including Google and Cloudflare) may process your information on servers located outside the EEA/UK, including in the United States. Where we transfer personal data internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

13. Data retention

We keep personal data only for as long as we need it for the purposes in this Policy. When you delete your account (see §15), we delete or anonymize your data, subject to the exceptions below.

Data	Retention
Account, profile & gameplay data	While your account is active; deleted or anonymized when you delete your account.
IP address	Not stored in our user database. Used transiently for security (rate-limiting), where it expires within minutes. Any IP address in edge or server request logs is retained only per our providers’ standard log-retention periods.
Online games played against others	Retained in anonymized form (your identity removed) so opponents keep their history and for anti-cheat integrity.
Purchase & subscription records	Deleted from our systems when you delete your account. Google Play, as the seller of record, separately retains transaction records as required by law.
Diagnostics & analytics	Retained by Google/Firebase according to their default retention periods.
Backups	Residual copies may persist in routine backups for a limited period before being overwritten.

14. Your privacy rights (GDPR)

If you are in the EEA or the UK, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time (without affecting prior processing). You can exercise many of these directly in the App (edit your profile, change consent, or delete your account) or by contacting [email protected].

To protect your account, we may need to verify your identity before acting on a request. We aim to respond within one month, as required by the GDPR. You also have the right to lodge a complaint with your local supervisory authority. In Greece, this is the Hellenic Data Protection Authority (HDPA) — www.dpa.gr.

15. Account & data deletion

You can delete your account and associated data at any time:

• In the App: open Settings / Account → Delete account. This removes your account and personal data from our systems (subject to the exceptions in §13), signs you out, and clears the App’s local data on your device.
• On the web: use our online account deletion form and submit your account email or username.
• By email: write to [email protected] from, or including, your account email or username, and we will process your request.

For full details of what is deleted and what is retained, see our Account & Data Deletion page.

16. U.S. state privacy rights

If you are a resident of California or another U.S. state with a comprehensive privacy law, you may have rights to know, access, correct, and delete your personal information, and to opt out of “sharing” or “sale” of personal information for targeted advertising. In the past 12 months we have collected the categories described in this Policy (identifiers; commercial information such as purchases; internet/app activity; coarse location; and inferences such as engagement segments), for the purposes described in §4.

We do not sell your personal information for money, and we do not knowingly share the personal information of minors under 16 for cross-context behavioral advertising. To opt out of the use of advertising identifiers for personalized ads, use the controls in §7. We honor recognized opt-out signals (such as Global Privacy Control) where required. We will not discriminate against you for exercising your rights. To exercise a right, contact [email protected]; you may use an authorized agent, and we may need to verify your request.

17. Children’s privacy

Brilliant Chess is intended for a general audience and is not directed to children under 13 (or under the minimum age of digital consent in your country, which is up to 16 in parts of the EEA). We do not knowingly collect personal data from children under that age. If you believe a child has provided us personal data, contact [email protected] and we will delete it.

18. Security

We protect your information using measures such as encryption in transit (HTTPS/TLS), managed authentication through Firebase, and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs that is likely to affect your rights, we will notify the competent supervisory authority and, where required, affected users, in line with applicable law.

19. Third-party services & links

The App relies on third-party services (including Google, Firebase, Google Play, AdMob, Cloudflare, and Lichess) and may contain links to other services. Their handling of data is governed by their own privacy policies, which we encourage you to review (links are provided in §10).

20. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide a more prominent notice within the App. Your continued use of the App after an update means you accept the revised Policy.

21. Contact us

Questions or requests about this Policy or your personal data:

Sunrise Labs — Eleftherios Katiforis
Greece
Email: [email protected]