Privacy Policy

01Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for providing the app and this website is:

No data protection officer has been appointed, as the conditions of Art. 37 GDPR are not met. For any privacy question, an email to the address above is enough.

02Principle: local-first

Kiebitz processes your chess data exclusively on your own devices. There is no user account, registration, cloud storage or Kiebitz server to which games, analyses or training progress are transmitted. These contents are not shared with ad providers either.

Kiebitz Free may display ads. For this purpose the app connects to Google Mobile Ads, and Google may process technical device and usage data. Kiebitz runs no product analytics of its own and sends no automatic remote crash reports. All network connections are listed in section 4.

03What the app stores locally

Kiebitz keeps its data in a local SQLite database and in local configuration files inside the operating system's application data directory (Windows: the application data directory of your user account; Android: the app's private directory, not readable by other apps). Stored are:

• imported games with metadata (date, opponent name, Elo values, time control, opening, result, moves, source)
• engine analysis results (evaluations per move, move classification, accuracy)
• repertoire tree and FSRS review data, puzzle progress and puzzle Elo, endgame results, study plan and checklists
• your own notes and tags on games and moves
• settings, including the chess.com and Lichess usernames you entered, language, engine options and, if you paired a phone, the address, pairing code and certificate fingerprint of the sync hub
• cached responses of the optional online opening book (up to 30 days)

This data does not leave your device unless you export it yourself (for example as a PGN file) or synchronise it with a second device of your own (section 6).

04Network connections made by the app

The app establishes only the following connections. All other functions work offline.

These services are independent third parties and process the data named above under their own privacy terms. Advertising processing is limited to Kiebitz Free; chess content is not sent to any of these services as advertising data.

• chess.com: privacy policy
• Lichess: privacy policy
• chessdb.cn: provider site
• GitHub: privacy statement
• Google: privacy policy
• Google: data use on partner apps

05Device permissions

• Camera (Android): solely to scan the QR code for device pairing. The permission is requested only at that moment. No photos or videos are stored, processed or transmitted; only the text contained in the QR code is read.
• Internet / network access: for the requests listed in section 4 and for sync on the local network.
• Notifications: optional, for local training reminders. They are generated on the device, without any push service.
• File access: only when you import or export a PGN file yourself, through the operating system's file picker.

06Device sync on the local network

When you pair desktop and phone, only your own devices connect to each other. The desktop acts as the hub; the phone receives the address, pairing code and TLS certificate fingerprint from the QR code shown on screen. The transfer runs encrypted (TLS with fingerprint verification) directly over your local network or a VPN you set up yourself.

There is no intermediary server, no relay and no provider access. Without pairing there is no sync; you can remove the pairing in the settings at any time.

07Advertising and privacy choices

Kiebitz itself runs no product analytics, automatic crash reporting or remote logging. Games, analyses, notes and training data are not sent to Google as advertising data. Kiebitz makes no automated decisions within the meaning of Art. 22 GDPR.

The Android version of Kiebitz Free uses Google Mobile Ads. Before an ad request, Google’s User Messaging Platform (UMP) updates the consent status and, where required, presents a choice. You can reopen it under Settings → Ads & privacy. Even non-personalized or limited ads may process technically necessary data such as the IP address and data for security and fraud prevention. You can also reset or delete the advertising ID in Android’s system settings.

The desktop version of Kiebitz Free loads a static advertising surface from this Kiebitz website via GitHub Pages. No chess data, Kiebitz user identifier, cookies or advertising ID are transmitted, and the app suppresses the referrer. GitHub processes technically necessary connection data such as the IP address and browser identification in server logs when the surface is requested. Creatives are loaded from the same website. Only after you click an advertisement does the advertiser's destination open and receive its own connection data. The legal basis for this contextual delivery is Art. 6(1)(f) GDPR (financing and operating the free version). If no campaign is active, the advertising surface remains hidden.

08Legal bases

Where the app processes your chess data exclusively on your device, the provider has no access to it. The following apply in particular to individual network and advertising operations:

• Art. 6(1)(b) GDPR: providing the functions you requested, in particular importing your games from chess.com or Lichess and syncing between your devices.
• Art. 6(1)(a) GDPR: consent, wherever you enable a function or make an advertising choice: the optional online opening book (chessdb.cn), camera access for QR pairing, notifications, personalized advertising and device access requiring consent. You can revisit advertising choices under “Settings → Ads & privacy” and withdraw other permissions in the app or system settings.
• Art. 6(1)(f) GDPR: legitimate interest in secure, up-to-date software: checking for program updates.

09Retention and deletion

Your local chess data stays stored for as long as you want to keep it; Kiebitz operates no server-side storage for that data. At any time you can:

• delete individual games, notes, tags or repertoire entries inside the app,
• remove the pairing with another device,
• uninstall the app, which removes the local app data (on Android additionally via “clear app data”, on Windows by deleting the application data directory),
• export your data as PGN beforehand if you want to keep it.

Retention of technical data processed by Google Mobile Ads is governed by Google’s own terms. You can reopen your advertising choices in Kiebitz and reset or delete the advertising ID in Android.

10Children

Kiebitz is not specifically directed at children. Advertising is subject to the age, consent and child-safety rules provided by Google and Google Play; if the app is classified for children, the applicable Families and advertising requirements must also be met. The terms of the respective chess platform apply when importing games.

11Your rights

Under the GDPR you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw consent at any time (Art. 7(3)).

Kiebitz stores no chess data about you in its own backend; you can view, export and delete local data yourself. For Kiebitz requests, email kiebitz.chess@gmail.com. You can also exercise rights relating to advertising data processed by Google through Google’s privacy controls.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, Germany; you may also contact the authority where you live.

12This website

This website is static and delivered via GitHub Pages (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). When you visit it, GitHub as the host processes technically necessary connection data in server log files, in particular your IP address, date and time, the file requested, referrer and browser identification. The legal basis is Art. 6(1)(f) GDPR (secure, trouble-free operation). The provider of this website has no access to these log files.

The publicly accessible website pages set no cookies and use no analytics, advertising or social media scripts. The advertising surface embedded only in Kiebitz Desktop uses a local script to select active campaigns, but likewise uses no cookies, storage, user identifiers, analytics or third-party scripts. Fonts, styles and advertising creatives are served from the same server. The language you choose on the website is stored only locally in your browser (localStorage) so the page appears in the same language next time; that setting is not transmitted. GitHub's privacy statement: docs.github.com.

Feedback form: Only when you submit a report are the entries you provided (report type, summary, details and, optionally, platform, app version and email address) and technically necessary connection data transmitted to FormSubmit (formsubmit.co) and forwarded from there to the provider by email. No data is automatically read from or attached by the app. According to its own documentation, FormSubmit retains submissions for up to 30 days for delivery and retrieval. The legal basis is Art. 6(1)(b) GDPR where you request support, and otherwise Art. 6(1)(f) GDPR (handling voluntary feedback and improving the software). The email received by the provider is deleted once it is no longer needed to handle the report or follow-up questions. FormSubmit information: privacy and documentation.

13Changes to this policy

If the app gains functions that involve new data processing, this policy will be updated beforehand. The current version is dated above and permanently available at this address.