Privacy Policy

App: Tiger Chess / Cờ Hùm (vn.tigerchess.app)
Publisher: Imagine Technologies
Contact: nhungkengusivodoi@gmail.com
Effective date: 30 October 2026

Tiger Chess is a Vietnamese folk board game. This policy covers local games, bots, named variants, optional online play, advertising and one-time purchases for Remove ads and individual skins.

Data saved on your device

The app saves your language choice, move highlights, touch feedback, sound/music and visual skin preferences, named board variants, one resumable match and its move history. It also stores puzzle completion progress, one unfinished puzzle attempt, remaining bot-game Undo uses, the local ads-removed status, individual skin ownership and online room codes used on this installation. Bots and hints calculate on your device; board positions are not uploaded for those calculations. Music and sound effects are bundled and played locally, with no microphone recording or streaming service. Private app data is excluded from Android cloud backup and device transfer.

Use Settings → Delete saved games and variants to delete the local match, variants and puzzle progress while keeping preferences and purchase status. Clearing Android app data or uninstalling also removes local preferences and stored room codes. These actions alone do not delete online records or cancel a Google Play purchase.

Legacy Firebase records

The current build offers Online Relay only and hides the Firebase/WebRTC connection and identity controls. The Firebase sections below describe older versions and any records they created. Contact support about those legacy records.

When you create or join a room, Firebase Authentication creates or reuses an anonymous online identity without asking for a name, email or password. The configured Firebase Realtime Database stores that identity ID, a room code, membership, board setup (including a custom variant name), session ID, creation/expiry timestamps, connection signals and relayed game messages. The other room member can receive the setup and game data. An unfilled room can be read by another authenticated user who knows or guesses its code so they can join. Do not put private information in variant names.

Firebase uses technical connection information such as IP addresses and user-agent data for service operation and abuse prevention. This friend mode has no public matchmaking or chat. Google processes Firebase data under its service terms; see Firebase privacy and security.

Direct connection and relay

This section describes the Firebase/WebRTC friend mode.

The app tries an encrypted WebRTC data channel using public STUN services. Network addresses and connection candidates may be disclosed to the other player and the connection services. No audio or video track is created. If a direct connection is unavailable, Firebase forwards game messages. Firebase remains connected during a direct game to support fallback. You can select relay in the room; this stops the direct transport, but cannot undo addresses already exchanged.

Optional online rooms on a relay server

Play online connects to the relay server configured when this app was built. Its operator receives your chosen display name, network address, a generated guest identity, room membership, readiness and game state/moves. Names and available public rooms can be shown to other players using the same game and client version. Private rooms are omitted from discovery; a room password, if set, is sent to the server during creation/joining. Do not reuse an account password. The bundled relay stores a salted password hash and does not include the password in room listings or invitations.

The bundled relay keeps sessions, rooms and game checkpoints in memory. Sessions last up to 24 hours; disconnected seats have a default 120-second reconnect grace. A server restart loses this state. The app stores that server address, name, guest token and current room locally to reconnect, and does not save the room password. Leaving a room releases your seat; disconnecting does not erase the guest session. Clearing app data removes the local credentials. For server records or operational logs, contact the operator of the selected server, whose logging/retention settings may differ. The Firebase deletion control applies to Firebase records only.

Production builds require HTTPS/WSS for this mode. Debug/Preview builds also allow unencrypted HTTP/WS for local testing. Bots calculate on the current authority player’s device; game results are relayed without server-side rule verification. No direct WebRTC connection is used in this mode.

Firebase retention and deletion

Rooms stop accepting gameplay writes after approximately 24 hours. Expiry does not automatically erase records: room data remains until a player deletes it or the publisher cleans it up. Anonymous authentication records remain until deletion is requested or the publisher removes them.

On legacy builds, while still signed in on the same installation, choose Settings → Delete online identity and room data. With internet access, the app first deletes the shared rooms recorded on this device, including setups, signals and relayed messages, and then deletes the anonymous identity. Both players lose access to those shared rooms. If deletion fails, the app keeps the remaining room list and credentials for a retry. Starting online play again creates a new identity.

After clearing app data or reinstalling, old room codes or credentials may no longer be available. You can request deletion at the data deletion page or email the contact above, including your online ID and room code if available. Your online ID can be copied from Settings before clearing app data. The publisher may need to verify that a request concerns your data. Firebase service logs and backups follow Google's retention procedures; deleting a live record is not a promise of immediate deletion from every backup. The opponent may retain their own local copy of a game.

Advertising and your choices

Google Mobile Ads (AdMob) can collect and share IP addresses (which may indicate approximate location), app interactions, diagnostic information, and device/account identifiers such as advertising ID and app set ID for advertising, analytics and fraud prevention. SDK data uses encrypted transport. See Google's Privacy Policy and information from apps that use Google services.

Where required, Google's consent form appears before ads can be requested. Settings → Ad privacy choices is available when required for your consent state. Android settings also provide advertising ID controls. Banners are on the home screen. An occasional preloaded full-screen ad may appear after a completed regular offline game, before result action buttons appear, or after you confirm New game during an unfinished regular offline match, before the replacement game opens. Completed matches and confirmed restarts share a two-match counter, with at least 120 seconds of foreground play and 180 seconds between ads. Cancelling the confirmation does not count. No automatic interstitial interrupts moves, puzzles or online matches, or appears on app launch/exit. You may explicitly choose a rewarded ad for one puzzle/bot-game hint or to restore a bot match to 5 Undo uses. Only the earned-reward SDK callback grants that benefit. Puzzle Undo and Reset are free and unlimited; no ad is required to play or unlock levels by solving them. Reward handling is client-side without a separate verification server. Removing local game data does not delete data already received by advertising services.

Purchases

Google Play handles one-time, non-consumable purchases for Remove ads, Village wood and Earth & pebbles. Each product unlocks its own benefit; skins do not remove ads and Remove ads does not unlock skins. The app uses product, purchase state and a signed receipt to verify ownership locally and acknowledge a completed transaction. It queries Play again when available and stores ads-removed and individual skin ownership locally. The publisher does not receive payment card details. The Remove ads purchase removes ads, provides hints directly without rewarded ads, and enables unlimited Undo in regular bot matches. All game modes remain free. Restore purchases with the same Play account after reinstalling. Data deletion does not refund or cancel that purchase; manage purchase records and refund requests through Google Play.

Permissions and security

The game uses internet/network access, Google Play billing and advertising-related SDK permissions. It does not request camera, microphone, contacts or precise location permission. Production internet transports use encryption; local test relay connections may use HTTP as described above. No system guarantees absolute security. The app does not include Firebase Analytics or Crashlytics.

Contact and policy changes

If you email support, the publisher receives your email address, message and information you include, uses it to answer support/privacy requests and retains it only as needed for that purpose or required records. You may request deletion of that correspondence. Do not send passwords, private keys or payment card details. We update this policy and the bundled in-app version when data handling changes; the effective date identifies this version.