Legal

Privacy Policy

Last updated: November 2026

This policy describes what ShogiGO collects, why it collects it, and what it never collects. It covers the web app at shogigo.net and the Android app, and it is based on the apps' actual behavior — if an app doesn't do it, it isn't in this policy.

1. The short version

• You can play ShogiGO without an account — no personal data required. On the web, a first visit creates an anonymous guest session so your game works; it carries no name, email, or personal information, and you can link it to an account later to keep your progress.
• If you sign in with Google or email, we store your profile (name, avatar, rating, game history) so online play, friends, and rankings work.
• We run no analytics, no crash reporting, no advertising, and no in-app purchases.
• We collect no device identifiers (no advertising ID, no IMEI).

2. Information we collect

2.1 If you play without an account

Nothing tied to your identity. Casual and AI games work without an account; on the web, the anonymous guest session described above is the only thing created, and it holds no personal information.

2.2 If you sign in (optional)

Sign-in uses Google OAuth in your browser (scopes: openid, email, profile) or email and password through Firebase Authentication. We receive and store:

• Your Google account's display name and email address, or the email address you sign up with
• A Firebase user ID (a random key generated for your account — not a device identifier)
• Authentication tokens, stored only in the app's private storage on your device

Passwords are handled by Firebase Authentication and are never visible to ShogiGO.

2.3 Profile and gameplay data (signed-in users)

To run online play, rankings, friends, and challenges, the following is stored in our Firebase Realtime Database:

• Username, chosen avatar, Elo rating, and win/loss/draw record
• Game history: opponent name, result, your color, rating change, date, and the move list
• Friend list, friend requests, and direct challenges
• Online presence: a heartbeat sent while you're signed in and the app is open (used for "online now" indicators and matchmaking)
• Active online games: moves, game state, draw offers, and tournament context

3. Information we do NOT collect

• No analytics or usage tracking SDKs
• No crash reporting — if the app crashes, that data is not sent anywhere
• No advertising identifiers or ad SDKs
• No in-app purchases or payment information
• No location, contacts, camera, microphone, or storage access (the app never requests these permissions)
• Voice coaching uses your device's built-in text-to-speech — no voice data leaves your device

4. Permissions the app requests

The web app requests no device permissions. On Android, the app requests:

• Internet — required for online play, matchmaking, and sign-in
• Notifications — optional; alerts you when it's your turn, when a match is found, or when a friend challenges you (processed on-device; no push notification service is used)
• Foreground service — keeps challenge and turn alerts working while the app runs

5. Third-party services

• Google Sign-In — if you choose to sign in; governed by Google's Privacy Policy
• Firebase Authentication & Realtime Database — hosts accounts and online gameplay; governed by the Firebase Privacy and Security terms
• Google Fonts — the app loads the Barlow Condensed typeface from Google's font servers (fonts.googleapis.com and fonts.gstatic.com) when pages load. Font requests do not include your account data; governed by Google's Privacy Policy

The app communicates with these services directly over encrypted HTTPS. No other third parties receive your data.

6. Data retention and deletion

Your profile and game history are kept for as long as your account exists, so rankings and history persist between sessions. Presence heartbeats are transient and expire automatically.

How to delete your account

Delete it yourself in the app: Profile → Account → Delete account, available now on web and Android. Or use the public deletion page at shogigo.net/delete-account.html. Or email support@shogigo.net from the email address associated with your ShogiGO account and request permanent account deletion.

What is deleted

• Your profile: display name, avatar, Elo rating, win/loss/draw record
• Your username reservation (the username becomes available again)
• Your friend list, friend requests, and challenges
• Your presence data and matchmaking entries
• Your authentication tokens on your device (sign-out completes the process)

What is retained and why

Match records from games you played also live in other players' histories — their ratings, tournament results, and game lists were computed from those games. Those shared competitive records are retained so other players' histories stay intact, but your profile, username, and contact information are removed. We do not keep your email address or username beyond the deletion request.

7. Children

You must be at least 13 years old to create a ShogiGO account. If you are under the age of majority in your jurisdiction, you may only use ShogiGO with the permission of a parent or legal guardian. We do not knowingly collect personal information from children under 13; if we learn that we have collected such information, we will delete the account and its personal data. Google sign-in applies Google's own age requirements.

8. Security

All network traffic uses encrypted HTTPS. Authentication tokens are stored in the app's private on-device storage, inaccessible to other apps. That said, no method of electronic storage is 100% secure, and public profile and game data is intentionally visible to other players as described in section 2.3.

9. Changes to this policy

If this policy changes, the updated version will be posted here with a new "Last updated" date. Material changes will also be noted in the app.

10. Contact

Privacy questions or requests (including account deletion): support@shogigo.net.