Pikafish Privacy Policy
Pikafish (including xiangqiai.com, the iOS app, the Android app and the desktop app, collectively the “Service”) is operated by Xiamen Elo Infinity Technology Co., Ltd. (厦门棋力无限科技有限公司, “we” or “us”). This policy explains what personal information we collect when you use the Service, why we collect it, how we store and protect it, and your rights. Please read it carefully, especially the text in bold.
1. Features available without signing in
The board, engine analysis, play against the engine and local game records run on your device. No registration is required, and these features do not upload your game records or positions to us. If you do not agree to this policy in the app, you can enter “Basic Mode” and use these features offline. In this mode, the app does not send network requests to us or any third party.
2. Personal information we collect
| When | Information collected | Purpose |
|---|---|---|
| Registration / sign-in by phone | Phone number and SMS verification code | Create and verify your account, recover your account, and verify your identity for account deletion |
| Registration / sign-in by email | Email address and email verification code | The same purposes as above |
| WeChat sign-in (website only) | WeChat OpenID, UnionID, nickname and profile picture | Identify the same WeChat user and display the nickname and profile picture |
| Setting a password | Password (stored only as an irreversible hash) | Password sign-in |
| Setting a nickname | Nickname | Display your nickname; a content moderation service checks it for unlawful or prohibited content |
| Cloud game records and collections | Game content, annotations, titles, players, tags, folders, visibility settings and study progress that you choose to save | Synchronization across devices and sharing |
| Board recognition (sign-in required) | Board photos you take or select; the time, result and processing duration of each recognition request | Recognize positions and measure the number and success rate of requests. Images for which recognition fails or has low confidence are retained to improve the recognition algorithm, without being associated with your account or device. Other images are not retained after recognition. |
| Cloud database queries (can be disabled in Settings) | The current position | Look up moves and evaluations; the position does not include your identity information |
| Feedback | Your message and contact details, images and game records you attach, IP address, device information and app version | Handle your feedback |
| Device and version information (with each network request from the mobile and desktop apps) | Platform, app version and distribution channel, installation identifier (randomly generated on installation, not a hardware identifier), operating system version and device model | Compatibility, staged releases, abuse prevention, rate limiting and statistics |
| Activity statistics | Randomly generated device identifier, account ID (when signed in), page load time and font size setting | Count daily active users |
| Diagnostics | Browser or system version, CPU core count, memory tier, screen dimensions, engine version, loading duration and error information; an engine crash report includes the last engine command, which may contain the position at that time | Diagnose engine loading failures and crashes; this information does not include account information |
| Google Analytics (website only) | Pages visited, device type, approximate region and IP address | Understand overall usage. See Sections 4 and 7. The mobile and desktop apps do not use Google Analytics. |
We do not collect location, contacts, SMS messages, call records, hardware identifiers such as IMEI, MAC address or Android ID, or the list of apps installed on your device. We read the clipboard once only when you tap “Paste from Clipboard”.
3. System permissions used by the app
| Permission | Purpose | When requested |
|---|---|---|
| Camera | Take a board photo for recognition | The system asks when you tap the photo recognition button. The Android app uses the system camera and does not request camera permission. |
| Photos / files | Select a board image or game record file | The system picker provides access only to files you select. We do not request photo library permission. |
| Network | Sign-in, cloud game records, recognition and updates | At installation (system default) |
| Install unknown apps (Android version downloaded from our website only) | Install a new version you have confirmed and downloaded | The system asks when you tap “Update”. Versions downloaded from an app store do not include this permission. |
The app does not start automatically, is not started by other apps, and does not run continuously in the background.
4. Third-party services and information sharing
| Third party | Purpose | Information involved | Details |
|---|---|---|---|
| Tencent Cloud Computing (Beijing) Co., Ltd. | Servers, databases, object storage, content delivery, SMS, email and board recognition computation | Account and cloud data, phone number (for SMS), email address (for email), and recognition images | Data is stored in mainland China |
| Shenzhen Tencent Computer Systems Co., Ltd. (WeChat Open Platform) | WeChat sign-in (website only) | WeChat OpenID, UnionID, nickname and profile picture | Provided to us by WeChat after you authorize it |
| Content moderation service provider | Nickname moderation | Nickname text | The service is located in mainland China and does not receive other account information |
| Cloud database (chessdb.cn) | Look up moves and evaluations | The current position | Can be disabled in Settings |
| Google LLC (Google Analytics) | Website usage statistics | Pages visited, device type, approximate region, IP address and cookie identifier | Website only; not used by the mobile or desktop apps. Data is transferred outside mainland China (see Section 7). |
Except as described above or required by law, we do not sell, rent or share your personal information with any third party.
5. Storage on your device
To remember your settings (skin, language, engine parameters and display mode), save local game records and the position being analyzed, cache engine and skin resources, and keep you signed in, the Service stores data on your device (browser localStorage, IndexedDB, Cache Storage and cookies, or local app files). This data remains on your device. Uninstalling the app or clearing browser data deletes it.
6. Storage location, retention and security
- Except as described in Section 7, your personal information is stored on servers in mainland China.
- Account information, cloud game records and collections are retained until you delete them or delete your account.
- Activity statistics and diagnostic records are deleted after 30 days; staged-release statistics are deleted after 90 days. Only aggregated figures without personal identity information remain after that.
- Sign-in and verification records contain only irreversibly processed phone numbers or email addresses and are deleted after 90 days.
- SMS and email verification codes expire after their validity period of a few minutes and are then deleted.
- Feedback is retained after it is handled so we can follow up on the same issue. It is deleted along with your account when you delete your account.
- Images used to improve recognition are not associated with an account or device and are retained for no more than one year.
- Server access logs, including IP addresses, are retained for the period required by law.
We encrypt data in transit using HTTPS, store passwords only as hashes, and use access controls and least-privilege measures to protect data. If a personal information security incident occurs, we will notify you and report it to the relevant authorities as required by law.
7. Transfers of personal information outside mainland China
The mobile and desktop apps do not transfer your personal information outside mainland China.
The website uses Google Analytics for usage statistics. The information described in Section 4 is transferred to Google LLC servers outside mainland China (contact: Google privacy contact form) and used only to understand overall usage. You can refuse this processing by disabling cookies in your browser or blocking the analytics script without affecting any features. Apart from this, we do not transfer your personal information outside mainland China.
8. Your rights
- Access and correction: View and change your nickname, password and other details in your profile. You can edit, delete or change the visibility of cloud game records at any time.
- Copy: Use the export feature to download your game records.
- Deletion: Deleted game records disappear immediately from your list and their sharing links.
- Account deletion: See Section 9.
- Withdraw consent: In the app, go to Settings → Privacy to withdraw consent to this policy. The app will sign you out and enter Basic Mode. You can also disable cloud database queries separately in Settings. Withdrawal does not affect processing carried out before you withdrew consent.
- Other requests and complaints: Contact us as described in Section 13. We will respond within 15 working days.
9. Account deletion
You can delete your account yourself in your profile using the account deletion option. Deletion takes effect immediately after identity verification. Your account information, cloud game records and collections, recently viewed items, recognition records and feedback will be deleted. Sharing links will stop working, and this cannot be reversed. Local game records on your device are not affected.
The following information is retained after account deletion: aggregated statistics without personal identity information, recognition improvement images not associated with your account, administrator audit records, and information that must be retained by law. You can register again with the same phone number, email address or WeChat account, but this creates a new account.
10. Sharing and public access
If you set a game record or collection to “Anyone with the link”, anyone who obtains the link can view its current content, including later changes, and copy it to their own account, but cannot change your content. You can change its visibility back to “Only me” at any time, which disables the link. Do not put information you want to keep private in titles or annotations.
11. Children
The Service is intended for the general public. If you are under 14, please use account features with your guardian’s supervision and consent. If we discover that we have collected personal information from a child under 14 without guardian consent, we will delete it as soon as possible.
12. Updates to this policy
We may update this policy due to feature changes or legal requirements. We will publish the new version and updated date on this page. If there are material changes to the scope or purpose of collection or the third parties involved, the app will ask you to confirm again the next time you open it.
13. Contact us
- Operator: Xiamen Elo Infinity Technology Co., Ltd. (厦门棋力无限科技有限公司)
- Email: [email protected]
- QQ group: 829220986