Privacy.

In short

• The app has no account, no analytics, no advertising and no tracking. Your games, players, places, notes and photos are stored on your phone. We never receive them.
• Sync and backup are off until you turn them on, and then go to your own iCloud or Google Drive. We cannot see that copy.
• Stockfish runs on your phone. Recording together links two phones directly, with no server.
• Maps load from OpenFreeMap, which sees your IP address and the area shown. Address search uses your phone's maps service (Apple's or Google's). Your location is used only when you tap Use my location or Near me.
• This website uses necessary cookies only, unless you accept analytics. Rejecting is as easy as accepting, and you can change your mind at any time from Cookie settings at the foot of every page.
• We never sell personal data or use it for advertising.
• You have rights over any personal data we hold, and you can complain to the Information Commissioner's Office.

This notice has three parts: the app, the website, and what applies to both (why we use data, who else is involved, how long we keep it, your rights). It covers the Plyfolio app on iPhone, iPad and Android phones, tablets and foldables, and the website at plyfolio.com.

Who we are

Plyfolio is made by Remiam Limited, a company registered in England and Wales with company number 10829191 and its registered office in Winchester, Hampshire ([registered office address to confirm]). We are registered with the Information Commissioner's Office (ICO) under number ZA917465.

For the little personal data described here, Remiam Limited is the controller: we decide why and how it is used. We are a small company and are not required to appoint a data protection officer. Questions about privacy go to [privacy email to confirm], and a person, not a system, will reply.

If you are in the European Union, the EU General Data Protection Regulation also protects you. Our representative in the EU is [EU representative to confirm, or remove this sentence if a lawyer advises one is not needed].

The app: what it keeps, and where

Plyfolio is offline first. Everything you put into it is saved in a database (SQLite) inside the app's own storage on your device. There is no Plyfolio server, and the app does not send what you write to us or to anyone else.

What the app does not collect

• No account, sign-up, email address or password with us.
• No analytics, advertising or tracking code, and no third party software that reports on you.
• No advertising identifier, no fingerprinting, and no location tracking: your location is used only when you tap for it, never in the background.
• No contacts, messages or browsing history.
• No copy of your games, photos or notes, ever, unless you choose to email one to us.

The app: sync and backup to your own cloud

Sync and backups are off until you turn them on in Settings. When you do, you sign in to your chosen provider on your device, and Plyfolio writes your library to your own account: iCloud (on iPhone and iPad) or Google Drive (on any device). The connection is encrypted by the provider. We do not run a server in between, we do not receive your sign-in details and we cannot open the copy.

Your cloud copy is held by Apple or Google under their own terms and privacy policies, which apply to it: apple.com/legal/privacy and policies.google.com/privacy. To delete it, turn sync off and delete the Plyfolio folder or data in your iCloud or Google Drive settings.

The app: reviewing with Stockfish

Stockfish, the chess engine, runs on your device. Positions and games you review are not uploaded anywhere. Stockfish never runs during a recording.

The app: recording together

When both players have Plyfolio, Recording together links two phones at the board so each player writes their own moves. This is how it handles data:

• One phone shows a QR code; the other scans it. The code carries a one-time key, so the link is encrypted and only those two phones are in it. Both of you confirm the same three-word code before the game starts.
• The phones talk directly over Bluetooth Low Energy, or over the local Wi-Fi network you are both on. No internet connection and no server, ours or anyone else's, is involved.
• Only notation travels: moves, gaps, corrections, the result and the player names on the scoresheet. Never photos, ratings, notes, places or the rest of your library.
• Each phone keeps its own full copy of the game. Either player can end the link at any time, and the one-time key is thrown away when the game ends.
• Your phone will ask your permission to use Bluetooth or the local network the first time. You can refuse and still record on your own.

Using a phone that talks to another phone during play is something arbiters may not allow. Ask the arbiter before you use Recording together at an event.

The app: maps, addresses and your location

A place can have a position on a map. The app has no map provider of ours in between: it draws maps itself from map data fetched over the internet, and it asks your phone to look up addresses. This is what leaves your device, and to whom:

• Plyfolio asks for your location only when you tap Use my location or Near me, and our own page explains why before your phone asks. It is used while the app is open, never in the background.
• Your location is never stored, except as the position of a place you choose to save, which stays on your device like the rest of your book.
• Nothing about maps, searches or your location is sent to us. Maps are not kept on the device, so they need a connection; offline, a place shows its address in words.
• Map data is © OpenStreetMap contributors, available under the Open Database Licence, and the map tiles are © OpenMapTiles.

The app: photos and other people

Your book will hold other players' names, ratings and perhaps photos, in the same way a paper scoresheet or a club notebook would. Keeping these for your own personal use is a household activity, which UK data protection law largely leaves to you. Even so, please:

• only take or add a photo of someone who is happy for you to, and remove it if they ask;
• take extra care with photos of children: ask their parent or guardian first;
• think before you share or publish games, photos or notes that name other people.

Photos stay on your device, cropped to a square, and only go to your own cloud if you turn sync on. They are never sent to us. If you share a game file, photos are not included.

The app: permissions it asks for

Plyfolio asks only when you use the feature that needs it, and works without any of them.

The app: buying it, and crash reports

You buy Plyfolio once, for £9.99, from Apple's App Store or Google Play. Apple or Google take the payment and keep your purchase records as controllers in their own right, under their own privacy policies. They give us sales figures and reports (such as how many copies were sold in which country) that do not tell us who you are. We never see your name, email address or payment details.

If you have chosen to share diagnostics with app developers (on iPhone and iPad: Settings, Privacy and Security, Analytics and Improvements, Share with app developers; on Android: your device's usage and diagnostics setting), Apple or Google may pass us crash reports and performance figures that do not include your name or what you wrote. We use them only to find and fix faults. You can turn this off in the same settings at any time.

The app: deleting your data

Because your data never reaches us, we cannot read, recover or delete it for you. You are in control of all of it: delete a game, player or place in the app; delete the app to remove everything on that device; and delete your own cloud copy in iCloud or Google Drive. Export your games first if you want to keep them.

The website: what happens when you visit

The site is a set of static pages served by our hosting provider, [hosting provider to confirm]. Like every web server, it records basic details of each request in server logs: your IP address, the date and time, the page asked for, the browser and device type it reports, and the page that sent you. We use these logs only to keep the site running and secure (for example to spot attacks), and they are deleted after [log retention to confirm; we suggest no more than 30 days].

The website: analytics, only with your consent

We would like to know how many people visit, which pages they find useful and where the site lets them down, so we can improve it. For that we use Google Analytics 4, loaded through Google Tag Manager. Neither is loaded unless you choose Accept all, or turn Analytics on in Cookie settings. If you reject, or ignore the banner, no Google script runs and no analytics cookie is set.

If you accept, Google Analytics records:

• the pages you view, how long for, and the page that sent you here;
• your approximate location (country and city), worked out from your IP address. Google Analytics 4 does not log or store IP addresses;
• your device type, operating system, browser, screen size and language;
• a random identifier stored in a cookie, so repeat visits from the same browser can be counted.

We have switched off Google signals, advertising features, ads personalisation and data sharing with other Google products. We never send Google your name, email address or anything you paste into the free tools. Analytics data is kept for 14 months and then deleted by Google.

We use Google Consent Mode v2. Before you choose, every Google signal (analytics_storage, ad_storage, ad_user_data and ad_personalization) is set to denied. Accepting analytics changes only analytics_storage to granted. The advertising signals stay denied whatever you choose.

Pages opened from the Plyfolio app (help pages and links in the app open the website with ?in=app) load no analytics at all, whatever you chose before: no Google Tag Manager, no Google Analytics and no cookie banner, because the app promises no analytics. The pages you go on to read in that tab stay the same way.

You can withdraw your consent at any time from Cookie settings at the foot of every page; we then stop analytics and remove its cookies. Withdrawing does not affect what was collected before. The cookie policy lists every cookie and how long it lasts.

The website: fonts and the free tools

The site's typeface, Livvic, is served from our own site [to confirm: self-hosting is recommended before launch], so loading a page does not contact Google Fonts. If we ever load it from Google Fonts instead, Google receives your IP address with the request, and this notice will say so.

The free tools (PGN viewer, PGN checker, board image, scoresheet maker and notation trainer) run entirely in your browser. What you paste or type is processed on your own device and is not stored or sent to us. The PGN viewer remembers whether you chose a 2D or 3D board until you close the tab. Share links you create carry the game in the link itself, so anyone you send one to can see that game.

AI assistants can use the same tools in your browser. They run on the page in the same way, and send nothing to us.

Emails you send us

If you write to [privacy email to confirm] or use the contact page, we receive your email address, your name if you give it, your message and anything you attach (for example a game file or a screenshot). We use them only to reply and to fix what you report. Attachments are deleted once the problem is fixed, and correspondence is kept for up to two years, then deleted. Our email is provided by [email provider to confirm].

The contact form is delivered by Web3Forms. When you press Send, your browser sends your name (if you give it), your email address, the topic and your message to Web3Forms, which emails them to us. Web3Forms sets no cookies on this site and loads nothing until you press Send. It acts as our processor: it keeps a copy only as long as it needs to deliver the message [Web3Forms retention to confirm], and it may process it outside the UK [Web3Forms location and transfer safeguard to confirm]. If you would rather not use the form, email us instead.

Why we use it: our lawful bases

UK data protection law needs a lawful basis for each use of personal data. Ours are:

Where we rely on legitimate interests, we have weighed them against your rights and kept the data to the minimum. You can object (see your rights below).

Who else is involved

We do not sell, rent or trade personal data, and we do not share it for advertising. We would disclose it only if the law required us to, or to protect our legal rights, and we would tell you unless the law said we could not.

International transfers

Google may process analytics data in the United States and other countries outside the UK and the European Economic Area. Where it does, the transfer is protected by the UK-US data bridge and the EU-US Data Privacy Framework (Google LLC is certified), and by Google's data transfer terms: the UK International Data Transfer Addendum (IDTA addendum) and the EU Standard Contractual Clauses. Our hosting provider, email provider and Web3Forms (the contact form) may also process data outside the UK [to confirm with each provider and the safeguard used]. You can ask us for a copy of the safeguards.

How long we keep it

• Server logs: [up to 30 days, to confirm with the host].
• Analytics: 14 months in Google Analytics; analytics cookies last up to 13 months [to confirm].
• Your cookie choice: 12 months, then we ask again.
• Emails: up to two years; attachments deleted once the problem is fixed.
• Contact form messages: up to two years in our inbox; Web3Forms keeps them only to deliver them [to confirm].
• Anything in the app: as long as you keep it, on your own device and cloud. We hold none of it.

Children

Juniors use Plyfolio to record and study their games, and it is designed to be safe for them: no account, no adverts, no chat, no messages from strangers, no in-app purchases and nothing collected by us. A parent or guardian usually buys it through the store, and Apple's and Google's family controls apply.

A note for parents: your child's games and any photos they add stay on their device, and in your family's own cloud only if sync is on. Please talk with them about only photographing people who agree, and about asking the arbiter before using a phone at an event.

On the website, analytics is off unless someone accepts it. If you are under 13, please ask a parent or guardian before choosing Accept all; Reject all works just as well and the whole site still works.

Your rights

Under UK data protection law (the UK GDPR and the Data Protection Act 2018), and the EU GDPR if you are in the EU, you have these rights over personal data we hold about you:

• Access: to ask whether we hold data about you and for a copy of it.
• Rectification: to have wrong or incomplete data corrected.
• Erasure: to have your data deleted, where there is no good reason for us to keep it.
• Restriction: to ask us to stop using your data for a while, for example while a correction is checked.
• Objection: to object to our use based on legitimate interests. We will stop unless we have compelling grounds.
• Portability: to receive data you gave us in a common machine-readable format, or have it sent to someone else.
• Withdraw consent: to change your mind about analytics at any time, from Cookie settings at the foot of every page.
• No automated decisions: we make no decisions about you by automated means alone, and do no profiling.

To use any of these rights, write to [privacy email to confirm]. It is free. We will reply within one month (we may extend this by two more months for complex requests, and will tell you if so). We may ask for something to confirm who you are. In practice, the only personal data we are likely to hold is emails you have sent us; the app's data is on your device, where you can see, change, export and delete it yourself. We cannot identify you from analytics data alone, so please tell us which browser and roughly when if your request is about analytics.

Complaints

If you are unhappy with how we have handled your data, please tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator: ico.org.uk/make-a-complaint, or 0303 123 1113. If you are in the EU, you can complain to the data protection authority where you live or work.

Security

• The safest data is data we never hold: the app keeps everything on your device, protected by your device's own passcode and encryption.
• Sync goes straight from your device to your provider over encrypted connections. Recording together is encrypted with a one-time key and never leaves the two phones.
• The website is served only over HTTPS, has no logins and stores no personal data of its own.
• Access to our email, analytics, hosting and store accounts is limited to the people who need it and protected by two-step sign-in.
• If something goes wrong that puts your data at risk, we will tell the ICO within 72 hours where the law requires it, and tell you if it is likely to affect you seriously.

Please keep your device locked and up to date, and use a strong password and two-step sign-in on your iCloud or Google account.

How the stores describe Plyfolio

Apple's App Store and Google Play show a privacy summary for every app. These are Plyfolio's answers, and why:

Features coming later

Some later features may need to contact other services when you ask, such as fetching your public Lichess or Chess.com games by username, or looking up an English Chess Federation rating. Each will ask first, say what it sends and where, and this notice and the stores' privacy summaries will be updated before it ships.

Changes to this notice

If we change this notice, we will update this page and its date. If a change matters to how your data is used, we will say so in the app's release notes and, for the website, ask for your consent again where it is needed. Earlier versions are available on request.

Contact

Remiam Limited, Winchester, Hampshire. [registered office address to confirm]. Email [privacy email to confirm]. Company number 10829191. ICO registration ZA917465.

Company details

Company

Remiam Limited, a private company limited by shares, registered in England and Wales

Company number

10829191

Registered office

Winchester, Hampshire. [registered office address to confirm]

ICO registration

ZA917465

VAT

Not VAT registered

Privacy and legal contact

[privacy email to confirm]