Privacy Policy

1. Information We Collect

We collect only what is needed to run multiplayer rooms, voice chat, and leaderboards. Depending on how you use the Service, this may include:

We do not collect payment information, precise GPS location, contacts, photos/media, or SMS/call data — the App does not request or use any of these permissions.

2. Google Sign-In

If you choose to sign in with Google, we use Firebase Authentication to receive your basic Google profile information — your name, email address, and profile photo URL — solely to identify your account, save your progress, and display your name/avatar to other players in a room. We do not receive your Google password. You can review or revoke Chor Sipahi's access at any time from your Google Account permissions page.

3. Guest Login

You may also play without an account using Guest Login. A temporary, randomly generated guest ID is created for your session so you can join a room and be scored on the leaderboard for that game. Guest data is not linked to any personal identity, is not tied to an email address, and is only retained for as long as needed to support reconnects during an active session (see Data Retention).

4. Voice Chat (Agora RTC)

Voice chat is an optional feature powered by Agora RTC. When you join a room's voice channel:

• Your device streams live audio directly to Agora's real-time communication network for relay to other players in the same room.
• Our server never receives, stores, or has access to your raw audio — it only issues a short-lived, room-scoped access token that authorizes your device to join that specific voice channel.
• Voice tokens expire automatically (typically within an hour) and are re-issued only for the room you are currently a verified member of.
• We do not record or retain voice chat audio.

Agora acts as our real-time communication sub-processor. See Agora's own privacy practices at agora.io/en/privacy-policy.

5. Microphone Permission

The Android app requests the RECORD_AUDIO permission solely to enable Voice Chat. The microphone is only active while you are actively connected to a room's voice channel; it is not accessed in the background or while voice chat is off. You can deny or revoke this permission at any time from Android Settings → Apps → Chor Sipahi → Permissions — the game remains fully playable without it, with voice chat simply disabled.

6. Firebase Authentication

We use Google Firebase Authentication to manage sign-in sessions securely. Firebase issues a signed identity token that our backend verifies to confirm who you are before letting you create or rejoin a room. Firebase Authentication is governed additionally by Google's Firebase privacy terms. We do not store your Google password — authentication is handled entirely by Google/Firebase.

7. Other App Permissions

Pass & Play (offline mode) runs entirely on your device — no gameplay data leaves your phone in this mode, and no network permissions are used while playing offline.

8. Cookies (Website)

Our website, playchorsipahi.com, uses only strictly necessary cookies/local storage required for the site and game client to function (for example, remembering your sound/haptics preferences or an active session). We do not use third-party advertising cookies or cross-site tracking cookies. You can clear these at any time via your browser settings; doing so will simply reset your local preferences.

9. Analytics

If we introduce analytics or crash reporting in the future to improve app stability and gameplay experience, we will update this Privacy Policy and the app's Play Store Data Safety section beforehand to disclose exactly what is collected.

10. How Data Is Stored

• Account data (name, email, UID) is stored by Google Firebase Authentication under Google's security and compliance standards.
• Live room/game state (players, scores, round data, chat) is held in our Node.js backend server's memory only for the duration of an active game session, and is discarded once a room becomes inactive and is cleaned up.
• Voice chat audio is relayed peer-to-peer via Agora's network and is never stored by us at all.
• We use industry-standard encryption in transit: all connections to our server (REST API, Socket.IO, and static site) are served over HTTPS/WSS.

11. Data Sharing

We do not sell your personal data. We share limited data only with the service providers necessary to run the Service, each acting as a data processor on our behalf:

• Google Firebase — authentication and identity verification.
• Agora — real-time voice chat relay.
• Other players in your room can see your display name, avatar, score, and — if you choose to speak — hear your voice during that game, by design.

We may disclose information if required to do so by law, or to protect the rights, safety, and integrity of the Service and its users.

12. Data Deletion Requests

You can request deletion of your account data at any time:

• In-app: Use the "Sign out" option to end your session; guest session data is automatically discarded when your room ends.
• By request: Email us at privacy@playchorsipahi.com with the subject line "Data Deletion Request" and the Google account email or approximate guest session date/time used. We will verify and delete associated account data within 30 days.

Note: because live gameplay data (scores, room history) is held only in server memory for the duration of a session and not persisted afterward, most gameplay data is already automatically removed shortly after a room ends.

13. Your Rights (GDPR / CCPA)

If you are located in the European Economic Area (EEA/GDPR) or California (CCPA), you have the right to:

• Access the personal data we hold about you.
• Request correction or deletion of your personal data.
• Object to or restrict certain processing of your data.
• Request a copy of your data in a portable format.
• (CCPA) Know what categories of personal information are collected and not have your data sold — we do not sell personal information.
• Withdraw consent at any time (e.g. by signing out or uninstalling the App).

To exercise any of these rights, contact us using the details in Contact Information below.

14. Children's Privacy

Chor Sipahi is intended for a general audience and is not directed at children under 13 (or the minimum age required by your country's law). We do not knowingly collect personal information from children under this age. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

15. Security

We take reasonable technical and organizational measures to protect your information, including:

• HTTPS/WSS encryption for all network traffic between the app/website and our servers.
• Server-side verification of identity tokens before granting access to rooms or issuing voice chat tokens.
• Voice chat tokens are short-lived, room-scoped, and never expose our underlying Agora credentials.
• Secrets and service credentials are never bundled into the app or exposed to the client.

No method of transmission or storage is 100% secure; while we work hard to protect your data, we cannot guarantee absolute security.

16. Data Retention

Account identity data (Google name/email/UID) persists in Firebase Authentication until you delete your account or request deletion. Live game/room data exists only in server memory for the duration of an active session and is discarded shortly after a room becomes empty or inactive. We do not maintain a persistent gameplay history database at this time.

17. Contact Information

18. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, features, or legal requirements. Material changes will be reflected by updating the "Last updated" date below, and — where required — we will provide additional notice (e.g. an in-app notice) before the change takes effect. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.