Privacy Policy

Last updated: 06 July 2026

Effective date: 03 August 2026

This Privacy Policy ("Policy") explains how Atimis Technologies, the operator of the Kibitzz product ("Kibitzz", "we", "us", or "our"), collects, uses, shares, retains, and protects your personal data when you use the Kibitzz mobile application and website (together, the "Service").

We act as the Data Fiduciary for personal data processed through the Service. We are committed to processing your data in accordance with India's Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and its rules, and other applicable data-protection laws.

By creating an account or using the Service, you confirm that you have read and understood this Policy. If you do not agree with it, please do not use the Service.

1. Who we are and how to contact us

• Service: Kibitzz
• Operated by: Atimis Technologies
• Location: Bengaluru, Karnataka, India
• Grievance & Privacy Contact: contact@kibitzz.in

You may use our Grievance & Privacy Contact for any question, request, or complaint about your personal data or this Policy. We aim to acknowledge grievances promptly and to respond within the timelines required by the DPDP Act.

2. A quick summary

We collect only what we need to sign you in, digitise your scoresheets, analyse your games, and run your account. In particular:

• We use Google Sign-In, so we never see or store your password.
• Scoresheet photos you upload are used only to extract the moves, and are deleted from our servers immediately after processing — we do not keep them or use them to train models.
• When we send chess data to our AI provider for OCR and coaching, we send only the chess moves and game details — not your name, email, or profile picture.
• We do not sell your personal data, and we do not use third-party advertising or tracking cookies.

The rest of this Policy sets out the detail.

3. What data we collect

a) Account and identity data (via Google Sign-In)

When you sign in with Google (OAuth 2.0), we receive and store:

• your email address (used as your primary unique identifier),
• your full name (displayed in the app), and
• your profile-picture URL (displayed in the app).

We do not collect or store your Google password (Google handles authentication), and we do not collect your phone number or physical address.

b) Chess content you provide

• Scoresheet images — photographs or image files of handwritten chess scoresheets that you capture or upload for digitisation.
• Game metadata — the player names (White/Black), event name, date, site, round, and result that you enter, review, or edit before saving a game.
• Chess moves (PGN/FEN) — the sequence of moves and the corresponding board states, together with their validation status (whether each move was legal or flagged as a possible OCR error).
• PGN files you upload, paste, or export.

c) Data we generate from your content

• Engine analysis — Stockfish evaluations such as blunder detection, accuracy metrics, and evaluation graphs.
• AI coaching reviews — plain-language, LLM-generated coaching summaries of your games.

d) Usage metrics and telemetry

To operate free-tier limits, prevent abuse, and manage AI/compute costs, we store:

• Quota counters — the number of scans, full game analyses, and coaching summaries you have used.
• Timestamps — your account creation date, last login/update time, and the time you accepted our Terms.

e) Technical and log data

Basic technical information necessary to deliver and secure the Service, such as device/app version information and diagnostic logs generated when you use the Service.

f) Subscription and payment data (if and when paid plans are offered)

Where paid features are available, purchases are processed by the Apple App Store, Google Play, or a third-party payment processor. We may receive confirmation of your subscription status and a transaction identifier. We do not collect or store your full card or bank details — these are handled entirely by the payment provider.

We do not intentionally collect special-category or sensitive personal data, and we ask that you not include such data in scoresheet images, metadata, or notes.

4. How your scoresheet images and games are processed (AI)

Because AI processing is the core of the Service, we want to be explicit about it:

• Scoresheet upload and OCR. When you scan or upload a scoresheet, the image is transmitted securely to our backend and to our AI provider (Groq, which hosts vision and large-language models) to extract the moves via optical character recognition (OCR).
• Immediate image deletion. Your uploaded image is held only for the few seconds needed to run OCR. As soon as the text is extracted, the image file is immediately and permanently deleted from our servers. We do not store your scoresheet photos, and we do not use them to train any model.
• Move validation. Extracted moves are validated for legality. Uncertain or illegal moves are flagged (red-flagged) so you can review and correct them before the game is saved or analysed.
• Engine analysis (Stockfish). On the mobile app, in-depth analysis generally runs locally on your device, and only a small result payload is sent to our servers — reducing data transmission and working even with poor connectivity. On the web app, analysis runs on our backend server.
• AI coaching summaries. To generate a coaching summary, we send the relevant game data to our AI provider and return the summary to you.

Data minimisation with our AI provider. When chess data is sent to our AI provider, we send only the chess moves and game metadata. We do not send your personal identifiers (email, name, or profile picture) to the AI provider.

5. Purposes and legal bases for processing

We process your data for the purposes below, relying on the grounds permitted under the DPDP Act — your consent, the performance of our contract with you (our Terms), our legitimate uses, and compliance with law:

• to create, authenticate, and manage your account;
• to digitise scoresheets, validate moves, run engine analysis, and produce coaching summaries (core Service, provided under our contract with you);
• to save your games and history and sync them to your account;
• to enforce free-tier usage limits and, where applicable, manage subscriptions;
• to maintain security, detect and prevent fraud, abuse, and misuse, and to debug and improve the Service;
• to respond to your enquiries and provide customer support; and
• to comply with legal obligations and to establish, exercise, or defend legal claims.

You may withdraw any consent you have given at any time (see Section 10). Withdrawing consent may limit or prevent your use of features that depend on that processing.

6. Children's privacy

Kibitzz is used by chess players of many ages, including children, and we take children's data seriously.

• Under the DPDP Act, a "child" is anyone under 18 years of age.
• We process a child's personal data only with the verifiable consent of a parent or lawful guardian. A child should use Kibitzz, or have their games uploaded, only under the supervision and with the consent of a parent, guardian, or a coach acting with parental authorisation.
• We do not carry out tracking or behavioural monitoring of children, and we do not serve targeted or behavioural advertising to children.
• Where a coach or parent uploads a child's games, that adult confirms that they have the authority and consent to do so.
• A parent or guardian may review, correct, or request deletion of a child's data, or withdraw consent, by contacting our Grievance & Privacy Contact.

If you believe a child's data has been collected without appropriate consent, contact us and we will take prompt steps to verify and, where required, delete it.

7. Who we share data with

We do not sell your personal data. We share it only with the service providers ("Data Processors") that help us run the Service, and only to the extent needed. Each is engaged under terms requiring them to protect your data and process it only on our behalf.

We may also disclose personal data: (a) to comply with applicable law, a court order, or a lawful request from a public authority; (b) to protect the rights, safety, and security of our users, the public, or Kibitzz, and to investigate abuse or fraud; and (c) in connection with a merger, acquisition, restructuring, or sale of assets, subject to this Policy.

8. International data transfers

Some of our providers (for example, our AI provider and certain infrastructure) may process data on servers located outside India. Where we transfer personal data abroad, we do so in accordance with the DPDP Act and any restrictions notified by the Central Government under it, and we take reasonable steps to ensure your data remains protected. By using the Service, you acknowledge such transfers for the purposes described in this Policy.

9. Data retention

• We retain your account data and saved games, analysis, and reviews for as long as your account is active, so you can revisit and re-analyse them.
• Scoresheet images are not retained — as described in Section 4, they are deleted immediately after OCR processing.
• Usage metrics and timestamps are retained as needed to operate free-tier limits, secure the Service, and improve it.
• When you delete your account, we delete or irreversibly anonymise your personal data within a reasonable period, except where we are required or permitted by law to retain certain data (for example, for accounting, tax, or dispute-resolution purposes). We may keep aggregated or anonymised data that can no longer identify you.

10. Your rights

Subject to the DPDP Act, you have the right to:

• Access — obtain a summary of the personal data we process about you and how we process it;
• Correction and completion — have inaccurate or incomplete data corrected, completed, or updated;
• Erasure — request deletion of your personal data where it is no longer needed for the purpose it was collected;
• Withdraw consent — withdraw any consent you previously gave, as easily as you gave it;
• Nominate — nominate another individual to exercise your rights in the event of your death or incapacity; and
• Grievance redressal — raise a complaint using our Grievance & Privacy Contact and, if unresolved, escalate to the Data Protection Board of India.

To exercise any right, contact us using our Grievance & Privacy Contact (Section 1). We will verify your identity and respond within the timelines required by law. To help you exercise your erasure right directly, the Service provides (or will provide) an in-app account-deletion option and/or the contact route above.

11. How we protect your data

We use reasonable security safeguards appropriate to the sensitivity of the data, including:

• Encryption in transit — all data exchanged between the app or website and our servers is encrypted using standard HTTPS/TLS;
• Authentication — sign-in is handled via Google OAuth 2.0, and the web app stores your session token (JWT) in the browser's localStorage;
• On-device processing — on the mobile app, in-depth engine analysis runs locally on your device, reducing the data transmitted to us; and
• Access controls — internal access to personal data is limited to what is necessary to operate the Service.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. In the event of a personal-data breach, we will notify affected users and the Data Protection Board of India as required by law.

12. Cookies and similar technologies

The website uses essential storage — principally the browser's localStorage — to keep you signed in by holding your authentication token, and to remember basic preferences. We do not use third-party advertising or tracking cookies. You can control browser storage and cookies through your browser settings, but disabling essential storage may break parts of the Service.

13. Third-party links and services

The Service may reference or link to third-party sites or services (for example, Chess.com or Lichess). We are not responsible for the privacy practices of those third parties, and we are not affiliated with them. Please review their policies separately.

14. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, technology, or the law. We will post the updated version with a new "Last updated" date and, for changes that materially affect how we process your data, provide a prominent notice in the app or by email. Continued use of the Service after the changes take effect means you accept the updated Policy.

15. Contact

For any question, request, or complaint about this Policy or your personal data:

Atimis Technologies (operator of Kibitzz)
Grievance & Privacy Contact: contact@kibitzz.in
Location: Bengaluru, Karnataka, India

You may also lodge a complaint with the Data Protection Board of India if your grievance is not resolved to your satisfaction.