Privacy, Deception and Device Abuse

Last updated: September 14, 2026

This page sets out how Chkoba meets the Google Play Developer Program Policies grouped under Privacy, Deception and Device Abuse. It covers the data the game handles, the permissions it asks for, how it is monetised, and — just as importantly — what it does not do. It sits alongside, and does not replace, our full Privacy Policy.

1. User Data

What the game stores about you

An account holds only what the game needs to work:

• Identity: username, email address, and a password that is stored hashed, never in plain text. If you sign in with Google, a Google account identifier is stored instead of a password.
• Progress: coin balance, experience level, games played and games won.
• Play history: finished matches, rounds and scores, and who you played against.
• Social: friendships and friend requests you create, and messages you send in the in-match chat.
• Preferences: language, timezone, difficulty, sound and animation settings, and your notification and privacy choices.
• Purchases: for each coin purchase, the payment processor's transaction reference, the number of coins, the amount and currency, and whether it completed.

What it does not collect

Chkoba does not collect your location, your contacts, your call or SMS logs, your photos or files, your installed apps, or any health or fitness data. It has no access to any of these — see the permissions section below.

We never sell your personal information. Card details are never seen or stored by us: payments are handled entirely by Google Play Billing on Android and by Stripe on the web, and we receive only the transaction reference and its outcome.

Data in transit

Every request between the game and our servers is encrypted. The Android build is built to use HTTPS and WSS exclusively, and its build pipeline refuses to produce a release that is configured any other way.

Deleting your data

2. Permissions

The Android app requests exactly one permission:

• android.permission.INTERNET — to reach the game server for accounts, matchmaking, online matches and purchases.

That is the whole list. Chkoba requests no location, camera, microphone, contacts, storage, phone, SMS or nearby-devices permission, and it declares no accessibility service, device administrator, VPN service, or any permission classed by Google Play as sensitive or restricted. It does not ask to draw over other apps, to read notifications, or to run in the background.

3. Deceptive Behaviour

The store listing describes the game that is actually installed. The screenshots are real frames captured from the running game rather than mock-ups or concept art, and the gameplay footage is an unedited recording of a real match.

• No hidden functionality. The app does nothing that a reasonable player would not expect from a card game, and has no undisclosed features.
• Ads are separate from play. Adverts are never disguised as part of the game, as a card, or as a system notice. Rewarded adverts are started only when you choose to watch one, and what you get for watching is stated before it begins.
• Purchases are explicit. Coins are a virtual in-game currency with no monetary value outside the game and cannot be exchanged for cash. The coin count and the price are shown before you confirm, and every purchase is verified with Google Play or Stripe on our servers before any coins are added.
• No impersonation. Chkoba does not claim affiliation with, or endorsement by, any organisation it is not part of.

4. Device and Network Abuse

Chkoba does not do any of the following, and is built so that it cannot:

• Download or execute code from outside Google Play. The game ships complete; there is no dynamic code loading, no interpreter fed from a server, and no self-updating mechanism.
• Modify device settings, install or remove other apps, or interfere with any other app.
• Use the network for anything other than playing the game — accounts, matchmaking, live matches, purchases and adverts. It does not run background transfers, proxy traffic, mine cryptocurrency, or participate in any distributed network.
• Attempt to gain privileges it was not granted, or to circumvent any part of the Android security model.

5. Advertising

The Android app shows adverts through Google AdMob; the web version uses Google AdSense. Google may use advertising identifiers to select and measure adverts, as described in Google's own policy. We do not pass your account details, email address or play history to any advertiser.

Adverts are optional in the sense that matters: rewarded adverts — the ones that pay out coins — only ever play because you asked for one.

6. Families and Age

Chkoba is not directed at children under 13 and we do not knowingly collect personal information from them. Sound effects rated for mature audiences are off unless a player turns them on; that is a content setting, not an age check. If you believe a child has given us personal information, email [email protected] and we will delete it.

7. Contact

Questions about anything on this page, including data deletion requests and policy queries from Google Play reviewers, go to [email protected].