Official Katuranga document
Privacy Policy
This English translation is provided for convenience. If it differs from the Indonesian version, the Indonesian version prevails.
On this page
Summary
This section doesn't replace the full text below, but here are the three things people most often want to know before creating an account.
There isn't a single third-party script on Katuranga's pages — not just a promise, but a security rule set by the server and enforced by your browser.
All of your account data can be downloaded yourself as a single file, at any time, without asking anyone's permission.
From inside the app or from the website, without having to send us a request letter.
Who operates Katuranga
Katuranga is a chess app and website operated by Katuranga — Chess League Limited ("we"). This policy applies to the katuranga.com website and the Katuranga app for Android.
Any questions about this page can be sent to support@katuranga.com.
Data we store
This list is written from what our database actually contains, grouped by when the data comes in.
a. When you create an account
- Username — shown to other players on leaderboards and in games.
- Email address — to verify your account, recover your password, and send important notices such as plan expiry.
- Password — never stored as is. Only a random fingerprint (hash) is stored, which can't be turned back into your password; we can't read it ourselves.
- Google account ID — only if you choose "Sign in with Google". We receive your ID, name, and email address from Google; we never receive your Google password.
- Profile photo — only if you upload one yourself.
b. When you play
- The games you play with all their moves, results, and times.
- Your rating in each mode and its history of ups and downs.
- Game analysis results, accuracy scores, and moves marked as mistakes.
- Course progress: classes completed and the answers you submit.
- Points, badges, event and tournament participation, and your friends list.
- Appearance choices: board color and piece set.
- Region (country/province/city) — chosen by you, used for regional filters on the leaderboard. The Android app never asks for location permission. On the website, your browser may offer to guess your region, and that is always your choice.
- Last active time, so other players know who is online.
c. For account security
- A list of devices used to sign in: a device fingerprint, the label you gave it, and the last IP address of that device. This is what lets you see "where my account was opened from" and sign out unfamiliar devices.
- Server technical logs containing IP addresses and request times.
d. If you buy a plan
- Order records: plan, validity period, rupiah amount, payment method, status, and the reference number from the payment gateway. Failed payment attempts are stored too — it's the only way a question like "money was taken but my plan didn't upgrade" can be answered.
- Your card number, PIN, or e-wallet balance never reaches our servers. Payment is handled entirely by the payment gateway (Midtrans).
e. If you join the Invite Friends Program
- Your phone / GoPay number, because that's where commission is transferred. The number is checked by a person before it's used, and changing the number revokes its approval.
- Commission and withdrawal records: who you invited, when, how much, and the transfer status.
- Anti-fraud signals: the IP address at sign-up of invited people, device fingerprint, account age, and number of games. All of this is used to check invitations that look fabricated.
f. If you use the Android app
- Google Play Integrity check results: package name, version number, and Google's assessment of whether the app genuinely comes from Play and runs on a real device (not an emulator). This is used to prevent cheating and prize abuse, not to identify you.
- The app asks for only two permissions: internet access and vibration. Gallery access is only requested when you yourself choose to change your profile photo.
What the data is used for
| Running the game | Matching you with opponents, saving games, calculating ratings, building leaderboards and statistics. |
|---|---|
| Managing accounts | Verifying email, recovering passwords, sending important notices to your Inbox. |
| Keeping play fair | Detecting chess engine use, multiple accounts, and prize abuse — then refunding rating points to affected players. |
| Processing payments | Upgrading your plan after a valid payment, and keeping bookkeeping records. |
| Paying commission | Calculating and transferring Invite Friends Program commission. |
| Security | Detecting other people signing in to your account, and restoring service when something goes wrong. |
We don't use your data to build advertising profiles, and we don't sell it to anyone.
What we don't do
No ads in the app or on the website.
No trackers and no third-party analytics. Katuranga's pages may only run code from katuranga.com itself — this rule is sent by the server as a Content-Security-Policy and enforced by your browser, so it applies even if foreign code were somehow injected into a page.
We count visits ourselves, not through someone else. Since 21 September 2026 we use Umami — an open-source visit counter running on Katuranga's own server — to see which pages are opened and where visitors come from. It sets no cookies, stores no IP address, and cannot follow you to other sites. The numbers never leave our server.
We don't sell, rent, or trade your data.
We don't read the contents of your device. Katuranga doesn't ask for access to your contacts, location, SMS, or files.
Other parties involved in processing
We use as few outside parties as possible, and each one has a reason we can name.
| Only if you use "Sign in with Google" (to confirm the account really is yours) and Google Play Integrity in the Android app. | |
| Midtrans | The payment gateway for QRIS, GoPay, and other payment methods. Your payment data is processed on their side, not ours. |
| Server provider | Where this application runs and its database is stored. |
| Email provider | Delivers verification and password recovery emails to your address. |
Data is stored on servers we rent; their physical location is in Southeast Asia (Indonesia or Singapore). We don't transfer your data to parties outside the list above, unless required by applicable law.
How long data is kept
- Account data is kept for as long as your account exists, and deleted when the account is deleted.
- Server technical logs containing IP addresses rotate automatically and are deleted within 30 days at most.
- Payment records are kept longer for bookkeeping, but without your identity — the buyer is replaced by a one-way random code that can't be turned back into anyone's name.
- Games you played against other people stay in your opponents' archives after your account is deleted, with your name replaced by "Deleted player". A game belongs to two people, and deleting half of the archive of someone who asked for nothing isn't our right.
Security
- All traffic to katuranga.com runs over HTTPS.
- Passwords are stored as random fingerprints, never as readable text.
- You can see the list of devices that have opened your account and sign out unfamiliar ones.
No system is invulnerable. If a data breach involving you occurs, we'll notify you at your registered email and explain what happened — rather than waiting for you to find out yourself.
Your rights over your data
- View and correct. You can change your profile, region, email, and photo yourself on the Account page.
- Download a copy. Via Account → Delete account → Download my data, you get a single JSON file containing your profile, every game with its moves, ratings, points, and purchase history.
- Delete. You can delete your account yourself, from the app or from the website — without installing the app. The steps are fully explained on the Delete account page. Deletion has a 7-day grace period so it can still be cancelled after an accidental tap.
- Withdraw consent. You can disconnect your Google account, or stop using Katuranga at any time.
Can't sign in at all? Send an email from your registered address to support@katuranga.com stating your username.
Children and parents
Katuranga is a chess game, and people play chess from a young age. Katuranga's content is intended for players aged 6 and over.
Children under 13 may only use Katuranga with the permission and supervision of a parent or guardian, and the account is created and managed by that parent or guardian — including the email address used. A parent or guardian may ask us to delete their child's account at any time by emailing support@katuranga.com.
Plan purchases and the Invite Friends Program — including commission withdrawals — are only for users aged 18 and over, or younger with the consent of a responsible parent/guardian.
Please note: the "Sign in with Google" button depends on Google's own age rules for having a Google account. Children who don't meet those requirements can still play by signing up the regular way.
We don't knowingly collect data from children under 6. If you believe data from a child under that age has reached us, let us know and we'll delete that account.
Policy changes
If this policy changes, the effective date at the top of the page changes too, and meaningful changes are announced through the in-app Inbox. Changes that expand the data we collect never apply retroactively to data that already exists.
Contact us
Katuranga — Chess League Limited
Email: support@katuranga.com
Website: katuranga.com