Privacy policy

Who is accountable for this

The data controller is Tecno Eurotrading SL, tax ID ESB82779562, registered at Calle Caravaña 4, Local 1, 28805 Alcalá de Henares, Madrid, Spain.

You may exercise your rights of access, rectification, erasure, objection, restriction and portability at any time by writing to us from the contact form on this website. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD).

What the app collects

The app asks for no account and no sign-up, and ships no analytics, no third-party crash-reporting SDK and no advertising identifier: the manifest removes it explicitly. Your picture, your sound and whatever you type or do with the controller travel only between your Android device and your PC, never through a server of ours.

While you play, two things, and only two, do reach our servers, and both are described in detail below: diagnostic reports when something fails, and the minimal connection data the meeting point needs when you play away from home.

This holds whether or not you own a Non Stop Pass. The phone never talks to our licensing service: the PC obtains a signed permission and shows it to the phone, which only checks the signature. Buying a Pass is a separate case, and the only one that adds anything to this list: what the licence and the invoice need has its own section below.

Diagnostic reports

When the app core fails to start, when the app closes because of an error, or when you ask for it from Settings, the app sends a technical report to our server over HTTPS so we can see what happened and fix it.

The report contains the last lines of the app’s own log (never the whole system log nor other apps’ logs), the device model, the Android version, the app version, the reason for sending and a random installation identifier used only to group reports from the same device. It contains no picture, no sound and nothing you type or do with the controller.

Reports are kept for ninety days and then deleted automatically. The legal basis is our legitimate interest in keeping the app working; automatic sending is limited to failures, and the rest is up to you.

The meeting point (playing away from home)

On your home network the meeting point is not used: the app talks to your PC directly. Away from home, your PC keeps a small outbound connection to our meeting point and the app finds it through it; once introduced, picture, sound and controls travel directly between phone and PC.

To introduce them, the meeting point sees the identifiers of the two devices (a fingerprint of their identity, not your name or any account), the name you gave the device, their network addresses with ports, and the time they connect. It does not see — and could not see — your picture, your sound or your controls: they do not pass through it.

That connection data is processed in memory only, for as long as the connection lasts, and is not stored: the service log records how many PCs are online, versions and error reasons, never identifiers, names or addresses. It is used for nothing but introducing your two devices.

What stays on your device

The app keeps a few settings in your Android device private storage, readable only by the app and removed when you uninstall it:

• The name the server advertises on your network and the port it uses.
• The nicknames you give your controllers, tied to their serial number.
• Your preferences: auto-start, alerts, pairing key, controller-driven navigation.
• A summary of finished sessions (duration, bytes transferred, measured latency), which only you can export.

What travels on your network

When you plug in a controller and use it from the PC, the controller data travels between your Android device and your computer over your local network, using a USB/IP compatible protocol. That traffic never goes through any server of ours.

When you watch and play your PC from the device, the PC’s picture and sound and your controls, touches, keyboard, mouse, microphone and clipboard travel between the two devices, protected end to end and on by default; at home over your local network and, away from home, over the direct path the meeting point opens. None of it goes through a server of ours either.

The app advertises itself on the local network over mDNS so the client can find it. That announcement carries the name you gave the server and its address on your network.

Permissions and why

• USB device access: this is what the app does — read the controller you plug in.
• Internet and network state: to listen for the client on your local network and advertise on it.
• Foreground service (connected device): to keep the session alive while the PC is using the controller.
• Notifications: for the ongoing server notification and session alerts.
• Start on boot: only if you turn it on, to bring the server back after a restart.

Children

The app is not directed at children under 13, and since it collects no data from anyone, it collects none from children either.

Third parties

The published app ships no third-party library that collects data: no analytics, no advertising, no Google Play Services libraries (no Firebase, no ads). Diagnostic reports and the meeting point’s connection data stay on our servers and are shared with nobody.

To learn your PC’s internet address, ChimpDeck for Windows 1.0.1 also asks three public services (api.ipify.org, icanhazip.com and ifconfig.me) every 30 minutes, and they see that address as they would on any website visit. The next version contacts no third party at all: it asks only our own meeting point, which doesn’t store it; everything that leaves the PC is listed on the trust page (/trust).

This website (not the app) uses Google Analytics 4 in consent mode: until you consent, no analytics cookie or persistent identifier is stored, and Google only receives aggregated signals that do not identify you. You can browse and buy without accepting anything.

The form on this website

Everything above is about the app. This website also has a contact form, and it is worth saying what happens with what you write there: your name, your email and your message are sent by email to our support mailbox and used only to reply to you. They are not stored in any database, they feed no mailing list and they are shared with nobody.

To keep spam out, the server counts how many messages arrive from the same IP address over a few minutes. That count lives in the process memory, with no IP tied to any message, and disappears on its own shortly after. The website carries no tracking cookies and no advertising; the only measurement is Google Analytics 4 in consent mode, with no cookie or identifier until you accept (see “Third parties”).

The Non Stop Pass and the Windows client

This part does process data, which is why it is spelled out in full. When you activate the Non Stop Pass, the Windows client talks to our licensing server to check that the licence is yours and that it is used on a single computer. This is what gets stored, and nothing else:

• The cryptographic digest (SHA-256) of your twelve-word phrase, which is how a licence is looked up.
• The phrase itself, encrypted with AES-256-GCM. It exists so we can send it to you again if you lose it, which is the only thing that gets you back what you paid for. The encryption key is not in the database but in a file on the server: a database dump without that file yields no usable licence.
• Your email address. It is where your key goes, and it is what lets us resend it and stop you buying twice by mistake. It is the only personal detail in the licensing system.
• A random installation identifier, generated by your computer and unrelated to you as a person.
• Five cryptographic digests of the machine (motherboard, disk and the like). The original serial numbers never leave your computer: only the digest travels, and it cannot be turned back into them.
• An encryption public key for that installation, the client version, and the dates it was registered and last seen.
• For the free tier’s Play Cooldown, only a digest of the machine and the seconds of real play in the current cycle. It deletes itself when the cycle ends.
• To detect one key being shared with many people, the digest (SHA-256) of the IP address and how many times it was seen that day. The address itself is never stored, and the record deletes itself after 30 days.

What the licensing system does NOT hold

There are no card details: payment is processed by Stripe and the number never touches our servers. Nor is there anything about what you do — what you play, when, or which controllers you use — because neither the gameplay nor the controller traffic passes through any server of ours: it travels directly between your devices.

And there are no billing details. The name, tax number and address you type when buying do not go into the licensing database: they go to our invoicing system, which is where the law requires us to keep them. They are two separate places on purpose, and the licensing one holds only your email.

The legal basis is performance of the purchase contract, so we can give you what you paid for; compliance with a legal obligation, so we can issue and keep the invoice; plus our legitimate interest in a licence being used on one computer rather than a thousand. Your licence data is kept for as long as the licence exists and your billing data for as long as tax law requires; everything else deletes itself within the periods above. It is never shared or sold.

The invoice

When you buy we ask for just enough to invoice you: if you buy as an individual, your first name, last name and country; if you buy for a company, also its registered name, tax number and address. The country is always asked because it is what determines the tax on the sale.

Those details are used to issue your invoice and are kept in our invoicing system for as long as tax law requires. The invoice is registered with the Spanish Tax Agency through Veri*Factu, which is mandatory: that means reporting the invoice record to the Agency, with the data the rules themselves set out.

If you give us the VAT number of a company in another EU country, we check it against VIES, the European Commission’s public register, to know whether the reverse charge applies. That lookup sends the number and nothing else.

Changes to this policy

If a future feature ever needed to process data, this page would be updated before that version is published, stating the date of the change.