What ChimpDeck installs, what it sends, and what happens if we ever stop

At a glance

• The picture, sound and controls of your game never go through our servers.
• The USB bridge driver is signed by Microsoft. The virtual display is signed by SignPath Foundation. Our own installer is not code-signed yet.
• Your PC talks to our servers for your licence, update checks and the meeting point. Nothing it sends carries an account or your hardware serial numbers in the clear.
• Uninstalling removes the app and the virtual display; the USB bridge driver and your settings stay until you remove them.
• If ChimpDeck is ever discontinued, its source code is released as open source. That promise is in the Terms.

Who is behind it

ChimpDeck is made by Tecno Eurotrading SL (NIF ESB82779562), Calle Caravaña 4, Local 1 · 28805 Alcalá de Henares, Madrid, España.

Payments go through Stripe: your card number never reaches our systems, and all that comes back is the card brand and last four digits, to show them to you. Every purchase gets an invoice registered with VeriFactu, the Spanish Tax Agency’s invoicing system.

Your game never goes through our servers

The picture, the sound, your controllers, keyboard, mouse, touches and microphone travel straight between your PC and your Android device: over your home network or, away from home, straight across the internet once the meeting point has introduced them. A controller shared over USB goes direct too.

At home the meeting point isn’t used. Away from home it introduces the two devices and, if a direct path to the PC’s start-up channels can’t be opened, it carries only those: the PC’s details, pairing and the negotiation that opens the session. The encrypted part of that start-up, where the session keys travel, is protected end to end and the meeting point can’t read it. The rest (the PC’s name, what it can do and the negotiation) isn’t encrypted by the protocol; the meeting point passes it on without storing it. The PC won’t let the meeting point carry anything else.

You can switch the meeting point off in ChimpDeck for Windows. Without it you still play at home and, away from home, through the PC’s public address if your router lets it through.

What the Windows installer puts on your PC

• ChimpDeck for Windows, installed for your user account only. Our installer and app aren’t code-signed yet, so the first time Windows SmartScreen may warn about an unknown publisher: choose “More info”, then “Run anyway”. Only download it from www.chimpdeck.com. Every update is checked against its SHA-256 fingerprint before it runs.
• The USB bridge driver: usbip-win2 0.9.7.5, an open-source driver (BSD 2-Clause licence) maintained by Cloudyne Systems in Sweden. Its kernel files are signed by Microsoft (Microsoft Windows Hardware Compatibility Publisher) and its own installer is signed by its maintainer. It’s what makes your real controller appear on the PC.
• The virtual display adapter: Virtual Display Driver by MikeTheTech. It runs in user mode (no kernel component) and is signed by SignPath Foundation, not by Microsoft. It’s what gives your device a screen of its exact size.
• Microsoft WebView2, downloaded from Microsoft only if your PC doesn’t already have it.

What leaves your PC

Everything ChimpDeck for Windows sends over the internet, and nothing else:

• Licence (the free tier included): a pseudonymous fingerprint of the PC made from five hardware identifiers, each one hashed with SHA-256 and shortened before it leaves, never the identifiers themselves; a random installation ID; the app’s build number and a public key generated on the PC. It is rechecked every 24 hours. On the free tier, also the play time used, tied to a hashed machine ID.
• Update checks: the installed version and the random installation ID.
• Meeting point (on by default): the host’s ID, a short fingerprint of its certificate, its address on your home network, its ports and its version, with a heartbeat every 30 seconds; when one of your devices calls, the addresses the PC can be reached at; and small echo packets so it can learn its public address.
• Public address: version 1.0.1 also asks api.ipify.org, icanhazip.com and ifconfig.me for the PC’s internet address every 30 minutes. The next version contacts no third party at all: it asks only our own meeting point, which stores nothing.
• Payments: when you buy or renew the Non Stop Pass, a request ID and the version of the terms you accepted. Card details go to Stripe, never to us.
• Diagnostics: none. The PC’s log stays on the PC.

What leaves your phone or TV

The Android app has no account, no analytics, no ads and no Google Play Services. It reaches our servers in two cases only:

• A diagnostic report when the app crashes, when its core fails to start, or when you send one: a random installation ID, the device model, the app version and the last lines of its log.
• The meeting point, only when your PC can’t be reached at home or at its public address.

When you uninstall

• Removed: the app, its start-up entry, chimpdeck:// links and the virtual display. This step asks for administrator permission; if you say no, the uninstaller explains how to remove it from Device Manager.
• Kept: the USB bridge driver, which other software can use too (remove it from Settings → Apps, listed as “USBip”), and Microsoft WebView2.
• Kept: your settings, paired devices, licence and log, in %LOCALAPPDATA%\ChimpDeck and the registry key HKCU\Software\ChimpDeck. With version 1.0.1, delete them by hand if you want no trace left; from the next version, the uninstaller asks whether to delete them (no, by default). If you delete them and reinstall on the same PC, your licence comes back by itself.

If ChimpDeck is ever discontinued

We can’t promise the product will exist for ever. What the Terms do promise is this: if we ever stopped developing it, we would say so in advance, publish a way for licences to keep working without depending on us, and release the source code of the app, the host and its drivers as open source, so the community could keep them alive.