Privacy Policy

Smaipa AI UG (haftungsbeschränkt)
Weilburger Straße 16
60326 Frankfurt am Main, Germany
Email: privacy@chipsstory.com

When you use Chips Story, we may collect the following categories of data:

• Account information — email address and display name provided via Apple Sign-In or Google Sign-In.
• Camera & chip stack photos — photos taken within the app of your chip stacks, used to count and record chip denominations. Camera access is requested only when you use the chip-scanning feature.
• Chip stack data — the denomination counts you enter or confirm per chip color, stored against your account.
• Tournament data — tournament names, dates, and chip color-denomination mappings you configure.
• Usage analytics — anonymous interaction data such as screens visited, features used, and session duration, collected via Mixpanel. Your chip photos and stack counts are never sent to Mixpanel.
• Device information — device type, operating system version, and app version, used for diagnostics and compatibility.

• To provide the core service: storing your chip counts and displaying your tournament progression.
• To sync your data securely across your devices via your account.
• To improve the app experience based on anonymised usage patterns.
• To develop and improve AI-powered chip counting — see Section 4 for full details and your opt-out rights.

Chips Story uses and is developing machine-learning models to automatically count chip stacks from photos. Here is exactly how your data is involved and what control you have.

What may be used (with your consent): Photos of chip stacks and the denomination counts you confirm. This data is processed in aggregate and is de-identified before being used for model training — it is not linked to your name or email during training.

Third-party AI disclosure (Apple guideline 5.1.2): If your chip photos or data are processed by any third-party AI platform (e.g., a cloud vision API or external model provider), we will disclose this explicitly at the point of consent and name the service in this policy. Currently, on-device and internal models are used; this section will be updated before any external AI provider is introduced.

Opting out: You can opt out of AI training at any time in Settings → Privacy → AI Training. Opting out does not affect your ability to use the app. Anonymised data already incorporated into trained models cannot be retroactively removed, as it is no longer personally identifiable.

Where required — including for camera access, analytics, and AI training — we obtain your consent through clear in-app prompts before data collection begins. You may withdraw consent at any time:

• Camera access: revoke via iOS Settings → Chips Story → Camera.
• Analytics: opt out via Settings → Privacy → Analytics inside the app.
• AI training: opt out via Settings → Privacy → AI Training inside the app.
• Full account deletion: available via Settings → Account → Delete Account (see Section 9).

Your data is stored in Supabase, a cloud database platform hosted on AWS in the EU (Frankfurt, eu-central-1). All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).

We use the following third-party services. Each is contractually required to provide the same level of data protection as stated in this policy and as required by Apple's App Review Guidelines and GDPR:

• Supabase(database & authentication) — stores your account and app data on EU infrastructure. Privacy policy: supabase.com/privacy
• Apple Sign-In / Google Sign-In — used for authentication only. We receive only your name and email; we do not access any other data from your Apple or Google account.
• Mixpanel (analytics) — receives anonymous usage events only. Mixpanel does not receive your name, email, chip photos, or stack counts. Privacy policy: mixpanel.com/legal/privacy-policy

As a user in the EU, you have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and all associated data (see Section 9)
• Export your data in a portable format
• Object to or restrict processing of your data
• Withdraw consent at any time (see Section 5)
• Lodge a complaint with your national data protection authority

You can delete your account and all associated personal data directly within the app:

Alternatively, you can request deletion by emailing privacy@chipsstory.com. Chip stack photos are deleted alongside your account. Anonymised, aggregated data that has already been incorporated into AI model training may be retained, as it is no longer personally identifiable.

We retain your personal data for as long as your account is active. Upon account deletion, all personal data and chip stack photos are permanently deleted within 30 days. Aggregated, anonymised data derived from your data (e.g., trained model weights) may be retained indefinitely as it cannot be traced back to you.

We do not sell your personal data. We do not share your data with third parties except as described in Section 7 (service providers necessary to operate the app). We may disclose data if required by applicable law or a valid legal process. Any third party that receives your data is contractually bound to protect it to the same standard described in this policy.

Chips Story is not intended for users under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please contact us at privacy@chipsstory.com and we will delete the data promptly.

We may update this privacy policy from time to time. We will notify you of material changes via an in-app notification or email at least 14 days before changes take effect. Continued use of the app after the effective date constitutes acceptance of the updated policy. The date at the top of this page always reflects the most recent revision.

If you have questions about this privacy policy, your data, or wish to exercise your rights:

Smaipa AI UG (haftungsbeschränkt)
Weilburger Straße 16
60326 Frankfurt am Main, Germany
Email: privacy@chipsstory.com

You also have the right to lodge a complaint with the competent data protection supervisory authority. In Germany, this is the Federal Commissioner for Data Protection and Freedom of Information (BfDI).