Privacy Policy

We collect the minimum needed to run the site. We don't sell your data, we don't run third-party advertising trackers, and we don't build behavioral profiles. If you're not signed in, we don't know who you are.

What we store

• Account — your email address, optional display name, and the timestamp of your last login.
• Sessions — an opaque session cookie so you don't have to sign in on every request. Expires after 30 days of inactivity. The cookie is HTTP-only, SameSite=Lax, and signed; it carries no personal data, only a session ID.
• Uploaded games — SGF content you upload, plus the analysis we run on it.
• Saved variations + favorites — branches you've saved during review and games you've starred.
• Preferences — UI settings (theme, widget toggles, coordinates on/off) synced across your devices.
• Subscription state — for paid users: tier, renewal date, and a customer ID from our payments provider so we can match webhook events to your account. We do NOT store card numbers or billing addresses; those live with the payments provider.
• OGS link state — if you connect OGS: your OGS user ID, username, and OAuth tokens (encrypted at rest). We never see your OGS password.
• Request logs — IP address, user agent, and URL of each request. Retained 14 days, then automatically deleted by log rotation. Used for diagnosing bugs and blocking abuse — not for analytics or advertising.
• Encrypted database backups — twice-daily snapshots are uploaded to an offsite store (Backblaze B2, U.S.) for disaster recovery. Backups age out after 30 days. If you delete your account, your data is gone from the live database within 24 hours; backup expiry takes up to 30 additional days.

What we don't store

• Passwords. Auth is a magic-link email or a sign-in provider (Google, Apple, LINE, Kakao, Discord) — we never see or store one.
• Card numbers, billing addresses, or any payment details (handled entirely by our payments provider, who is PCI-DSS compliant).
• Third-party ad-tracking cookies.
• Cross-site behavioral profiles. If you're not signed in, we don't build a profile of you.

Sharing your games

A game you upload, import from another Go server (OGS, Fox, KGS, Pandanet) or play against one of our bots is unlisted. Nobody can find it on Kifubara: it never appears in the game browser, search, player or tournament pages, or in puzzles shown to other people, and we ask search engines not to index it. It's available only to people you share its link with, so you can share a game by sending someone the address from your browser.

Someone you share a game's link with can see the game record and its AI analysis, and can download the SGF if they're signed in. They don't see your notes and variations or your tags unless you share your review with them from the game's Share menu.

Boards you set up in the editor are private: only you can open them until you share one from its Share menu.

If you'd like your games to be private by default, so nobody else can open them even with a direct link, turn on Private until shared in your settings. Anything you share from a game's Share menu keeps working.

Your tags are private to you

Tags you add to games (in /me/games or at upload time) are scoped to your account. They're visible only to you, even on games that other users have also uploaded or favorited. We don't share tag data with other users, with advertisers, or with third parties. Your full tag set is included in the JSON data export so you can take it with you, and is permanently removed when you delete your account.

Third parties we share with

Your data primarily lives on infrastructure we control. The third parties that necessarily see some of it are limited to the ones you interact with directly:

• Sign-in providers — Google, Apple, LINE, Kakao and Discord. If you sign in with one, that provider sees your sign-in request. We ask only for your email address and display name (and your avatar, where the provider offers one). We use the email address solely to identify your account and to send the transactional mail described above — never for marketing, and we never share it onward.
• Apple's Hide My Email — if you choose it, Apple gives us a relay address instead of your real one and forwards our mail to you. We never see your real address.
• LINE and Kakao — these don't give us an email address, so we generate an internal placeholder. Those accounts never receive email from us.
• LemonSqueezy — our payments provider, acts as merchant of record for paid subscriptions. Handles VAT / sales tax globally. They receive what you enter at checkout (email, billing address, card details). We never see card details.
• OGS (online-go.com) — only if you connect your OGS account. We fetch your games via their API using a token you authorized. We never see your OGS password.
• Email delivery provider — sends our transactional email (magic-link, welcome, analysis-ready notifications). Transactional-only; we do not send marketing email.
• Analytics — privacy-focused pageview + event counting so we know which parts of the site are used. No cookies, no cross-site tracking, no behavioral profiles. The analytics provider sees the URL, referrer, and a generic device type (mobile/desktop) and nothing that personally identifies you.

Beyond those, we use standard infrastructure providers (hosting, CDN, backup, GPU compute) to operate the Service. They process data on our behalf under data-processing agreements, do not receive content beyond what's required to deliver the Service, and are not permitted to use it for their own purposes. The specific providers we use may change over time without a policy update. If you have a specific question about who handles a particular kind of data, reach us via the contact form.

Where your data is stored

Kifubara is operated from the United States and the European Union. If you use the Service from another region, your data may be transferred to, stored in, and processed in these locations. Our providers operate under the standard legal frameworks for international data transfers.

Your rights

Sign in at /me/settings to view, export, or delete your account at any time. Account deletion cascades to your uploaded games, saved variations, favorites, and subscription state. We process deletions automatically; no email required.

If you're in the EU/UK, you have additional rights under GDPR / UK-GDPR: access, rectification, erasure, restriction, portability, and objection. Most of these are available in the Settings UI; for anything that isn't, reach us via the contact form and we respond within 7 days.

Children

Kifubara is not directed at children under 16. If we learn a child under 16 has created an account, we'll delete it.

Changes

Material changes to this policy will be emailed to you at least 7 days before they take effect.

Contact

Privacy questions or data-rights requests: use our contact form.