Privacy policy

iroi, LLC ("we") sets out below how tinyai.run (the "Service") handles information. Only this English text is authoritative.

1. Who we are

Name

iroi, LLC

Location

Tokyo, Japan

Address and representative

Provided without delay on request to the contact below.

Contact

hello@tinyai.run

2. In short

• The Service has no sign-up and no accounts. We ask for contact details only from people who buy a sponsor sign (an email address, and a name and address for its receipt) and, optionally, from engine registrants who choose a license other than private (an email address or a social media URL).
• We do not store IP addresses as they are, except for an unpaid sign reservation (3 (1)). To apply limits we use values derived from them, most of which change every day.
• We use no advertising trackers and no tracking cookies. Page views are counted without cookies or identifiers.

3. What we collect, why, and for how long

We keep information only as long as we need it for the purposes below, and then delete it. Daily totals that contain no personal data may be kept without time limit.

(1) Connection data (everyone)

• IP address: received to deliver the Service, apply request limits and prevent abuse.
• Values derived from your network: to apply daily limits (on checks, registrations, games against AIs, forum posts and reports, and sponsor sign-in links), we store values derived from your network. They are deleted within 30 days, except the one kept with an engine's registration record.
• Unpaid sign reservations: when you open the sign payment page, the reservation keeps the network it came from, so that one network cannot hold too many places. This is erased when you pay; an unpaid reservation is deleted within 30 days.
• Page views: we record only the kind of page, the country, the referring site (not its path or search terms), the browser's language, whether the client looks automated and the response status, with no IP address, cookie or identifier. On some pages, our hosting provider's cookie-free page analytics may also count views and loading times. Used to understand and improve the Service.
• Logs: warnings, failures and main events are logged to find and fix faults, and kept for the period set by our hosting provider. Alerts sent to the operators contain no personal data.

(2) Engines, authors and the forum

• WASM and data files: used to check, measure and run the engine. Given to no one, and not returned to the registrant either. Only their sizes and SHA-256 hashes are published. Deleted a few days after the engine leaves official games.
• Names and license: the engine name, the self-declared author, the author name and the license are published, and kept after the engine is deleted.
• Author key: we store only the public key, to check signatures; it is not published. The private key stays with you and is never sent to us.
• Token: used to confirm the registrant.
• Contact: a contact entered with a license other than private is not published. It is shown only to sponsor companies whose sign is live, for research enquiries, on the consent given when it is entered. Each read is recorded. The contact is erased when the engine leaves official games.
• Game records: records of official games, results, ranks, ratings and power estimates are published and kept after the engine is deleted (Article 4 of the Terms of use). What an engine writes for itself is not published; only its registrant can read it.
• Forum posts: authors can write in the forum. A post's title, text, the items it points at, the author name and the time are published until the post is deleted; threads without a reply from another author are deleted automatically under the forum rules. With each post we keep the version of the confirmation agreed to and a value derived from the network; with each report, the reporting author and a value derived from the network. Reports are deleted after 30 days.

(3) Games against AIs

• The game: we store the moves, the clock time you used, the result, the start and end times, a value derived from your network and a hash of the key that lets you resume the game. Used to run the game, apply limits and count an engine's results against people. A game that is not published is deleted after 30 days.
• Country: during the game we keep only the two-letter country code of the connection (given by our hosting provider). It is used only to add the result to that country's totals, and then cleared from the game. The totals per country are not linked to any game, network value or person, and are published. To mark your own country on the scoreboard, your browser asks for its code again; that answer is not stored.
• Watching: anyone can watch a game while it is played and for a short time after it ends. No name is shown (the Service does not receive names).
• Publishing a game: a game you choose to publish is kept with no time limit and shown on the Service and at its own link (the moves, the AI's name, the result and the clock time you used). Publishing cannot be undone. The network value and the resume key are still deleted after 30 days.
• Videos: game videos are made in your browser and are not sent to us.

(4) Buying a sign (sponsors)

• Payment: you enter your card details on our payment processor's page; they never reach us. From the processor we receive the email address, the billing and card countries, and payment references. Used to manage the order, send the sign-in link and notices, decide whether we sell to the country, determine consumption tax, issue receipts and make refunds.
• Where you are now: we check whether we sell to the country you are in now. That country is not stored for this check.
• Sign content: the name, link, logo and message are published on the Service while the sign is live. Videos saved by viewers keep the signs shown at that moment. If you link your sponsor account to an author, your sign's name is shown on that author's pages and the logos you set are shown with their AIs. Logos are deleted within 30 days after they are no longer shown.
• Receipt addressee: the name, department, address, contact and tax ID you enter, and whether your head office or home is in Japan, are used to issue and keep the receipt.
• Sign-in: to sign in to the portal we email a link to the address you enter.
• Retention: paid orders, receipts and refund records are kept for as long as tax law requires (at least 7 years).

(5) Human checks

Starting a game against an AI, opening the sign payment page and requesting a sign-in link are checked with our hosting provider's human check, which receives your IP address and information about your browser.

(6) Enquiries

The address and content of emails you send to hello@tinyai.run are used to reply and handle your enquiry.

4. Cookies and browser storage

Cookies are used only to keep you signed in to the sponsor portal (including the portal opened from the payment page), and expire within days.

The following are kept in your browser and sent to us only when needed. You can delete them in your browser settings.

• Settings (such as language, game and sound) and what pages remember for you (such as the ranks you last saw)
• Tokens of engines you registered, and your author key (including its private key, which is never sent to us)
• The ID and key of a game against an AI you can resume, and the AIs you have beaten
• While buying a sign: the place you picked and markers that let this browser recognize its own reservation and payment. The email address typed on the sign-in screen is kept only until the tab is closed.

5. Disclosure to third parties

We do not provide personal data to third parties without your consent, except:

• where required by law;
• where necessary to protect a person's life, body or property and it is difficult to obtain consent;
• where necessary to cooperate with a public authority carrying out duties under law and obtaining consent would hinder them;
• where we entrust handling to the service providers in 6, within the purposes above.

Information described as published in 3 is published by the nature of the Service. A contact is shown to sponsor companies with a live sign on the basis of the consent given when it was entered.

6. Service providers and transfers outside Japan

Within the purposes above, we entrust the handling of personal data to service providers of the following kinds:

• hosting, content delivery, database and file storage, request limits, abuse prevention and human checks, page view statistics and logs;
• payment processing and refunds;
• sending emails (sign-in links and notices to sponsors, and notices to the operators);
• our email service, for receiving and replying to enquiries.

These providers include businesses in the United States, and data may be processed or stored outside Japan, including in the United States and at locations near the user. Data entrusted to them is handled under the systems of the countries where they are. The United States has no comprehensive federal law on personal information protection; there are sector-specific federal laws and state laws (such as the California Consumer Privacy Act). We supervise these providers' handling of personal data as necessary and appropriate, and handle it under this policy and the Japanese Act on the Protection of Personal Information.

7. Security measures

To prevent leaks, loss or damage of personal information, we take reasonable measures, including: encrypted connections; storing tokens, sign-in links and sessions only in hashed form; not storing IP addresses as they are, as a rule; not handling card details on our servers; restricting operator access and logging operator actions on signs; and running registered engines in isolated environments without network access. If we find unauthorized access to personal information and decide that it may affect users, we promptly inform them and take the necessary action.

8. Requests about your data

To ask us to notify you of the purposes of use, or to disclose, correct, add to, delete, stop using or erase personal data we hold, stop providing it to third parties, or disclose records of provision to third parties, write to hello@tinyai.run. We confirm your identity and respond as the law requires.

As the Service has no accounts, we may ask for information to confirm it (such as the engine name and token, or the email address used for a sign order). For information that does not let even us identify a person, such as the values derived from networks, we may be unable to find the data.

9. For people in the EEA and the UK

We are the controller under the EU and UK General Data Protection Regulation (GDPR).

• Legal bases: selling signs, registering engines and running their games, and providing games against AIs and the forum are performance of a contract. Keeping tax records is a legal obligation. Request limits, abuse prevention, security, page view counts and statistics, publishing game records and replying to enquiries are our legitimate interests. Showing a contact to sponsor companies is consent.
• Recipients and transfers: the kinds of service providers in 6. Data is handled in Japan and in the countries of those providers, such as the United States. Japan is covered by adequacy decisions of the European Commission and the UK. For transfers to providers in other countries, we rely on the EU–US Data Privacy Framework and its UK Extension where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses and the UK Addendum in the provider's data processing terms.
• Your rights: you have the right to access, rectify and erase your personal data, to restrict or object to its processing, and to data portability. You can withdraw consent at any time (a contact is erased by deleting the engine or by writing to us). You have the right to lodge a complaint with a supervisory authority, such as the one where you live.
• Contact: hello@tinyai.run

10. Changes to this policy

When we change this policy, we post it on this page and update the date below.