ChessUmi Analysis privacy boundaries

ChessUmi Analysis is local-first. Saved games, studies, position drafts, annotations, review output, and local Stockfish analysis stay in the browser's local storage unless you deliberately use one of the features below.

Contact, access, correction and privacy complaints

Chessumi publishes ChessUmi Analysis and the optional ChessUmi Batch Analysis extension. For privacy questions, or to request access to or correction of personal information, contact [email protected]. You can also use that address to make a privacy complaint. Please describe the request or concern and the feature involved; do not send passwords, provider credentials, or full game records unless we ask for specific information to resolve your request. We will review and respond under the laws that apply to the operator. If the Australian Privacy Act applies and your complaint is not resolved, you may contact the Office of the Australian Information Commissioner.

Owner-only performance capture

Performance submissions are disabled on the server by default. An owner must explicitly enable them; the endpoint then still requires a signed, unexpired debug token. Ordinary visits do not start a collector or make a performance upload. A capture exists only when the top-level URL contains the explicit empty ?debug flag and an administrator-issued, short-lived token is pasted into the visible capture control. The token is held only in JavaScript memory, defaults to a two-hour lifetime, may be issued explicitly for at most seven days, and is not placed in a cookie, URL, browser storage, retry queue, or offline queue.

Every upload is one bounded 15-second aggregate containing only fixed enums, coarse device buckets, counters, milestones, and timing quantiles. It excludes games, identifiers, FENs, PGNs, moves, engine lines/evaluations, selectors, free text, full URLs, stacks, and storage contents. The isolated stateless relay validates a closed schema, writes sanitized one-line records only to its bounded Docker log, and has no database, volume, or public read endpoint. The fixed dialog timing categories cover More actions, Library, and other dialogs; catalog refresh has one separate duration. No dialog content or selected action label is recorded.

Public share links

A share payload is stored in the #/share/... URL fragment. It is not sent as part of the HTTP request to ChessUmi, but anyone who receives the full link can open its preview. Public links contain only the bounded, redacted share format: they omit local IDs, device-sync identity, provider URLs, engine evidence, retry state, application preferences, and private text notes. Opening a link does not initialize writable workspace storage or prepare engines; saving a separate local-only copy is an explicit action. Mainline links include only the starting FEN, every mainline UCI move, and board orientation. Preview navigation stays in memory.

Provider import

After confirmation, an import may contact only the documented Lichess export endpoint or the fixed Chess.com public archive endpoints at https://api.chess.com directly from this browser. Account preview sends the provider username; chosen date/speed/rated/color filters remain in the browser. Lichess may additionally receive the session bearer token. ChessUmi fetches Lichess games as streamed PGN records and Chess.com archives serially, then filters and validates locally. Imports save games without starting local analysis. Open a saved game and explicitly start Game Review to run Stockfish and Maia on this device. It never asks either provider for engine analysis. If the request is blocked, unavailable, rate-limited, or offline, pasted PGN remains the local alternative. Imported records remain local unless you explicitly enroll this device in full-library sync. Their import provenance is preserved.

Chess.com receives the public username and ordinary network metadata such as your IP address and browser request headers, and returns its public PubAPI response directly to this browser. Chess.com import requires no ChessUmi API key or provider login. Requests omit cookies, referrers, shared API keys, Lichess tokens, saved games and library content. ChessUmi does not proxy or store these provider responses; the application service worker does not cache them. The former key-authorized Chess.com relay is retired, and its obsolete same-origin routes return uncached 410 Gone responses. There is no server fallback when direct provider access fails.

Preview payloads, OAuth state/tokens and unfinished manual review checkpoints remain device-local and are excluded from backup and sync. Confirmed games and completed verified reviews can enter an explicitly enrolled full-library sync. The shared scope-free Lichess bearer token is stored in this browser's local storage, while short-lived OAuth state and errors remain in the current tab's session storage. The token is sent only to fixed Lichess origins and ends on disconnect, token expiry, or removal of this site's data. If the browser blocks persistent site storage, the connection can only remain for the current tab. Chess.com import uses no login, and Lichess credentials are never sent to Chess.com.

Optional batch-review extension

The optional ChessUmi Batch Analysis extension connects only to the ChessUmi Analysis app on analysis.chessumi.com. Its bridge supports the app's review catalog and controls. Catalog rows sent to the extension contain a local game ID, title, player names, date, provider, time-control details, Maia and Stockfish review status, opening name, and ECO code. When you start a review, the extension sends selected local game IDs to the app. Catalog filtering also sends the current search text and selected provider/review-status filters to the app, which returns matching rows and available filter options. The extension reads and writes saved per-source speed and exact-clock eligibility rules through the app; these rules stay in the app's device-local preferences. The bridge does not send full game documents, PGNs, reports, engine lines, provider credentials, or the complete queue to the extension. It shares aggregate queue progress and the current game's display metadata so the popup can show status.

The extension checks tab URLs only to find open ChessUmi Analysis tabs. It stores its enabled, auto-sync, auto-review, and interval choices along with a versioned data-notice consent choice in Chrome local storage. On first use, the extension displays the data fields and app actions it handles and asks you to agree before it queries the app or starts connection/sync alarms. It asks again if that notice is materially revised. Closing the notice without agreeing leaves the extension disconnected. Temporary app-tab binding, connection IDs, status, and tab-discard protection details are held in Chrome session storage after consent. These preferences and session records are not an account, and they do not contain provider credentials. The review queue and review results stay in the app's device-local storage. Review-filter choices remain in the app's device-local preferences and are read or updated through the extension's review controls.

The extension does not contact Chess.com or Lichess itself. It asks the app to run the existing provider import flow using the provider settings already configured there. The app-mediated requests follow the Provider import disclosures above, including the relevant provider endpoints and network metadata. The extension contains its executable code in the installed package and does not download or run remote code.

ChessUmi Batch Analysis uses information received through Chrome browser APIs only to provide or improve its disclosed batch-review features. It does not sell that information, use it for personalized advertising, or transfer it for unrelated purposes. Its use of information follows the Chrome Web Store User Data Policy, including the Limited Use requirements.

You can stop extension access by disabling or removing the extension in Chrome. The app's saved games and reports remain under the app's separate local data controls.

Optional full-library sync

Sync is a separate, opt-in connection between your devices. Its preview includes existing games and imports, studies, variations, comments, drawings, notes, and verified saved Stockfish/Maia review evidence. Device appearance, engine preferences, downloaded models, unrelated caches, and private sync credentials are excluded. Public sharing remains a separate redacted format.

Network sync requires the shared ChessUmi API key issued by the administrator. It is bound to an immutable central user UUID, and the same key works across ChessUmi apps and the user's devices. Device capabilities still identify each library and device. Raw keys and validated central UUIDs/expiry remain in private browser storage and are excluded from exports, bundles, public controller state and logs. Analysis validates every protected request with the private central authority, which stores the shared key hash. Analysis stores immutable UUID ownership for libraries and groups; email never grants historical access. No local key issuance or cached active authorization is used. Blank expiry means no expiry. Rejected, expired or revoked access and authority outages pause network work while preserving local edits, enrollment and previously committed server data. Connections and jobs recheck every five seconds and before commit; revocation events cancel active work and transfers where possible. Bytes already received by a device cannot be recalled. Forgetting the saved key disconnects this browser without deleting local or server content.

Newly created synced libraries use protocol 3. Their library records are sent over HTTPS and stored durably in server-readable form. This allows another connected device to catch up even when the sending device is no longer online. The server and its operator can access synced games, imports, studies, variations, comments, drawings, notes, training records, and saved review evidence in these libraries. The server also retains library/object identifiers, revisions, device membership/names/modes, receipts, and hashed access credentials.

Invitations are one-use and expire after 15 minutes. Their private code travels in a QR/link fragment, not the HTTP URL query. Pairing and authorization wraps remain cryptographically protected in both current and legacy full-library sync. Enrolled devices can read the library and manage connected devices. Do not share an invitation with someone you do not want to give that access. Connection limits retain the existing trusted-proxy and public-IP HMAC boundary.

Merge devices exchange additions and updates and share recoverable Trash. Concurrent edits are preserved as separate versions. Send only publishes additions/updates; Receive only applies them while keeping receiver-only data. One-way modes do not transfer deletions. Trash recovery lasts 30 days; compact deletion markers remain after recovery data expires to prevent resurrection by an old offline device. Restore creates a new revision.

Removing a device revokes its future access; it cannot erase content already received by that device. Local exports are independent backups and never recreate enrollment.

Existing encrypted full-library sync (protocol 2)

Existing protocol 2 libraries stay encrypted until an enrolled device explicitly converts them to server-readable synchronization. Conversion requires the retained historical keys, verifies every remote revision and switches the same library atomically. Devices, history, Trash and local edits remain intact; a missing key, interrupted upload or quota error keeps the original encrypted library available. The server retains the original encrypted representation as a recovery archive. After conversion, the server and operator can read the active library content described above. New encrypted libraries cannot be created. Protocol 2 uses P-256 pairing to exchange encrypted library keys and AES-GCM to encrypt library content before upload. The server stores opaque library/object identifiers, encrypted chunks and revisions, device membership/names/modes, receipts, and hashed access credentials. It does not receive plaintext games, library encryption keys, or pairing proof secrets for those libraries.

Each protocol 2 device stores its library keys privately in IndexedDB. Removing a device revokes its future access and rotates the content-key epoch; it cannot erase content or keys already received by that device. There is no account/password recovery for a protocol 2 library: losing every enrolled device and library key loses access to its encrypted server content.

Retired study-only sync (v1)

The Settings-based WebSocket synchronization endpoint /sync is retired and returns uncached 410 Gone. Its pairing controls and automatic connections are removed. Existing local studies and private enrollment records are preserved; retirement never uploads them or automatically enrolls them in full-library sync. Use the current Sync controls and explicitly review the full-library preview.

Engine-asset downloads

Engine inference stays on this device. When you explicitly approve an uncached Maia or Stockfish start, the browser downloads the exact checksummed model, WASM runtime, or NNUE network directly from the public Hugging Face repository named in the app's asset manifest. Hugging Face necessarily receives the asset-download request and ordinary network metadata such as your IP address and browser request headers. ChessUmi does not proxy those bytes, send games, positions, diagnostics, or engine results with that request, or upload the mobile diagnostic panel's copied results.

Verified engine files are stored in this browser's Cache Storage by checksum. Cached files start without another confirmation or network request. Offline engine use requires those files to have been cached previously; otherwise the app shows Retry or Cancel and does not substitute a server download.

Your controls

You can keep all work local by avoiding provider import, public sharing, and device sync. You can disable device sync at any time, remove individual paired devices, export your saved games and studies, or delete local browser storage using your browser's site-data controls.

Local opening data and engine readiness

The opening book is a static public-domain catalog served from ChessUmi and cached at normal workspace startup. Book lookups and move history stay on this device; no Lichess API/account or live opening request is involved. Writable workspace startup prepares local processing, Stockfish, and Maia behind a readiness screen; it has no saved ask/prepare/skip choice. Any legacy engine-preparation value remains local but is ignored. Missing engine files always retain explicit download confirmation and are never fetched merely by entering limited mode or retrying unrelated work.

Optional online Explorer and device-local improvement tools

Explorer defaults to the local opening catalog. Selecting Lichess games or Masters sends the current position and selected rating/speed/date filters to explorer.lichess.org; previewing an example requests its public game ID from that explorer or Lichess's official game-export endpoint. Requests omit cookies and referrers. Online databases now require a Lichess login: the scope-free PKCE flow stores an OAuth bearer token in this browser's local storage and sends it only to the two fixed Lichess origins. Short-lived OAuth state remains tab-scoped. The token never enters game documents, backups, sync or logs. Disconnect, token expiry, or clearing this site's data removes it; other tabs in the same browser can reuse it when persistent site storage is available. If that storage is blocked, the connection is limited to the current tab. No saved library or private annotations accompany these requests. Online results are cached on this device; choosing Offline book avoids online position queries. Example previews are saved only by an explicit action.

Library Insights runs Stockfish locally after explicit activation and pauses while the application is hidden. Its derived aggregates, aliases, queue choices remain device-local. Personal thoughts and training attempts belong to the private library: JSON backups and opt-in full-library sync include them, with source position identity, assistance, outcomes, timestamps and endgame opponent settings. Public share links and PGN exclude training history and private notes. Neutral review explanations are derived locally from engine evidence; personal notes remain independently authored data. Clearing site data removes local history unless it has been backed up or synced. Attempts retained on conflict copies and in Trash preserve the same privacy rules.