Chrome Extension Privacy Policy
Last updated: February 23, 2026
1. What We Collect
| Data | When | Purpose | Stored Where |
|---|---|---|---|
| Board position (FEN string) | When you click Analyze | Generate AI coaching response | API server (not persisted after response) |
| Anonymous device ID (UUID) | On first install | Enforce free-tier daily limit | Your browser + server logs |
| Email address | When you sign in (optional) | Account identification | Your browser + our server |
| Authentication tokens | When you sign in (optional) | Authenticate API requests | Browser storage (session + local) |
| Settings preferences | When you change settings | Personalize coaching | Your browser only |
2. Sign-In (Optional)
Sign-in is entirely optional. Anonymous users get free analyses daily without creating an account. If you choose to sign in, we collect only the email address associated with your account. We never access your Lichess or Chess.com accounts.
3. What We Do NOT Collect
- Lichess or Chess.com account credentials
- Game results, ratings, or match history
- Browsing history or activity on other websites
- Cookies or cross-site tracking data
- Financial or payment information
4. Local Processing (Stockfish)
The Stockfish 17 chess engine runs entirely within your browser using WebAssembly. Engine analysis never leaves your device.
5. API Communication (AI Coaching)
When you explicitly request AI coaching, the extension sends the current board position, last move, your question, coaching preferences, and anonymous device ID to api.chessvia.ai over HTTPS. The API does not persist board positions after generating the response.
6. Data Storage
On Your Device
Settings, panel preferences, API configuration, anonymous UUID, and cached rate limit status are stored in chrome.storage.local. Authentication tokens (if signed in) use chrome.storage.session (cleared when browser closes). All local data is removed when you uninstall the extension.
On Our Servers
Anonymized usage logs (request count, response time, error rates) are retained for up to 90 days. These contain no personally identifiable information.
7. Third-Party Services
| Service | Purpose |
|---|---|
| Chessvia API (api.chessvia.ai) | AI coaching responses |
| OpenRouter | LLM inference (called by our API, not by the extension) |
| Google Firebase Authentication | Optional sign-in and token refresh |
The extension does not integrate Google Analytics, Facebook Pixel, or any other third-party tracking services.
8. Permissions Explained
| Permission | Why |
|---|---|
storage | Save settings and auth tokens locally |
offscreen | Run Stockfish WASM engine in a background document |
activeTab | Access the current tab when you interact with the extension |
| Host permissions | Inject coaching overlay on chess sites and communicate with our API |
9. Children's Privacy
The extension does not knowingly collect information from children under 13.
10. Changes to This Policy
We may update this policy as the extension evolves. Changes will be noted by updating the date above.
11. Contact
For privacy questions or data deletion requests: support@chessvia.ai