GhostBoard — Privacy Policy

Last updated: April 25, 2026

1. Introduction

GhostBoard ("the Extension", "we", "our") is a browser extension that provides a practice analysis board overlay on Chess.com. This privacy policy explains what data the Extension accesses, collects, stores, and transmits, and how that data is handled.

We are committed to transparency. GhostBoard is designed to function with minimal data collection. We do not run analytics, do not track browsing behavior, and do not sell or share any user data with third parties for advertising or profiling purposes.

2. Data We Access But Do Not Collect or Transmit

a) Chess.com Page Content

The Extension reads the chess board position and move list from the Chess.com page DOM (Document Object Model) to synchronize pieces on the GhostBoard overlay. This data is processed entirely within your browser. It is never transmitted to any server, stored persistently, or shared with any third party.

b) Page URL

The Extension checks the current Chess.com page URL to determine whether GhostBoard should activate (e.g., /play/computer, /analysis, /puzzles). This check happens locally in your browser. URLs are never transmitted, logged, or stored.

3. Data We Store Locally

The Extension uses Chrome's built-in storage APIs (chrome.storage.sync and chrome.storage.local) to save the following:

a) Theme Preferences

Your selected board color scheme and piece style. Stored so your preferences persist across sessions.

b) Overlay Window Position and Size

If you move or resize the GhostBoard overlay, its last position and width are saved locally (via chrome.storage.local) so the overlay reopens in the same place on your next visit. This setting contains no personally identifiable information and never leaves your browser.

c) Pro License Status

A boolean flag indicating whether a Pro license has been activated.

d) License Key (Pro users only)

If you activate a Pro license, your license key is stored in Chrome's synced storage (chrome.storage.sync). This enables your Pro activation to carry across Chrome installations where you are signed into the same Google account. The license key is never transmitted to any party other than Gumroad for verification (see Section 4). Pro licenses permit up to 3 device activations. Gumroad tracks the activation count server-side; we do not store this information ourselves. Deactivating Pro on a device through the Extension's settings page clears the license key from your local browser storage; it does not send any data to Gumroad. To reset your device count on Gumroad's side (for example, after switching computers), you can contact us at ghostboard.support@gmail.com — see Section 4(c).

e) Installation Timestamp

A timestamp recording when the Extension was first installed, used solely to calculate free trial eligibility (a 3-day trial of Pro features). This timestamp is stored in both chrome.storage.sync and chrome.storage.local as a redundancy measure. It contains no personally identifiable information.

f) Trial Integrity Seal

A locally computed hash of the installation timestamp, used to verify that the trial period has not been tampered with. This is computed entirely within your browser and is never transmitted.

None of the above data contains personally identifiable information (PII) except the license key, which is a Gumroad-issued product key and does not inherently contain your name, email, or payment details.

4. Data We Transmit

a) License Key Verification

When you activate a Pro license, the Extension sends your license key to the Gumroad API (https://api.gumroad.com) to verify its validity and claim a device slot. To prevent unnecessary increments to your activation count from failed attempts, the Extension performs this in two steps: first a non-incrementing check to confirm the key is valid and that you have an available device slot, then (only if you do) a second call that claims the slot. Both calls send the same minimal data.

Data sent:

• Your license key
• The GhostBoard product identifier

Data received:

• Whether the key is valid
• Your current activation count
• Whether the associated purchase has been refunded, disputed, or charged back

Gumroad-bound API requests are the only external network requests the Extension makes. Activation calls happen only when you explicitly click "Activate" on the settings page. See Section 4(b) regarding automatic revalidation for already-activated licenses.

b) License Revalidation

To detect refunded or revoked licenses, the Extension periodically (at most once every 24 hours) re-sends your license key to the Gumroad API for verification. This occurs in the background and uses the same minimal data (license key + product ID) as initial activation. If you never activate a Pro license, no external requests are ever made.

c) Manual License Resets (Support Workflow)

If you contact us at ghostboard.support@gmail.com requesting a device reset, we will use your license key — provided by you in your email to us — to call Gumroad's licensing API and reduce your activation count or re-enable a disabled key on our end. We process this request only at your explicit request and only for the purpose you asked us to perform. We do not retain your license key after the reset is complete beyond what is contained in the email thread itself, which is stored in our email provider (Gmail) under their own privacy terms.

The Extension itself never calls these reset endpoints — only verification calls (Sections 4(a) and 4(b)) are made from your browser.

5. Data We Do Not Collect

To be explicit, GhostBoard does NOT collect, store, or transmit:

• Your name, email address, or any account information
• Your Chess.com username or account details
• Your browsing history or activity on any website
• Your chess games, ratings, or performance data
• Cookies or tracking identifiers
• Device fingerprints or hardware information
• Location data
• Any data from websites other than Chess.com

6. Chrome Permissions Explained

a) storage

Used to save your theme preferences, license status, and installation timestamp. No data leaves your browser through this permission.

b) activeTab

Used to communicate between the popup interface and the Chess.com tab when you click the GhostBoard icon. This provides temporary access only to the tab you are actively viewing.

c) Host permission: *://*.chess.com/*

Required so the Extension's content script can run on Chess.com pages to read the board position and render the GhostBoard overlay.

d) Host permission: https://api.gumroad.com/*

Required to verify Pro license keys against Gumroad's API when you activate a license.

7. Third-Party Services

The only third-party service the Extension communicates with is:

• Gumroad (gumroad.com)
  • Purpose: License key verification for Pro activation
  • Data shared: License key and product identifier
  • When: When you manually activate a Pro license (one verification call to confirm the key is valid, plus one to claim a device slot if available), and for periodic revalidation while Pro is active (at most once per 24 hours). No request is made when you deactivate Pro on a device.
  • Gumroad's privacy policy: gumroad.com/privacy

The Extension includes the following open-source libraries, which run entirely within your browser and make no external connections:

• jQuery (MIT License)
• chess.js (BSD License)
• chessboard.js (MIT License)

8. Data Retention and Deletion

All Extension data is stored in your Chrome browser's local and synced storage. You can delete all stored data at any time by:

• Uninstalling the Extension (Chrome removes all extension storage; synced data may take a short time to clear across all signed-in devices)
• Using Chrome's "Clear browsing data" feature for extension data
• Manually clearing extension storage via Chrome Developer Tools

Upon uninstallation, Chrome automatically removes all data stored by the Extension in both chrome.storage.local and chrome.storage.sync.

We do not maintain any server-side database of user data. Once you remove the Extension, no trace of your data remains on our end because no data was ever sent to us.

9. Data Security

All data stored by the Extension resides within Chrome's built-in storage system, which is sandboxed and inaccessible to other extensions and websites. License key verification is transmitted over HTTPS (encrypted in transit) to Gumroad's API.

10. Children's Privacy

GhostBoard does not knowingly collect any personal information from children under the age of 13 (or the applicable age in your jurisdiction). The Extension does not collect personal information from any user.

11. Changes to This Policy

We may update this privacy policy to reflect changes in the Extension's functionality or to comply with legal requirements. When we make material changes, we will update the "Last updated" date at the top of this policy. Continued use of the Extension after changes constitutes acceptance of the updated policy.

12. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the data stored by the Extension (visible in Chrome's extension storage via Developer Tools)
• Delete all stored data (by uninstalling the Extension)
• Remove your license key from Chrome sync storage (by deactivating your Pro license on the settings page)
• Clear locally-saved overlay position by uninstalling the Extension or using Chrome's extension storage tools

Since we do not operate any servers that store your data, data access and deletion are fully within your control through your browser.

13. Contact

If you have questions about this privacy policy or the Extension's data practices, please contact:

• Email: ghostboard.support@gmail.com
• Gumroad: ghostboard.gumroad.com/l/ghostboard