Privacy
Privacy at LibreChess
Published
The short version: your chess stays on your device. LibreChess does not have accounts and does not upload your moves, games or study data. The site does make ordinary web requests and uses cookieless Plausible analytics to understand aggregate traffic and page engagement. This page draws that boundary precisely.
On this page
What is stored only in your browser
- Games and archive: the current game, finished-game PGNs, results, openings, opponents and local statistics. The archive retains at most 200 finished games in this browser.
- Analysis and hand-offs: pasted PGNs and FENs, engine evaluations and review results are held in page memory. Moving a game from Play, Archive or the static PGN viewer to Review uses a one-use session-storage hand-off containing the PGN and a small amount of review context.
- Training: puzzle rating and attempt history, puzzle and daily streaks, and drill progress. “My Mistakes” records derived setup positions, relevant played and better moves, motif, phase, a brief explanation when available, game ID, date and solved state. The learning profile retains up to 120 completed-review records; each contains a local de-duplication ID, completion time and up to five theme observations with labels, bounded weights and same-site lesson links. It does not retain that review’s PGN, FENs, moves, evaluations or explanation text.
- Repertoire and preferences: saved opening lines, spaced-repetition dates, board and piece themes, sound, hints, clock and play settings.
What network requests occur
Your browser requests the site’s HTML, styles, scripts, fonts, chess datasets and engine files so the app can load. Cloudflare provides LibreChess’s authoritative DNS and acts as a content-delivery network and reverse proxy in front of the Fly.io origin. For an online request, Cloudflare processes standard request and connection information such as the IP address, user agent and other HTTP headers, requested path and any query string, and TLS or security metadata so it can route, cache, deliver and protect the site. A request that is not served from Cloudflare’s cache continues to Fly.io and the LibreChess web server. Normal app asset requests do not include your local archive or board state.
Cloudflare receives those same-origin LibreChess requests even though the browser address remains librechess.com; it is part of site delivery, not the analytics service. The Plausible tracker remains the only automatic cross-origin request. Fonts, search data, chess datasets, Stockfish and the rules validator are served from LibreChess itself. Other cross-site requests begin only when you follow an external link or choose another app through a share control.
Current shareable analysis links put their FEN after the URL’s #; browsers do not send that fragment in an HTTP request. LibreChess still opens older ?fen=… links for compatibility, but the initial request can put that FEN in hosting logs before the app rewrites it to a private fragment. Site search ranks results locally after downloading the same-site search index, but it writes the search phrase into /search/?q=…; opening, refreshing or sharing that URL can likewise expose the phrase to hosting logs. Do not put confidential text in a search query.
Cloudflare, Fly.io and the LibreChess web server may retain ordinary access and security logs according to their settings and policies. Cloudflare describes its handling in its privacy policy. For that reason, local chess analysis should not be read as a claim of zero-log web hosting.
The progressive web app checks for service-worker updates while online. Engine files are deliberately left out of the install-time cache and are requested only when play, review or another engine feature needs them. A successful request is placed in the runtime cache only when the service worker already controls the page; loading the home page alone does not prepare Stockfish for offline use. A later online visit can still check for a new worker or refreshed files.
Cookieless aggregate analytics
LibreChess pages include a tracker script hosted by Plausible. Its exact reviewed bytes are pinned with Subresource Integrity, so an upstream change is blocked until LibreChess deliberately reviews and updates the hash. When the script loads and is not blocked, it sends pageview and page-engagement events to Plausible. The resulting dashboard reports aggregates such as visited path, referring site, visit and engagement duration, scroll depth, approximate location, browser, operating system and device category. Those figures can show which pages receive visits and broad reading or device patterns; they cannot establish that a lesson is correct or useful.
The game-review funnel also sends three allow-listed event names: Review Started, Review Completed and Review Failed. Their properties are limited to whether the review was started automatically, manually or as a retry, a broad move-count bucket, and — for completion or failure — a broad duration bucket. The event name distinguishes technical completion from failure; it does not report the chess result. Exact timings, PGNs, FENs, moves, ratings, opening names, local review identifiers and free text are not sent.
Plausible does not set an analytics cookie or write a persistent tracking identifier into browser storage. The event request still carries an IP address and user agent. Plausible’s published data policy says it derives location and a site-specific daily visitor identifier from those values, does not store the raw IP address or full user agent, and rotates the identifier salt daily.
LibreChess constructs pageview and review-event payloads from an exact allow-list before Plausible sends them. Page queries and fragments are removed; a same-site referrer keeps only its path, while a cross-site referrer keeps only its origin. Unknown events, properties and bucket values are dropped. The pinned tracker constructs page-engagement requests from that sanitized pageview state; LibreChess’s release check executes the exact pinned tracker bytes and verifies that those requests contain only the path, site domain, scroll depth, engagement duration, event name and protocol version. Automatic form-submission, file-download and outbound-link capture are disabled. Analytics still identifies the path visited — for example, /rules/castling/ — but does not contain private board or study state: no moves, PGN, FEN, result, local rating, puzzle answer, repertoire line or saved-game record.
What local storage does not protect against
Local does not mean encrypted. Anyone with access to the same unlocked browser profile may be able to see the archive or repertoire, and browser extensions or developer tools operate under their own permissions. Use a separate operating-system or browser profile if the positions are genuinely sensitive.
Browser storage is also not a backup. Private browsing, storage quotas, automatic eviction and manual site-data clearing can prevent a save or remove existing records. Most write failures leave the current page usable but cannot preserve progress for the next visit.
Your controls
- Erase local data: close open LibreChess tabs, then clear the site’s data in your browser. This removes its persistent storage and caches; closing the tabs also ends one-use session-storage hand-offs.
- Keep a copy first: use the Archive’s PGN export for finished games and the Repertoire page’s JSON export for saved opening lines before clearing data or changing devices.
- Block analytics: content blockers can block the Plausible request; the chess app and lessons continue to work.
- Use a cached feature offline: after the app and relevant engine files have successfully cached, a disconnected browser can serve them without contacting LibreChess or Plausible. This does not make an uncached article available.
External links, export and sharing
Links to rule books and data sources open other websites with their own privacy practices. LibreChess sends a strict origin-only referrer on cross-site requests; a URL fragment containing a shared FEN is not part of that referrer.
PGN and repertoire exports are files created in the browser, not uploads. Copy and Share buttons hand a position link, PGN or daily score to the browser clipboard or operating-system share sheet only after you ask. If you then choose another app or recipient, that destination receives the content under its own privacy terms.