Privacy Policy

ChessFrame Automation · Last updated: 21 August 2026

Document URL: https://chessframe-automation.pages.dev/privacy

This policy describes how ChessFrame Automation handles data. The application is a private desktop tool that runs locally on its owner's own computer and is used only by that person, to manage their own YouTube channel.

1. Authorisation: OAuth 2.0

The application authorises against YouTube using OAuth 2.0 for installed applications: the system browser is opened, the owner signs in with Google directly, and the response is returned to a local loopback address. The application never sees, requests or stores a Google password.

2. Scopes requested

Only two scopes are requested, the minimum the application needs:

• https://www.googleapis.com/auth/youtube.upload — to upload a video and set its custom thumbnail on the authorised channel.
• https://www.googleapis.com/auth/youtube.readonly — to read basic information about the authenticated channel and to check the status of videos the application itself uploaded.

Scopes that allow deleting videos or fully managing the account, such as youtube.force-ssl, youtube and youtubepartner, are deliberately not requested.

3. What the application can access

• Basic channel information of the authenticated channel: its channel ID, its title and the identifier of its uploads playlist. The channel ID is used to verify, before every upload, that the authorised channel is the expected one.
• Status of videos it uploaded: upload status, processing status and privacy status, used to confirm that an upload completed correctly.

4. What the application can do

• Upload videos to the authorised channel. Videos are uploaded as private by default and subscribers are not notified.
• Set a custom thumbnail on a video it has uploaded.

The application does not delete videos, does not modify videos it did not upload, does not read or post comments, and does not access any channel other than the one it is explicitly bound to.

5. Credentials stored locally

To keep the authorisation active without asking the owner to sign in repeatedly, the application stores the OAuth credentials it receives — including the refresh token and the short-lived access token — as files in a local directory on the owner's own machine. It also stores the ID of the channel it is bound to.

These files are stored as plain text on the local filesystem and are excluded from version control. They are never transmitted to any third party, never printed to logs, and never included in any published artifact. This policy does not claim they are encrypted, because they are not.

6. Data is never sold or shared

OAuth credentials, access tokens, refresh tokens and any data obtained from the YouTube API are never sold, rented, traded or shared with third parties. They are used only to perform the uploads the owner has asked for, on the owner's own channel.

No data obtained through the YouTube API is used for advertising, profiling, analytics or training any model.

7. Content is generated locally

The videos, titles, descriptions and thumbnails are produced on the owner's machine, from publicly available chess game data and from analysis performed locally. Board, pieces, layout and graphics are original to this project. No external content-generation service is used.

8. This website

This site is a set of static pages. It sets no cookies, contains no analytics, no trackers, no advertising, no embedded third-party services and no forms. It collects nothing from visitors.

9. Revoking access

The owner can revoke the application's access to their Google account at any time from the Google account permissions page:

https://myaccount.google.com/permissions

The application also provides a local command that revokes the authorisation and deletes the stored credential files. Revoking access does not delete any video that was already published.

10. Deleting data

Because all data is held locally, deletion is performed locally: removing the credential directory on the owner's machine erases every stored token and the channel binding. Combined with revoking access at the link above, this removes the application's ability to act on the account entirely.

For any request related to data or authorisation, contact franciscoschuhmann@gmail.com.

11. YouTube API Services

This application uses YouTube API Services. By using it, its owner agrees to be bound by the YouTube Terms of Service and the YouTube API Services Terms of Service, and to comply with the YouTube API Services Developer Policies.

Information handled by Google is governed by the Google Privacy Policy.

12. Changes to this policy

If the application's use of the YouTube API changes, this policy will be updated and the date at the top of this page will change with it.