Privacy

Your data, and how to leave

Local runner files stay local unless you choose a connected feature. Android Internal test builds with technical diagnostics enabled also send limited problem reports as described below. Chummer owns its retention and deletion policy; service providers do not. Hosted Build deletion claims stay review-gated until restore and whole-account erasure status passes.

Effective 2026-03-25 Updated 2026-10-09

Claim your copy Read terms Open contact Request account deletion

Privacy

What Chummer stores, hides, and still needs review

Chummer keeps account, install, help, feedback, and owner-scoped Hosted Build workspace data. This page separates approved retention rules from Hosted Build recovery and erasure policy that is still under review.

Local runner files stay on your device until you choose a connected action Chummer, not a service, owns account and deletion status You can request deletion from the web without reopening the app

Open help Open contact

Support cases

Public pages can mention known issues and fix availability.

Owner: chummer6-hub

Stored: case timeline and user-visible status events: retain for 18 months after the last state change public known-issue linkage and closure records: retain for 18 months after public closure raw attachments that are no longer needed for open investigation: summarize or redact within 90 days

Hidden: remove secrets, local paths, and unrelated identity data from user-visible case history preserve limited install/channel/version status needed for honest fix-availability notices

Your account can show your own help history and follow-up.

Install linkage

Public pages show release status and install help.

Owner: chummer6-hub plus chummer6-hub-records

Stored: pending claims and install-link events: retain for 365 days after last install activity durable install identity, channel status, and last-seen release status: retain while the install relationship remains active older claim files should collapse into one current install record plus limited historical records

Hidden: never persist personalized binary data because the binary remains standard and signed keep person, install, device-role, and campaign scopes explicit instead of flattening them into a single sync blob

Your account can show linked installs and recovery context.

Survey follow-up

Public routes may summarize learned product changes after review.

Owner: chummer6-hub

Stored: post-fix follow-up invites and answer summaries: retain for 365 days raw free-text survey answers: summarize or redact within 180 days unless still tied to an open product decision

Hidden: keep survey status out of public guide copy until synthesized into source redact install/account data that is not required for the follow-up question being answered

Signed-in routes may show that follow-up happened without replaying raw survey text.

Help tools

Public help may show short answers and source links, not raw transcripts.

Owner: executive-help plus the owning product surface

Stored: raw outside-service request and response logs: retain for 30 days unless a narrower service contract says less service comparison notes and answer summaries: retain for 180 days promoted help, support, and public answers must be rebuilt from Chummer sources, not from indefinite outside-service transcripts

Hidden: no unbounded personal data spill into prompts, logs, or review traces answer notes should prefer case numbers, release numbers, and calculation records over raw user text where possible

Signed-in help may show the answer path without becoming the account record.

Hosted Build workspaces

Review required

Launch blocker: Hosted Build now has atomic content-free deletion records, readiness replay, and owner-workspace erasure. Launch remains blocked until the journal is proven to survive independently across production backup recovery and whole-account erasure is implemented across every account-owned store.

No Hosted Build workspace content is public.

Owner: chummer-presentation

Stored: Chummer-controlled content-bearing backup and point-in-time-recovery data: maximum 30 days content-free deletion tombstones and replay journal: 35 days content-free deletion review record: 365 days operational logs: maximum 30 days and no workspace payload by default active workspace rows leave serving surfaces immediately and are deleted within 24 hours of a confirmed workspace or account deletion restore-time deletion replay and owner-wide erasure are required implementation gates; public permanent-deletion claims remain `needs review` until restore and erasure details passes

Hidden: workspace content must remain owner-scoped and must not be copied into support, telemetry, or maintainer logs by default deletion copy must distinguish removal from the active hosted serving store from backup retention and from files the user already downloaded public and in-product copy may state the approved numeric windows only after the live implementation and cleanup records are candidate-bound; it must not imply that downloaded or independently shared files remain in Chummer custody

Signed-in account surfaces may show only the owner's live hosted workspaces.

Public surfaces

may expose support status, known issues, release status, compatibility, origin, and channel-aware fix availability

may not expose private case notes, raw crash reports, outside-service logs, or private survey text

Signed-in user surfaces

may expose case timeline, install status, claimed-device state, and the user-safe slice of crash/support data

may not expose unrelated reporter data, maintainer-only notes, or private moderation notes

Help tools

must ground answers in curated standard sources, current records, or support-case status

must not become the system of record for support or release state

Privacy summary

Read the short privacy summary first, then the full policy.

Start with the short version: the app file stays the same for everyone, and telemetry or diagnostics stay explicit about what they capture.

Android Internal testing Technical problem reports, without your story

Local runner files stay on your device until you choose a connected action

Open section

Account record Your account keeps sign-in, preferences, and help together

Chummer, not a service, owns account and deletion status

Open section

Install linking The download file is the same for everyone

You can request deletion from the web without reopening the app

Open section

Android Internal testing

Technical problem reports, without your story

Internal builds that include automatic diagnostics enable sending by default, unless you have already switched it off. Reports help maintainers investigate failed actions, rejected UI updates and slow operations. They are not a record of everything you do, and a slow-operation report does not prove a crash.

Each report contains the app version, observation time, app area, operation and outcome categories, duration, a general error category, and a random report ID for duplicate prevention. It contains no account or device identifier, runner or book text, credentials, screenshot, raw exception message or stack trace.
Reports go over HTTPS to chummer.run. Like any web request, the connection exposes network metadata such as an IP address to hosting and network infrastructure; that metadata is not copied into the diagnostic report store.
Individual reports expire after two days. The private receiver cleans them at startup and every 15 minutes while running. This short-lived store is separate from account history, support cases, work board and backups. Maintainer alerts may contain technical categories and counts, not individual report IDs or user content.
You can turn diagnostic sending off in the app settings at any time. This stops new sends, cancels pending delivery and clears unsent reports. Reports already accepted by the server remain subject to the two-day expiry. Your off setting survives app updates and restarts.
Development and public builds do not enable this Internal-test default. An Internal build must not be promoted unchanged to a public track.

Account record

Your account keeps sign-in, preferences, and help together

Your Chummer account keeps your basic profile, linked sign-in methods, device access, support history, and preferences together so you do not have to rebuild that history by hand.

Install linking

The download file is the same for everyone

When Chummer publishes a download, everyone gets the same file. Chummer does not build a private installer just for your account. If account linking is available, the account step is a short-lived code that reconnects a local copy back to your account.

What stays out

Short-lived sign-in access stays out of your account record

Short-lived third-party access stays on the machine or service using it. Your account keeps consent, help history, and access records, not passwords or access keys.

Privacy and recognition

Recognition should not force publicity

Participation and recognition remain optional layers. Private product use, private support, and a quiet account setup remain valid even while community pages exist.

Leaving Chummer

Deletion has a clock and a status gate

A confirmed deletion removes active data within 24 hours. Chummer-controlled content backups have a 30-day maximum, content-free replay tombstones last 35 days, and a content-free review record may remain for 365 days. These windows become a public deletion promise only after restore and whole-account erasure details passes.