Privacy policy

Who is responsible

The company named above runs openpawn.org and is the controller for everything this policy describes (Art. 4(7) GDPR). In this policy, “OpenPawn”, “we” and “us” always mean that company. Write to us at the address above about anything here; it costs nothing and you need no reason.

OpenPawn writes its legal texts in English. The English version is the original, and the versions in other languages are translations for your convenience. If a translation differs from the English or is unclear, the English version applies; where the meaning is in doubt, the reading more favourable to you as a consumer prevails.

Using the site without an account

You can play the coach, solve puzzles and take lessons without signing up. Your progress then stays in your browser’s storage on your device and never reaches us. Clearing your browser data removes it.

The chess engine runs in your browser too, so positions you analyse stay on your device. When a bot plays like a person, our server receives the position and the moves so far for each bot move and asks our own move service, which runs on the same private network. Neither keeps them, and nothing about you goes with them.

When someone sends you a link to play a game, you can play it without an account. We then keep a guest entry with the name shown in the game (one we pick, like “Guest 4821”, or a nickname you type), the link you took and the games you play with that person. A cookie in your browser says which guest you are. A guest has no rating and no profile. If you create an account in the same browser, the games move to your account. Otherwise we delete the guest and its games 30 days after your last game. The legal basis is the game you accepted (Art. 6(1)(b) GDPR).

Your account

When you sign up and use your account, we store:

• your email address, your username and a hash of your password made with Argon2id (never the password itself);
• your year of birth, so younger players get safer settings and show less to strangers;
• the country, language and avatar you choose, a profile photo if you upload one, and your settings;
• your games, ratings, puzzles, lessons, courses, opening repertoire, studies, medals, friends, blocked players, communities and tournaments, and the notifications in your bell;
• the games the coach reviewed with you, so it knows you on your other devices, and fixed coach sessions if you book them (their times, focus and whether they took place);
• security data: your active sessions with a short device label, your passkeys, your encrypted two-step secret if you turn it on, hashes of your recovery codes, and when you were last active.

We need this to run your account and the games you play (Art. 6(1)(b) GDPR). Your profile shows others your username, ratings, medals and recent games; the privacy settings let you hide some of it. Your email address is never shown to anyone. We keep all of this until you delete your account.

Signing in with Google or Apple

Only if you choose it. You then sign in on Google’s or Apple’s own page, and they tell us your email address and an account identifier; we keep nothing else from them (Art. 6(1)(b) GDPR). Google and Apple are responsible for their sign in pages under their own privacy policies.

Games from Lichess and Chess.com

When you ask us to import games or to scout an opponent, our server asks lichess.org or chess.com for that username’s public games. We send only the username, from our server, so neither site sees your IP address. Lichess is run from France and Chess.com from the United States. Answers are kept in memory for a few minutes; games you save become part of your account.

Scouting uses only games the scouted player made public on those sites. To count scouting reports against the monthly limit, we keep on your account which usernames you scouted and in which month. For you the legal basis is the service you asked for (Art. 6(1)(b) GDPR); for the scouted player it is our legitimate interest, and yours, in preparing for a game from games that player chose to publish (Art. 6(1)(f) GDPR).

If you install and connect the OpenPawn browser extension, it fetches your finished games from Lichess and Chess.com in your browser and sends them to your account; those two sites then see that request from your browser as they would any visit. The extension holds a key that only works for it and lapses after 90 days without use. You can disconnect it at any time on the site or in the extension.

The opening explorer works like the import: our server sends the position, nothing about you. If you make a Chess year card from a Lichess or Chess.com username, we keep the username and the numbers on the card for 60 days so the link works, then delete them.

Public chess data

The leaderboard and the game database show what FIDE’s monthly rating list and public tournament broadcasts already publish: players’ names, federations, titles, sex as FIDE lists it, years of birth, ratings and games. We take the list from ratings.fide.com once a month and keep each month’s ratings for the rating history.

We show this because chess players have a legitimate interest in following their sport, and the players are already listed publicly by FIDE for exactly that purpose (Art. 6(1)(f) GDPR). We add nothing that FIDE or the broadcast does not publish. If you are listed and object (Art. 21 GDPR), write to us and we will look at your case. Club directory entries come from Wikidata and from members; they describe clubs, and if one names or links to you and you object, we change it.

Verified titles

If you apply to show a FIDE title on your profile, we keep your FIDE ID, the name you give, the account on another chess site you verify with and the code you post there, what we found, and our decision with the reason. A verified player may add a public name and one link to the profile. We keep this while you have your account, so the title stays verified (Art. 6(1)(b) GDPR).

Clubs and communities

In a community we keep who is a member and with which role, join requests and invites, homework and your results on it, and club nights with their pairings and results. Organisers can add players to a club night by name; those names are kept with the club night. Other members see what the community’s settings allow (Art. 6(1)(b) GDPR).

Daily goal, reminders and the weekly email

If you set a daily goal, we count what you do toward it on your account (puzzles, games, lessons and minutes of practice) by your own calendar day. For that we keep your time zone, the days you met your goal, and the day you last opened your dashboard, so we can welcome you back after a break. Only you see these counts and your streak. We keep them while you have your account (Art. 6(1)(b) GDPR).

Reminders on your device are off until you turn them on. Your browser then gives us an address at its push service, which the browser’s maker runs (Google for Chrome and most other browsers, Mozilla for Firefox, Apple for Safari). Each reminder is encrypted for your device and holds only one short sentence in your language and the page to open, so the push service learns nothing about you or your chess. Turning reminders off deletes these addresses. Junior accounts get no reminders on their device.

The weekly email Your week in chess is off until you turn it on. On Monday mornings it goes to your sign in address with the week’s games and puzzles, your streak and one note from your coach, taken from the reviews of your own games. Each one has a link that turns it off with one click, and nothing else.

The legal basis for reminders and the weekly email is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the settings, without affecting what was sent before.

Email

We email you to confirm your address, to reset a password, about the safety of your account, about notifications you turned on, and to answer you when you write to us. Our own mail server sends every email straight to your mail provider, encrypted in transit where your provider supports it. No outside email service reads or stores our mail.

For each email we keep the recipient, its kind, its subject and whether it arrived, for 30 days after sending; the text itself is deleted once the email has been handed on. If an address bounces or its owner marks our email as spam, we note that and stop writing to it, so we don’t harm our ability to reach everyone else. The mail server’s own delivery log, with the recipient address and the receiving server’s answer, is kept for at most 14 days.

Two kinds of email keep your account safe. When you change your email address, the new address gets a link to confirm it, and the old one a link that undoes the change for 7 days. If you lost both your authenticator and your recovery codes and ask us to take two-step login off, we email your account’s address every day of the 7 day wait, with a link that stops it. For these we keep the old and new address and the dates, and only a fingerprint of each link, until 30 days after the last link stopped working. A link to confirm a new account works for 48 hours, and a link to reset a password for one hour.

Links in our emails go through our own server, which adds one to a daily count for that kind of email and link before sending you on, without noting who clicked. Our emails carry no tracking pixels, so we never know whether you opened one. The legal basis is running your account (Art. 6(1)(b) GDPR) and, for the safety emails, the spam and bounce list, the delivery log and the click counts, our legitimate interest in a safe account and in mail that arrives (Art. 6(1)(f) GDPR).

Help and messages to the team

Searching the help runs in your browser, so what you type stays on your device. Only a search that found no good answer is sent to us, without your name or account and with anything that looks like an address or a number taken out, so we know which answers to add. We keep those words for 180 days. When you answer “Did this help?”, we only add one to a count for that answer and language.

When you write to the team from the help, we keep what you write, what it is about and the replies, and, unless you untick the box, the page you were on, the app version and your browser. You can add one screenshot; we redraw it as a new image, so nothing hidden in the file reaches us. People on our team read your message and answer in the app. Nothing goes to an outside support service.

If you can’t log in, you can still write. An email address is optional then and only used to tell you that we answered; we delete it the moment the conversation is closed. You open the conversation with a private link that we don’t store.

A conversation with no answer from you for 30 days is closed. We delete the screenshot 30 days after the conversation is closed and the rest of it 12 months after. If you delete your account, your conversations go with it at once, and the download of your data includes them. The legal basis is answering your request (Art. 6(1)(b) GDPR) and, for the page, app version and browser, our legitimate interest in finding what went wrong (Art. 6(1)(f) GDPR).

Fair play checks

To keep rated games fair, our server checks the moves of rated games against people with a chess engine after the game. For each game it keeps a few numbers per player: how often a move matched the engine’s choice, how much was lost per move, how long the moves took, and how often the game window lost focus while it was your turn. Only that count is kept, never what else was on your screen. It also looks at patterns across rated games, such as a rating that rises unusually fast, losses that look thrown, or two accounts that keep giving each other wins. We use no device fingerprints and no IP addresses for this.

Games against our bots only change your practice rating when the server can verify them. For that, the browser sends how long each move took along with the result.

The legal basis is our legitimate interest, and that of every player, in fair games and honest ratings (Art. 6(1)(f) GDPR). We weighed it against your interests: the checks use only what happens in rated games on OpenPawn, keep a few numbers instead of recordings, find nothing outside the game, and lead to nothing without a person’s review. You can object at any time (Art. 21 GDPR). Because fair rated play depends on these checks, an objection can mean that we stop offering you rated games against people.

Automated decisions

OpenPawn makes no decision about you based solely on automated processing (Art. 22 GDPR). The fair play checks above only score games and, above a threshold, open a case. A person then looks at the evidence and decides; nothing changes on your account before that. Reports from other players work the same way. We do not use automated means to decide on reports of illegal content either.

If a moderator marks your account for unfair play, your rating gains from the games concerned are taken back, your opponents get back what they lost and you are left off leaderboards. You are told why and can appeal, and your appeal is looked at again by a person, by a different moderator whenever OpenPawn has more than one. If you report a player, we keep your report and note; the player never learns who sent it.

Keeping the site safe

To keep the site safe, our moderators may look at an account, its games and the reports about it or sent from it. They see only what they need for that, never your password, your sign in codes or your full email address. Every look at an account and every decision is logged with who made it. Looks are kept for a year and decisions for two years.

If a moderator warns, suspends or bans an account, the player is told why on their account standing page and by email, and can ask for a second look. A suspended player can still sign in, take their data with them and delete the account. Warnings are kept for two years, and suspensions and bans for two years after they end. If you report something, you are told that a moderator looked at it, never what was decided about someone else.

Usernames are never given out twice, so nobody can take over an old name and pretend to be its former owner. For that we keep a one way hash of every username that was ever used, also after its account is deleted. If a banned account is deleted, we keep a salted hash of its email address for three years, so the same address cannot simply open a new account. Neither hash reveals the name or address it was made from.

The legal basis for all of this is our legitimate interest, and that of every player, in a safe site where bans mean something and names can be trusted (Art. 6(1)(f) GDPR). The hashes are the least we can keep for that: they serve only to recognise a name or an address that comes back.

Visit and step counts

To see which pages people use, your browser tells our server which page it opened, which other website it came from on the first page of a visit, and its language setting (such as “de-AT”, which also names a country). The server only adds one to a counter per day for each and keeps no record of the visit: no cookie, no IP address, no account and no order of pages.

We also count a few steps on the site, like a first move, a finished game or a shared card, as totals per day. Your browser sends only the name of the step, with nothing that could tell who you are or link one step to another.

From these totals nobody can be singled out. We keep them for about 13 months (400 days). The legal basis is our legitimate interest in improving the site (Art. 6(1)(f) GDPR); your interests are protected because nothing can be traced back to you. These counts set no cookie, store nothing on your device and read nothing from it beyond what the page itself needs, so no consent is required.

IP addresses, logs and security

Your IP address is used in memory to slow down abuse such as password guessing and floods of requests, and the counters are forgotten within minutes. We keep no access logs. When a page fails, the server counts the error per hour with the page address and the error message, without who saw it, for 30 days. The legal basis is our legitimate interest in a site that stays secure and works (Art. 6(1)(f) GDPR).

How we protect your data (Art. 32 GDPR):

• every connection is encrypted (HTTPS with HSTS), and a strict content security policy lets pages load scripts only from our own server;
• passwords are hashed with Argon2id, sessions and email links are stored only as hashes, and two-step secrets are encrypted with AES-256-GCM;
• the database and our own services sit on private networks with no route to the internet; only a few named outside services can be reached, through one gateway;
• nightly backups are encrypted before they leave the server and are kept for 30 days in the EU;
• moderators see only what a case needs, and every look and every decision is logged.

Who receives data

OpenPawn runs on its own servers in the European Union. One company processes data for us under a data processing agreement (Art. 28 GDPR):

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: the servers, the database and the encrypted backups, in data centres in the EU.

Our email, the move service behind the bots, and the fonts, sounds and engines of the site all run on our own servers, so no other company sees them. Some data reaches others because you use a feature that needs them; they act as controllers in their own right:

• Google or Apple, if you sign in with them;
• the push service of your browser’s maker (Google, Mozilla or Apple), if you turn on reminders;
• Lichess and Chess.com, which receive a username when you import, scout or use the extension;
• your own email provider, which receives the emails we send you.

We disclose data to authorities only where the law obliges us to, and we never sell data or share it for advertising.

Data outside the EU

We store all data in the EU and use no processor outside it. Data leaves the EU only in the cases you start yourself: a username you import from or scout on Chess.com goes to the United States; the push services of Google, Mozilla and Apple may handle reminders in the United States; and Google and Apple may handle sign in there. Where the company is certified under the EU-US Data Privacy Framework, the transfer rests on the Commission’s adequacy decision (Art. 45 GDPR); otherwise it rests on Art. 49(1)(b) GDPR, because it is needed for the service you asked for.

Cookies and storage on your device

We store something on your device only when it is strictly necessary for a service you asked for (Art. 5(3) of the ePrivacy Directive, § 25(2) no. 2 TDDDG in Germany). That is why there is no cookie banner. These are all our cookies:

• op_session keeps you signed in, until you sign out and for at most 30 days after your last visit;
• openpawn_locale remembers the language you picked, for a year;
• op_guest says which guest you are when you play someone’s link without an account, for up to 30 days;
• op_signup ties a sign up you have not confirmed yet to this browser, for 48 hours;
• op_pending, op_webauthn, op_oauth_google, op_oauth_apple, op_link and op_finish protect the steps of signing in, for 5 to 15 minutes.

Your browser’s storage keeps, under names that start with “openpawn:”, the theme, board, sound and other settings you choose, guest progress, the coach’s memory of your reviewed games, drafts and your list of messages to the team, and small marks so a tip is not shown twice. To work offline, the site also keeps its own files and pages you opened in the browser’s cache, never pages with your account in them. All of it stays on your device until you clear it in your browser.

How long we keep data

• Your account and what is in it: until you delete the account.
• Sessions: until you sign out, and at most 30 days after your last visit.
• A sign up you never confirmed: 48 hours.
• Guests from a game link and their games, also in the history of whoever sent the link: 30 days after the guest’s last game.
• Records of an email change or a two-step removal: 30 days after the last link stopped working.
• Sent emails: recipient, kind and subject for 30 days; the mail server’s delivery log for at most 14 days.
• Help searches without an answer: 180 days. Messages to the team: the screenshot until 30 days and the rest until 12 months after the conversation is closed.
• Fair play: the numbers per game for 180 days, signals and reports for one year, cases closed without action for one year and warnings for two years after the decision. A mark and its case stay for as long as the mark stands.
• Moderation: looks at an account for one year, decisions and warnings for two years, suspensions and bans for two years after they end.
• Hashes of retired usernames: as long as OpenPawn runs. The salted hash of a banned account’s email address: three years after the account was deleted.
• Daily visit, step, email and click totals: 400 days. Error counts: 30 days. A Chess year card: 60 days.
• Backups: nightly encrypted copies are kept for 30 days and then deleted, so anything deleted is gone from the last backup within 30 days.

When you delete your account

Deleting your account under Settings, then Data, removes it at once with everything listed above, including the emails we hold for your address and any running subscription. What stays is only what others need or what keeps the site safe:

• games against other players stay in their history and club night tables stay complete, with your name replaced by “?”;
• the hash of your username, and, if the account was banned, the salted hash of its email address, as described above;
• the daily totals, which never held anything about you, and the encrypted backups until they expire after 30 days.

Your rights

You have the right to access your data and get a copy (Art. 15 GDPR), to correct it (Art. 16), to have it deleted (Art. 17), to restrict its processing (Art. 18), to take it with you (Art. 20) and to object to processing based on our legitimate interest (Art. 21). Where you gave consent, you can withdraw it at any time (Art. 7(3)). Most of this is built in:

• Settings, then Data, then Export: a file with the data of your account;
• Settings, then Data, then Delete account: removes your account for good;
• your profile and settings, to correct what you entered and to choose what others see;
• the switches for reminders and the weekly email, to withdraw consent.

The export leaves out two things only while they could help someone hide unfair play: the numbers per game from the fair play checks, and a case still waiting for its first look. Once a case is decided, the case is in your export. If you ask us for the rest, we give you everything that does not reveal how the checks work or harm other players’ rights (Art. 15(4) GDPR).

For anything else, write to us. We answer within one month (Art. 12(3) GDPR) and may ask you to confirm that the account is yours, for example from its email address.

Your right to complain

You can complain to a data protection authority, in particular in the country where you live or work or where you think the law was broken (Art. 77 GDPR). The authority responsible for OpenPawn is named at the top of this page. We would be glad if you wrote to us first, so we can put things right.

Children and juniors

Young players are welcome. Anyone born in the last 16 calendar years plays as a junior, so every player under 16 is covered whatever their birthday. For juniors:

• games, results and whether they are online show to friends only, and their live games are never listed for watching;
• challenges come from friends only, and they can’t open games to everyone;
• there is no profile photo, their country shows to friends only, and a club with a junior in it stays closed and junior-safe;
• there are no reminders on their device and nothing to buy.

A junior’s account runs on the contract with the player (Art. 6(1)(b) GDPR), which a parent or guardian agrees to for players under 16, as the terms of use say. Where we ask for consent, a child under the age of digital consent in their country (between 13 and 16 in the EU: 16 in Germany and the Netherlands, 15 in France, 14 in Austria, Spain and Italy, 13 in Belgium and Norway) needs the agreement of a parent or guardian (Art. 8 GDPR).

If you are a parent and think your child gave us data without your agreement, write to us and we will delete the account or the data concerned.

Changes

When this policy changes, the new version appears here with a new date. If a change matters for your account, we tell you before it applies, and where a change needs your consent, we ask for it.