We keep as little as we can.
If we don’t need something to run the site, we don’t collect it. There’s no chat on OpenPawn, so there are no private messages to keep either.
What the server keeps, and why
| Data | Why |
|---|---|
| Email address | To confirm your account, sign you in and reset your password. Never shown to anyone |
| Username | So you can log in and friends can find you |
| Password hash (Argon2id) | To check your password. We never see the password |
| Year of birth | So younger players get safer settings and show less to strangers |
| Country, avatar and settings | Because you chose them |
| Sessions, passkeys and 2FA secret | So you can log in safely. The 2FA secret is stored encrypted |
| Games and ratings | To pick a bot at the right level and show your progress |
| Friends and communities | So friends can find you, invite you to a game and play together in a club |
| Puzzle and lesson progress | So it’s there on your other devices |
Guests have none of this. Their progress stays in the browser.
What we never collect
- Phone numbers or postal addresses
- Real names, unless you type one into your own display name
- Analytics, tracking pixels or fingerprinting
- Advertising IDs
- IP address history. Addresses are only held in memory for a short time for rate limiting
- Anything we don’t need from other companies. No CDNs and no external fonts. Google or Apple only tell us your email address and an account ID, and only if you sign in with them
Your account
- A username can never be changed or reused. Nobody can grab an old name and pretend to be your friend.
- Your email address is used only to confirm your account, sign you in, reset your password and send notifications you turn on. It is never shown to anyone.
- Signing in with Google or Apple is optional. If you choose it, they tell us your email address and an account ID, and nothing else.
- If you turn on two-step sign-in, you get recovery codes. Each one works once and gets you in if you lose your phone. Only you have them.
- You can download everything in your account, or delete it for good, under Settings, then Data.
Bot games stay on your device
The chess engines run in your browser: the bots on our own engine, and the coach on Stockfish. Both come from our own server, so analysing a game doesn’t contact anyone. When the bots play like people, the moves so far go to our own server during the game, so Maia-3 can choose each reply the way a person at the bot’s level would. Maia-3 sees only the position, never who you are, and nothing is kept. Otherwise your moves against a bot only go to the server when the game ends, so we can update your rating. Guests don’t send anything else: their games, puzzles and ratings stay in the browser.
Your coach remembers the games it has reviewed with you, to spot patterns and open a review again instantly. For guests that memory stays in the browser. With an account, a copy of the reviewed games is kept with it, so the coach knows you on your other devices too, and it goes when the account does. The first time you sign in, what you did as a guest in that browser comes along. Your profile can export it, restore it from a file, or delete it.
Importing games from Lichess or Chess.com
When you import games, our server asks Lichess or Chess.com for the public games of the username you typed. Your browser never contacts them, so they don’t see your IP address or anything about your device. They only see that OpenPawn asked about that username. Lichess is in France; Chess.com is in the US, so if you pick Chess.com, the username you typed goes there and nothing else does.
We keep the answer in memory for a few minutes so the list loads quickly when you come back to it, then it’s gone. Games you save become part of your account.
Reporting abuse
To report a player or illegal content, write to our contact point with the address of the page, what is wrong and why. The terms of use explain what happens next. Kids use OpenPawn too, so we take every report seriously.
Hosting
Servers are at Hetzner in the EU. Backups are encrypted before they leave the server, stay in the EU and are overwritten after 30 days. We don’t use processors outside the EU.
Puzzles come from real master games and are checked by our own engine. They ship with the site, so solving them doesn’t send anything to anyone else.
The legal details, how long we keep each kind of data and your rights under the GDPR are in the privacy policy. The site is still being built. When something here changes, this page changes with it.