Draft notice. This page describes, accurately, what the product does with data today (owner decisions O-0005, recorded 11 August 2026). It has not yet been reviewed by a lawyer and is not presented as a finished legal document.
Privacy
Last updated 11 August 2026.
The short version
Pawnbase is local-first: your games, repertoires, notes, and training history live in your own browser's database. If you create an account, that data also syncs to your account's private rows so your devices stay in step — readable by you alone, apart from individual games you explicitly share with a coach. There are no ads, no third-party trackers, and no analytics scripts.
What lives where
- On your device: games, analyses, repertoires, studies, puzzle history, journal notes, learning records, and settings — in your browser's own storage.
- Never synced, never in backups: AI provider keys you add and your Lichess token live in a separate local store; wiping data on account switch removes them.
- Synced when signed in: the training data above, mirrored to your account's rows with row-level security. The Account page lists exactly which collections sync.
- Fetched from providers when you ask: importing games queries Lichess's and Chess.com's public APIs for the username you enter; opening statistics and endgame tablebase answers come from Lichess's public services. Our Chess.com relay logs request shapes and statuses — never usernames.
- Anonymous usage counts: a short, fixed list of events (for example “sample preview opened”, page-speed measurements with routes reduced to patterns) — no usernames, no game content, no identifiers, no cookies. Your browser's Do Not Track or Global Privacy Control setting turns them off entirely.
Retention
- Local data stays until you delete it (Settings offers backup, restore, and wipe).
- Synced rows live only while your account exists.
- Server logs, including the anonymous usage counts, expire on our host's standard ~30-day rotation.
- Deletion: on request we erase your cloud data within 30 days. Honest caveat: the in-product one-click account-deletion flow is still being built; until it ships, deletion is by request via the contact below, and this page will be updated when the self-serve flow exists.
Your rights, everywhere
We apply the same standard to everyone regardless of where you live: access to your data (the backup export contains it), correction (it's your data — edit it), deletion (above), and objection to the anonymous counts (Do Not Track). Pawnbase is not directed at children; the intended minimum age is 16.
AI features
Optional AI prose (lesson plans, prep summaries) runs only if you bring your own provider key. Your key stays on your device; the structured context each feature sends goes directly to the provider you chose, under that provider's terms. Skip the key and no AI feature ever runs.
Contact
Privacy questions and deletion requests: open an issue or private security advisory on the project's GitHub repository, or contact the maintainer through the profile listed there.