Privacy Policy

One Pawn collects as little as it can. To have an account you need to give an email address and a password. Everything else stored about you is the chess you have played. There is no advertising, no tracking, and no analytics. Your data is not sold and not shared with anybody except the two providers needed to run the site.

One Pawn is the data controller for the data described here. One Pawn is a personal project run by mwlde, not a registered company. Contact: legal@mwlde.com.

The operator's full name and contact details are available on request to legal@mwlde.com, and to any supervisory authority that asks.

• Email address. Given by you when you register.
• Password. Stored only as a hash by Supabase, our authentication provider. It is never stored in a readable form and cannot be recovered, only reset.
• Game history. The games you finish while logged in: the moves, the result, the settings the game was played at, and when it was played.
• Technical data. Our hosting and authentication providers process connection data such as IP addresses and browser user-agent strings in order to serve the site and to block abuse. One Pawn does not build profiles from it and does not keep its own copy.
• Learn progress. Which lessons and practice items you have worked through, and when they are next due [planned].
• Coach usage. A count of how often you have asked the AI coach for comment, kept so that fair usage limits can be applied, plus a record of each request for debugging and abuse handling [planned].

If you play without an account, nothing is saved. The game lives in your browser and is gone when you leave.

• Email and password: to create your account, to sign you in, to confirm the address is real, and to let you reset your password. Your email is also how we would reach you about a material change to this policy or to the terms.
• Game history: so that you can look at your own past games. It is shown to you and to nobody else.
• Technical data: to deliver the site and to keep it available, which includes rate limiting and blocking attacks.
• Learn progress: to schedule practice and show you how far you have got [planned].
• Coach usage: to apply fair usage limits and to keep the feature working and affordable [planned].

One Pawn is run from the United Arab Emirates. The GDPR still applies to users in the European Economic Area, because the service is offered to people there, so the bases below are given in GDPR terms.

• Performance of a contract (Article 6(1)(b)) for your account, signing you in, and saving your games. These are the service you asked for.
• Legitimate interests (Article 6(1)(f)) for the technical data used to keep the site available and to prevent abuse. The interest is running a working service without it being knocked over.

There is no processing based on consent today, because there is nothing optional to consent to. If that changes, this policy changes with it and you will be asked first.

While your account exists, your account data and game history are kept indefinitely. The point of saved games is that they are still there next year.

When you delete your account, your account record and your saved games are deleted with it. This happens immediately, at the moment you confirm it, and there is no grace period in which it could be undone. Backups held by our providers may keep copies for a short period afterwards before they roll over. Technical logs held by the hosting and authentication providers expire on their own schedules and are not under our control beyond what those providers offer.

Your data is not sold, rented, or shared for advertising. It is handled by the following processors, each of which does one job:

• Supabase. Authentication and database. It stores your email, your hashed password, and your saved games.
• Cloudflare. Hosting and content delivery. It serves the site to your browser and processes connection data in doing so.
• Anthropic. The AI coach would send the position and moves being discussed to Anthropic's API to generate the comment. Your email address and account identity would not be sent [planned].

We may also disclose data where the law requires it. Given the size of this project, that has never happened.

Supabase and Cloudflare operate in several regions, including the United States and the European Union. Cloudflare serves the site from whichever location is nearest to you, so your connection data may be processed outside your own country. This means personal data may be transferred out of the European Economic Area.

Both providers offer data processing terms that include the European Commission's standard contractual clauses for such transfers. If the AI coach is built, the same question will apply to Anthropic and will be addressed in an updated version of this policy before the feature goes live.

If you are in the EEA or the UK, you have the following rights. We honour them for everyone, wherever you live.

• Access. Ask what data is held about you and get a copy.
• Rectification. Ask for anything inaccurate to be corrected.
• Erasure. Delete your account and its data yourself, from your profile page. You can also delete individual saved games there.
• Portability. Ask for your data in a machine-readable format.
• Objection. Object to processing based on legitimate interests.
• Restriction. Ask us to hold processing while a dispute about accuracy or lawfulness is sorted out.
• Complaint. Complain to your local data protection supervisory authority. In the EEA that is the authority for the country you live in.

Email legal@mwlde.com from the address on your account. We will reply within 30 days.

Erasure does not need an email. You can delete your account from your profile at any time. Deletion is immediate and cannot be undone. All associated data including games is permanently removed. You can also delete a single saved game from the games list on the same page.

The other requests are handled by hand in the current preview. There is no export button yet: ask by email and your data will be sent to you as a file within the 30 days above. If you want a copy of your games, ask for it before you delete the account, because afterwards there is nothing left to send.

One Pawn is for people aged 16 and over. It is not aimed at children and it does not knowingly collect data from anybody under 16. If we learn that an account belongs to somebody under 16, the account and its data are deleted.

If you are a parent or guardian and believe your child has made an account, write to legal@mwlde.com and it will be removed.

One Pawn sets one kind of cookie, and it is strictly necessary for the site to work:

• Session cookies (Supabase Auth), named sb- followed by the project identifier. Set when you log in. They hold the token that keeps you signed in as you move between pages. Without them you would be logged out on every click. They are cleared when you log out.
• onepawn_returning. Set the first time you sign in on a device, and it stores nothing but the fact that somebody has. It lets the login page say “Welcome back” to a returning visitor instead of greeting them as new. It holds no email address and no identifier, so it cannot be used to recognise who you are, only that this browser has been used to sign in before.

No other cookies are set. There are no advertising cookies, no tracking cookies, and no third-party cookies. Both cookies above are strictly necessary for a service you asked for, so no consent banner is required and none is shown.

One Pawn runs no analytics at all. There is no Google Analytics, no tag manager, no pixels, and no third-party scripts measuring what you do on the site.

This may change. If analytics are added, they will be a privacy-respecting, cookie-free tool such as Plausible or Fathom, which count page views without identifying individual visitors. This policy will be updated to say so before any such tool is switched on, not afterwards.

Passwords are hashed by Supabase and never stored in readable form. Database access is restricted by row level security policies, so one account cannot read another account's data. Traffic is served over HTTPS.

No system is perfectly secure, and this one is maintained by one person. If you find a weakness, please report it to hello@mwlde.com.

This policy carries a version number and a date at the top. For material changes, meaning a new category of data, a new recipient, or a new purpose, we will email the address on your account at least 30 days before the change takes effect. Minor edits that do not change the meaning take effect when published.

For any privacy question, or to use any of the rights in section 9, write to legal@mwlde.com.

For general inquiries and support, including anything that is simply not working, write to hello@mwlde.com instead.