1. Who is responsible
WhitePawn is operated by Khadim Fall. The full address is in the legal notice. For any privacy question or request, write to info@khadimfall.com.
This policy covers the WhitePawn mobile app, WhitePawn Web, this website, and the WhitePawn connector for AI assistants (the "AI coworker" connection, served from mcp.whitepawn.app).
2. Data we collect
- Account data: username, email address, a hashed password or your Google sign-in identifier, profile text you add, and your notification preferences.
- Chess content: games, PGN files, collections, engine analysis, statistics, puzzles, comments, ratings and reviews.
- Social content: friendships, direct messages, club memberships, club posts and replies, and public broadcast chat messages.
- Connected services: if you link Lichess, Chess.com, Twitch or YouTube, we store the account name and the access token needed to sync games or restream.
- Live features: broadcast settings, and the audio and video you choose to send during a call or a livestream. Calls are not recorded by us.
- Purchases: your plan and purchase status. Payment card details are handled by the app store or payment provider and never reach us.
- Technical data: device and browser type, app version, crash reports, server logs with IP address, and online presence while the app is open.
- Diagnostics you send: a report you submit yourself through "Report an issue".
We do not collect payment card numbers, health data, or government identifiers, and we do not run advertising trackers.
3. Why we use it
- To provide the service: store and sync your games, run analysis, deliver messages, run calls and streams (performance of our contract with you).
- To keep the service secure and working: logs, crash reports, abuse prevention (our legitimate interest).
- To send account and notification emails. You can turn notification emails off in Settings.
- To meet legal obligations.
We do not sell personal data and we do not use your content to train AI models.
4. AI assistant connections
You can connect an AI assistant such as ChatGPT or Claude to your WhitePawn account. This is optional and off until you approve it on a WhitePawn consent screen.
- The assistant receives only the data covered by the permissions you approve (account, games, analysis, puzzles, social, clubs, broadcasts), and only when it calls a tool.
- Data the assistant reads is sent to the provider of that assistant and is then governed by that provider's privacy policy.
- Actions that reach other people, publish content, or delete data are created as drafts. Nothing happens until you approve the exact action inside WhitePawn.
- We never receive your conversation with the assistant. We receive only the tool request it sends.
- We store the connection, its permissions, and a record of approved actions. Content written through an assistant is labelled as such.
- You can review and disconnect assistants at any time in Settings under "AI coworkers". Disconnecting revokes access immediately.
5. Who receives data
We share data only with service providers that process it for us, and with the services you choose to connect:
- Hosting and database infrastructure in Germany (Hetzner, operated through sp00ky cloud).
- Resend, for transactional email.
- LiveKit, for real-time audio and video.
- RevenueCat, Apple and Google, for purchases.
- Sentry, for crash reports from the mobile app.
- Google, if you use Google sign-in.
- Firebase Hosting, for this website.
- Lichess, Chess.com, Twitch, YouTube and AI assistant providers, only when you connect them.
Content you publish (public collections, published puzzles, reviews, public club posts, broadcasts and their chat) is visible to anyone. Some providers are located outside the European Economic Area. Where that is the case, transfers rely on the European Commission's standard contractual clauses or an adequacy decision.
6. How long we keep it
- Account data and your content: until you delete the content or your account.
- After an account deletion request: removed from the live service within 30 days. Backups expire on a rolling basis after that.
- AI assistant sign-in codes expire after 10 minutes. Unapproved draft actions expire after 15 minutes.
- Server logs and crash reports: up to 90 days.
- Records we must keep by law, such as invoices: for the legally required period.
7. Your controls and rights
- Edit or delete your content inside the app.
- Disconnect linked services and AI assistants in Settings.
- Turn off notification emails in Settings.
- Request a copy of your data, a correction, deletion of your account, restriction of processing, or object to processing, by writing to info@khadimfall.com. We answer within 30 days.
If you live in the European Economic Area you also have the right to complain to your data protection authority.
8. Children
WhitePawn is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.
9. Security
Traffic is encrypted in transit. Passwords are stored only as hashes. Access tokens for AI assistants are scoped, short-lived and revocable. No system is perfectly secure, so please use a unique password.
10. Changes
We will update this page when the policy changes and adjust the date above. Material changes are announced in the app or by email.