Privacy Policy

PawnUp · Last updated 13 September 2026

The short version: PawnUp stores your email, your chess, what you told onboarding and anything you send us through the feedback form, so the app can be about you. That is the whole list. It runs no analytics, it has never sent anyone your name, your email or your chess.com handle, and there is no advertising in it of any kind. When something in the app breaks it sends the error to Sentry, in the European Union, so that it can be fixed; that report says what broke, carries at most an install id, and holds nothing you typed or played. From version 2.0 the phone app also asks Expo for a fix each time you open it, and that check carries an install id and, after a crash, the error message. Both are described in full below.

This policy covers the PawnUp mobile app and the website at pawnup.app. PawnUp is made and run by an independent developer in France, who is the data controller for everything described below. Questions, requests, or a complaint: [email protected].

What is in your account

All of it lives in our Supabase database, in rows keyed to your user id. Row level security is switched on for every table, so nobody else's queries can reach your rows.

For everything above the first row down to your training, the legal basis is performance of the contract you enter by making an account: each of them exists because the app cannot do what you asked it to do without it. Feedback is different and is your consent, given by choosing to send it. You can decline by not using the form, and there is no part of PawnUp that stops working if you never do.

Deleting your account deletes your feedback with the rest of it, addresses included. That is one deletion rather than two lists to keep track of.

Analytics: there is none

This version of PawnUp measures nothing about how you use it. No product analytics, no usage events, no screen tracking. Nothing is sent to an analytics company, because the app is not built with the key that would let it reach one. That is why there is no analytics switch in Settings: a switch that governed nothing would be worse than saying this plainly.

What follows is the other half, and it is not analytics: when the app breaks it says so. That is a different thing collected for a different reason, and it has its own section rather than a sentence tucked into this one.

When the app breaks

PawnUp sends the errors it hits to Sentry, so that they get fixed. Sentry is run by Functional Software, Inc., and PawnUp uses its European Union region: the reports are stored in the EU and do not leave it for us to read them. This is the only thing that reports a broken PawnUp to us, and it is new: in every version before this one, a screen that was broken for you stayed broken until you told us about it.

A report is sent when the app hits an error it cannot handle, and it contains:

• The error and where it happened in our code. The message, and the list of functions that led to it. This is about our program, not about you.
• Which build it was. The version of the app, the platform it was running on, and whether it was a real build or a development one.
• The phone it happened on. Its make and model, its system version, the language and time zone it is set to, and its state at the time, such as free memory, storage, battery and whether it was online. Not the name you gave the phone.

Your account is not on it. A report used to carry your account id, the random identifier your account has in our database. It no longer does, and it has no email address and no name either. What a report from the phone app can carry is an install id. Sentry's code makes one up the first time PawnUp runs and keeps it on your phone. It is not your account id, nothing joins the two, and it cannot tell us who you are. It does let us see that several reports came from the same install. On iPhone a report can also carry a second one, a scrambled form of the identifier iOS gives an app's developer for your phone, which Sentry's code adds by itself. A crash the phone catches after the app has stopped always carries the install id, because it is sent by code that runs underneath PawnUp's and never passes through ours. Reports from this website carry neither.

The install id is deleted with the app on iPhone. On Android it is part of the automatic backup your phone makes, like the update check's id below, so setting a phone up from that backup or reinstalling PawnUp can bring it back.

We took that out knowing what it costs, and it is the same trade as the one below. With the account id there, if you wrote to us about a crash, we could find the report of it. That is not possible now: the install id is shown nowhere in the app and stored nowhere with your account, so nothing you could tell us leads to your reports. We would rather work the harder way than have your crashes filed under your name, and we would rather say what that cost than present it as free.

What is deliberately not in it: your IP address, which we switch off rather than accept; the headers or cookies of any request, which are removed on the way out; your device's own name, which is never sent; your account id, your email address, your chess, your games, your feedback, and any picture of your screen. We do not record your session and we do not send the addresses of the screens you visited.

Nor do we send the trail of what happened before it. Most crash reporting tools attach the last hundred things the app did: every screen you opened, every request it made, and the full address of each. It makes a bug easier to find. It is switched off here, including in the part of the reporting code that sends a crash after the app has stopped, and anything that still arrives with a report our own code sends is deleted from it on its way out. That costs us something real. A report arrives as the error and where it happened, with nothing about how you got there, so some bugs take longer to work out than they would. We would rather pay that than hold a list of everywhere you went, and we would rather tell you the price than present it as free.

There is no switch for this one. The reason is worth saying rather than hiding: an error report is about what our app did wrong, not about what you did, and a crash that ruins somebody's evening is the one we would most like to hear about. There is also less for a switch to be about than there was, since a report no longer says who you are.

Reports sent before this changed are the one exception. Between the day error reporting was switched on and the day the account id came off it, a report sent while you were signed in did carry that id, and any of those still held by Sentry still do. Email [email protected] and we will delete them; see Your rights below.

If this ever changes, this page changes first. That is partly automatic and partly a person, and it is worth being exact about which. The website you are reading this on is checked against this page every time it is built, in both directions, and a version of it that collected something this page denies would fail to build at all. That is not a promise about a check somebody might run: it is what made this page's own last edit compulsory. That check reads the website's own code, so it can see an analytics key or an error-tracking key appear and it cannot see the update mechanism below, which is part of the phone app and is not in the website at all. The iPhone and Android apps are built on somebody else's servers, where the check has to be run by hand before a release, so for those it is our procedure rather than a machine. We would rather tell you where the seam is than describe a guarantee that is only three quarters true.

What the update mechanism sends to Expo

This is about the iPhone and Android apps from version 2.0 onwards. It is not about this website, and it is not about version 1.0. Neither of those contains the mechanism at all, so neither has ever sent any of what follows.

From 2.0 a broken screen can be fixed without you fetching a new version from the store. To make that possible, the app asks Expo's update service at u.expo.dev, run by 650 Industries, Inc. in the United States, once each time you open it, whether there is a newer bundle for the version you have. That is a background request and the app never waits on it. Two things in it are worth naming rather than burying:

• An install identifier, on every check. A random id the app generates the first time it runs and stores on your phone. It is not your account, not your email address and not your phone's own identifier, and it is not linked to anything that says who you are. It does not change from one check to the next, and that is exactly what makes it an identifier: Expo can tell one install from another with it, and count them. On both platforms it is also part of the automatic backup your phone makes, so setting a new phone up from that backup can bring the same id back rather than a fresh one; on Android, so can reinstalling PawnUp on the same phone. Nothing in PawnUp asks a phone to forget it, on either platform.
• The message from a crash, once, on the check after one. If the app died the last time you opened it, the next check carries the text of that failure, cut off at 1024 characters, so that a bad release can be spotted and replaced. It is the technical message of the error, not a picture of your screen and not any of your data, and it is sent one time and then deleted from the phone. On iPhone this covers a crash in the app itself. On Android it covers only a failure of the update mechanism, which is a narrower thing.

Like any request over the internet, the check also tells Expo your IP address, which version of the app you are running and which platform you are on. Nothing about your chess, your account, your email or your feedback is in it. None of it comes back to us either: this goes to Expo, and there is no dashboard here that shows it to us.

This is separate from the section above and goes to a different company: Sentry gets the errors the app hits, Expo gets this. They are not the same report and they are not joined up anywhere. Each can carry an install id, the two are different ids made by different code, and neither is your account id. Neither report carries that. There is no switch for it either. It is how a broken version gets fixed on your phone rather than an extra we added on top, and we would rather say that plainly than offer you a choice you do not have.

What we send to other companies

• Supabase hosts the database and signs you in.
• chess.com is read, never written. The app fetches your public profile and your own game archives. Linking tells them nothing about you.
• Sentry receives the error reports described above, in its European Union region, and nothing else. No name, no email address, no account id, no chess.
• Expo, from version 2.0 of the phone app, receives the update check described above and nothing else. No name, no email address, no chess.
• Nobody else. No analytics service, no advertising SDK, no attribution network, no session replay, no fingerprinting, no data broker, and nothing sold or shared for anyone else's marketing. The app sends no advertising identifier on any platform, which is also why iOS never shows you a tracking prompt.

Deleting your account

Settings → Account → Delete account. It asks once, then it is done: your rows, your games, your puzzle history and your sign-in are removed. There is no soft delete, no grace period and nothing to email us about first.

Backups roll off within 30 days, which is the one place a copy briefly outlives the deletion. Old error reports are the other, and only old ones. A report sent today carries no account id, and the install id it may carry was never attached to your account, so deleting your account leaves nothing of the account behind in it. A report sent before we took the account id off them does carry that id, it is held by Sentry rather than by us, and deleting your account does not reach it: the button empties our database, and Sentry is not our database. Those expire by themselves, on Sentry's schedule for our plan. If you would rather not wait, email [email protected] and we will delete them. There is nothing else, because there is nowhere else it went.

Your rights

Under the GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, withdraw a consent you gave, object to processing based on legitimate interests, or complain to your data protection authority. This policy relies on three bases and no others. The contract you enter by making an account covers everything in the table above. Your consent covers the feedback you choose to send, and you give it by sending it. Our legitimate interest in keeping the app working covers the error reports, which is the one you can object to. Being straight about what that gets you now: a report the app sends today carries no account id and nothing you typed or played. It may carry an install id, and because that id is kept apart from your account and shown nowhere in the app, there is nothing you could give us that would pick out which reports are yours. What an objection still reaches is the older reports that carry your account id, and we will delete those if you ask. In France your authority is the CNIL. Deletion is a button in the app; for anything else, email [email protected] and we will answer within a month.

Where the data lives

Supabase is a US company and your data is in its EU region; the game analysis service runs on hardware in France. Sentry is a US company and the error reports are in its European Union region, which is a choice we made and which is visible in the address the app sends them to. Expo is a US company and its update service is reached wherever its network answers from, which is not something we choose. Where a transfer to the United States happens it rests on the EU Commission's standard contractual clauses.

Children

PawnUp is not directed at children under 13, and we do not knowingly collect anything from one. If you believe a child has made an account, email us and we will delete it.

Retention

Account data stays for as long as the account does, and deleting the account deletes it. Error reports are the second store, they are Sentry's rather than ours, and they expire on Sentry's retention schedule for our plan without anybody doing anything. They are not reached by the delete button, and that is said twice in this policy because it is the sentence in it most likely to be read as a promise it does not make. What it now matters for is the older reports that carry an account id, since a report sent today carries none and its install id was never tied to the account a deletion removes. Ask us and they go sooner. The update check described above is a third thing and is not part of your account either: it carries nothing that says who you are, we never hold it, and how long Expo keeps it is theirs to answer rather than ours to promise.

Changes

If this policy changes in a way that affects what we collect, the app will say so rather than quietly updating the date at the top.