Privacy

It depends how you play

As a guest, the app makes up a name and an identifier on your phone and keeps them there. Your statistics are counted on the phone. Nothing identifying you is sent anywhere.

With an account, you give us an email address, a nickname and a password, and your statistics are kept on our server so they survive a new phone.

What an account stores

• Your email address — it identifies the account and is where a password-reset code goes. We send nothing else to it.
• Your nickname, which the table sees.
• A scrambled form of your password (scrypt, salted). The password itself is never stored and cannot be recovered from what is — not by us either.
• Statistics for each hand: what you did with it, not what you held.
• When the account was made, and when the address was first confirmed.

Signing in stores a token on your phone; we keep only a one-way hash of it. Reset codes are stored the same way, expire after fifteen minutes and work once.

What never leaves your phone

• Hands you record in the tracker, and anything typed into the equity calculator.
• Your settings.
• Everything about a guest — until you make an account, at which point those totals come with you.

What the table sees

While you’re playing, the others are sent your nickname, the face you picked, your chips and what you do on each turn. That’s the game. Your email address is never sent to another player.

Faces come from a set inside the app. You can’t upload a photograph, so no picture of yours is sent anywhere.

What we don’t do

• No analytics and no crash reporting.
• No advertising, and no advertising identifiers.
• No tracking across other apps or websites.
• No third-party libraries in the app at all.
• No selling or sharing, to anyone, for anything.
• The app asks for no permissions — not your camera, photos, location, contacts or microphone.

Who else touches it

Railway runs the server and the database. Resend delivers the password-reset email, and so handles your address at the moment one is sent. Neither gets anything for their own purposes.

Deleting it

In the app: Profile → the gear → Delete Account. It asks for your password, then removes the account, every hand counted against it and every session it had open. The rows stop existing — nothing is marked deleted and quietly kept.

If you’d rather we did it, write to us from the address on the account. Deleting the app removes everything held on the phone.

Children

The app isn’t directed at children, and we don’t knowingly keep an account for anyone under 13.

Changes

If this changes, the date at the top changes with it.