We respect your privacy and are committed to protecting your personal data. This policy explains how we collect, use, and safeguard information when you use our service. It is intended to comply with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
1. Information We Collect
1.1 Account & Authentication
- Display name and email address
- Google account identifier (when you sign in with Google)
- Phone number (when you verify a phone to receive SMS notifications)
- Authentication events (sign-ins, sign-outs, device descriptors)
1.2 Service Usage
- Games you create or join (cash-game and tournament records)
- Player roster, buy-ins, buybacks, and settlement data you record
- Invitations sent or received
- Profile preferences
1.3 Technical Data
- IP address, device type, and browser identifiers
- Approximate geolocation derived from IP (used for security signals)
- Error logs and performance traces
2. How We Use Your Information
- To authenticate you via Google OAuth, Twilio Verify, or Resend magic links
- To operate Hold'em Pitboss and synchronize game state across devices
- To send transactional notifications (invitations, sign-in alerts, account changes)
- To detect and prevent abuse, fraud, and unauthorized access
- To improve the service through aggregate usage analytics
- To comply with legal obligations
3. SMS Communications
If you verify a phone number and opt in to SMS notifications, we use your phone number solely to send you transactional text messages related to your Hold'em Pitboss games.
- Data we collect: the phone number you verify and a timestamped record of when you opted in.
- How we use it: to deliver transactional SMS such as game invitations, schedule changes, cancellations, reminders, and host accept notifications. We do not use your phone number for marketing.
- Sharing: we share the phone number with our messaging provider (Twilio) strictly to deliver the messages above. We do not sell or share it for third-party marketing purposes.
- Frequency: message frequency varies based on your game activity.
- Cost: Msg & data rates may apply, depending on your mobile carrier and plan.
- How to opt out: reply STOP to any message, or turn SMS off in your profile under SMS notifications. You can also remove your phone number from your profile at any time.
- Help: reply HELP to any message, or contact support@holdempitboss.com.
4. Sub-processors & Data Sharing
We do not sell or rent personal information. We share specific data with the following sub-processors strictly to operate the service:
- Google — OAuth sign-in (identity verification)
- Twilio — Phone number verification and transactional SMS notifications about your games
- Resend — Transactional email delivery (magic links, notifications)
- MongoDB Atlas — Database hosting
- Railway — Application and static site hosting
- Plausible Analytics — Cookieless aggregate usage analytics
We may also disclose information when legally required (court orders, lawful subpoenas) or to protect the rights, property, or safety of users and the public.
5. Data Security
- Encryption of data in transit (TLS) and at rest where supported
- Strong authentication via OAuth, OTP, and magic-link flows (no stored passwords)
- Per-device session tracking and the ability to revoke devices
- Audit logging for sensitive account actions
6. Cookies & Tracking
We do not use cookies. To keep you signed in, we store a session token and your basic account details in your browser's local storage. This is strictly necessary to operate the service, and it is removed when you sign out. We also store display preferences, such as which columns you have chosen for a crew's standings table, so the interface looks the same on your next visit.
We use Plausible Analytics to measure aggregate usage of the service. It is cookieless: it stores nothing on your device, does not track you across other websites or apps, and does not build a profile of you. Page addresses are stripped of identifiers before they are sent, so visits are counted without recording which game, crew, or invitation you looked at. We do not run advertising scripts and we do not set tracking cookies.
7. Your Rights
Under GDPR and CCPA, you have rights to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your account and associated data
- Port your data in a structured format
- Restrict or object to certain processing
- Withdraw consent at any time
To exercise these rights, email support@holdempitboss.com.
8. Data Retention
We retain your personal data only as long as needed to operate the service, comply with legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your account at any time; some records may be retained as required by law or for legitimate fraud-prevention purposes.
9. Children's Privacy
The Service is not intended for users under 18. We do not knowingly collect personal information from anyone under that age. If you believe we have, contact us and we will delete the information promptly.
10. International Transfers
Data is processed and stored in facilities operated by our hosting providers, primarily in the United States. Where data is transferred internationally, we rely on appropriate safeguards under applicable law.
11. California Privacy Rights (CCPA)
California residents have additional rights under the CCPA, including:
- Right to know what personal information is collected and how it is used
- Right to know whether personal information is sold or disclosed (we do not sell)
- Right to delete personal information
- Right to non-discrimination for exercising these rights
12. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated by email or via the service. Continued use after the effective date constitutes acceptance.
13. Contact
Hold'em Pitboss
Email: support@holdempitboss.com
Address: Available upon request via email