We respect your privacy and are committed to protecting your personal data. This policy explains how we collect, use, and safeguard information when you use our service. It is intended to comply with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
1. Information We Collect
1.1 Account & Authentication
- Display name and email address
- Google account identifier (when you sign in with Google)
- Google profile picture, if you sign in with Google. We store the web address Google gives us for that picture, and separately the address of whichever avatar you choose to display — both as links, not as copies of the image itself. You can change your avatar at any time from your profile.
- Phone number (when you verify a phone to receive SMS notifications)
- Authentication events (sign-ins, sign-outs, device descriptors)
1.2 Service Usage
- Games you create or join (cash-game and tournament records)
- Player roster, buy-ins, buybacks, and settlement data you record
- Invitations sent or received
- Profile preferences
1.3 Technical Data
- IP address, device type, and browser identifiers
- Approximate geolocation derived from IP (used for security signals)
- Error logs and performance traces
2. How We Use Your Information
- To authenticate you via Google OAuth, Twilio Verify, or Resend magic links
- To operate Hold'em Pitboss and synchronize game state across devices
- To send transactional notifications (invitations, sign-in alerts, account changes)
- To detect and prevent abuse, fraud, and unauthorized access
- To improve the service through aggregate usage analytics
- To comply with legal obligations
3. SMS Communications
If you verify a phone number and opt in to SMS notifications, we use your phone number solely to send you transactional text messages related to your Hold'em Pitboss games.
- Data we collect: the phone number you verify and a timestamped record of when you opted in.
- How we use it: to deliver transactional SMS such as game invitations, schedule changes, cancellations, reminders, and host accept notifications. We do not use your phone number for marketing.
- Sharing: we share the phone number with our messaging provider (Twilio) strictly to deliver the messages above. We do not sell or share it for third-party marketing purposes.
- Frequency: message frequency varies based on your game activity.
- Cost: Msg & data rates may apply, depending on your mobile carrier and plan.
- How to opt out: reply STOP to any message, or turn SMS off in your profile under SMS notifications. You can also remove your phone number from your profile at any time.
- Help: reply HELP to any message, or contact support@holdempitboss.com.
4. Sub-processors & Data Sharing
We do not sell or rent personal information. We share specific data with the following sub-processors strictly to operate the service:
- Google — OAuth sign-in (identity verification)
- Twilio — Phone number verification and transactional SMS notifications about your games
- Resend — Transactional email delivery (magic links, notifications)
- MongoDB Atlas — Database hosting
- Railway — Application and static site hosting
- Plausible Analytics — Cookieless aggregate usage analytics
We may also disclose information when legally required (court orders, lawful subpoenas) or to protect the rights, property, or safety of users and the public.
5. Data Security
- Encryption of data in transit (TLS) and at rest where supported
- Strong authentication via OAuth, OTP, and magic-link flows (no stored passwords)
- Per-device session tracking and the ability to revoke devices
- Audit logging for sensitive account actions
6. Cookies & Tracking
We set no cookies of our own. To keep you signed in, we store a session token and your basic account details in your browser's local storage. This is strictly necessary to operate the service, and it is removed when you sign out. We also store display preferences, such as which columns you have chosen for a crew's standings table, so the interface looks the same on your next visit.
We use Plausible Analytics to measure aggregate usage of the service. It is cookieless: it stores nothing on your device, does not track you across other websites or apps, and does not build a profile of you. Page addresses are stripped of identifiers before they are sent, so visits are counted without recording which game, crew, or invitation you looked at. We do not run advertising scripts and we do not set tracking cookies.
One third party does set cookies, and not on our behalf. Opening the sign-in page loads Google's sign-in script, which may set cookies on accounts.google.com, its own domain. We cannot read them and they are governed by Google's privacy policy, not this one. This happens as the page loads, before you choose anything, so it applies whichever method you go on to use.
7. Your Rights
Under GDPR and CCPA, you have rights to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your account and associated data
- Port your data in a structured format
- Restrict or object to certain processing
- Withdraw consent at any time
To exercise these rights, email support@holdempitboss.com.
We respond to a rights request within one month of receiving it, as required by Article 12(3) of the GDPR. If a request is unusually complex we may extend that by a further two months, and we will tell you within the first month if we do. Deleting your account does not require a request — you can do it yourself from your profile at any time.
8. Data Retention
We keep your account and game records for as long as your account exists. You can delete your account yourself at any time from your profile; we act on it straight away rather than waiting out a period.
Security and account-activity logs are kept to fixed periods, and the period depends on what the record is for:
- Sign-in and security activity: 90 days. Records of sign-ins, failed sign-in attempts and similar security signals, kept so we can investigate account compromise and abuse. These carry a coarse network address (never your exact one) and a short description of your browser.
- Records of account decisions: 730 days. Evidence that a consequential action happened and who took it — a deletion honoured, a data export fulfilled, a consent recorded, a sign-in method added or removed. These are kept so we can show we handled your requests correctly, and they do not carry your network address. A separate entry logs the administrative action itself, and that one does keep a coarse network address for the staff member who acted, so administrative access is accountable.
One thing does outlast your account, deliberately. Games you played in belong to the other players too, so a placeholder record stays behind to keep their history intact — it is what shows as “[Deleted User]” in a past game. It carries no name, email, phone number, profile picture or sign-in details; those are erased. What remains is an internal reference and the date the account was deleted.
Deleting your account removes your data from the live service straight away, but it does not reach the encrypted daily backups we keep so the service can be restored after a failure. Those backups expire on a rolling 8-day cycle, so that is the outer limit on when the last copy of your data is gone. We never restore a backup to undo a deletion, and the data in one is not used for anything else while it waits to expire.
After a deletion request, your sign-in and security records are shortened to a brief window and then removed. The records showing that your deletion was carried out are kept for the period above — deleting them would destroy the evidence that we did what you asked.
9. Children's Privacy
The Service is not intended for users under 18. We do not knowingly collect personal information from anyone under that age. If you believe we have, contact us and we will delete the information promptly.
10. International Transfers
Data is processed and stored in facilities operated by our hosting providers, primarily in the United States. Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where the UK GDPR applies), which each of our sub-processors has entered into. You may request a copy of the relevant clauses by writing to us at the address in the Contact section.
11. California Privacy Rights (CCPA)
California residents have additional rights under the CCPA, including:
- Right to know what personal information is collected and how it is used
- Right to know whether personal information is sold or disclosed (we do not sell)
- Right to delete personal information
- Right to non-discrimination for exercising these rights
12. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated by email or via the service. Continued use after the effective date constitutes acceptance.
13. Contact
Hold'em Pitboss
Email: support@holdempitboss.com
Address: Available upon request via email