Privacy Policy

Last updated: September 2026

1. Introduction

This Privacy Policy explains how Street Poker collects, uses, stores, and protects your personal information when you use our poker analytics platform. We are committed to safeguarding your privacy and being transparent about our data practices.

2. Information We Collect

We collect the following types of information:

3. How We Use Your Data

We use your data to:

4. Uploaded Hand Histories & Product Improvement

You are responsible for making sure you have the right to upload and analyze any hand histories you provide. You retain ownership of those hand histories.

We may use uploaded hands to provide your requested analytics, detect bugs, tune features, and improve the service. When hand histories are used for product improvement beyond your direct analysis, we use de-identified or aggregated data where possible and honor any opt-out or consent settings available in the app.

We do not sell hand histories. We do not publish your raw hand histories or personal account details without your permission.

5. Data Storage

Client-side: Your hand history files and app settings are stored locally in your browser using localStorage and IndexedDB, and the files themselves are never uploaded. If you are signed in, a summary of your own ranges built from your imported hands is saved to your account so it follows you between devices.

Server-side: When you are signed in, your data is stored on Supabase infrastructure with encryption at rest. All data in transit is protected with TLS encryption.

Payment data: We do NOT store any payment information. All payment processing is handled securely by Stripe, our PCI-compliant payment processor.

6. Data Sharing

We do NOT sell your data. We do NOT share your personal information with third parties except for the following service providers, each operating under strict data processing agreements. Each provider receives only the data it needs for its function and is contractually required to protect it to a standard at least equal to this policy:

Breached-password check: When you create an account, your browser asks Have I Been Pwned's Pwned Passwords service whether the new password has appeared in a known data breach. It sends only the first five characters of the password's SHA-1 hash, which many passwords share. Your password, the rest of its hash and your email address are not sent.

7. Coach, Analytics & Error Telemetry

Coach: The Coach is an authenticated, server-proxied feature. Messages may include hand histories, player context, and notes that you choose to provide. Do not submit information you are not authorized to disclose. The service applies server-side subscription and usage controls.

Analytics: Vercel Web Analytics is configured as a deployment feature rather than an advertising profile.

The Street Poker iPhone app does not load PostHog or Vercel Web Analytics and records no session replays. Hand-history files you open in the app are read on your device and are not uploaded, and the Coach is available on the website only.

Product analytics (PostHog): The website (streetpoker.pro) sends page views, clicks, named product events (such as sign-up, hand upload, simulator use, drill results and checkout steps), JavaScript errors and session recordings to PostHog, hosted in the United States. Recordings mask what you type into form fields and your name in the header, but can show other content on screen, such as player names from hand histories you upload. When you sign in we attach your account ID and plan so we can tell free and paid use apart; we do not send your name or email. We use this to see which features people use, find bugs and improve the product, not for advertising. Session recordings are kept for 30 days. To opt out, turn on Do Not Track in your browser (we honor it), use the button below, or contact us.

Error telemetry: The client error beacon is capped per session and the server applies rate limits.

8. Your Rights (GDPR)

Under applicable data protection laws, you have the following rights:

To exercise any of these rights, contact us at privacy@streetpoker.pro.

You can also exercise these rights directly from your account: on the website, Settings → Data & Privacy → Privacy & Account; in the iPhone app, Settings → Delete account.

9. California & U.S. State Privacy Rights

If you are a resident of California or another U.S. state with a comprehensive privacy law, you have the right to know what personal information we collect about you, to access it, to correct it, to delete it, and to receive it in a portable format. You also have the right not to be discriminated against for exercising any of these rights.

We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising, and we have not done so in the preceding 12 months. The categories of personal information we collect (identifiers such as name and email, commercial information such as subscription records, and internet activity such as in-app feature usage) and the purposes we use them for are described in Sections 2 and 3 above.

To exercise these rights, use Settings → Data & Privacy in the app or contact us at privacy@streetpoker.pro. We verify requests through your authenticated account. An authorized agent may submit a request on your behalf.

10. Cookies & Local Storage

We use essential browser storage (localStorage and IndexedDB) for core app functionality. These records remain on your device until you clear them or use the app’s data controls. The hosted app also loads Vercel Web Analytics when that deployment feature is enabled. PostHog stores an anonymous ID and session ID in a first-party cookie and localStorage (named ph_…_posthog) so visits can be counted and linked to one session. We do not use advertising cookies.

11. Data Retention

Active accounts: Your data is retained for as long as your account remains active and you continue to use the service.

Deleted accounts: You can delete your account at any time (in the iPhone app: Settings → Delete account). This permanently removes your profile, leaderboard entries and progress, deletes your login, and cancels any active subscription. The deletion workflow records its progress and retries the Stripe, storage and authentication steps until each one succeeds.

Withdrawing consent: You can withdraw consent at any time by deleting your account, by signing out (the app then keeps your progress only on your device), or by emailing privacy@streetpoker.pro.

On-device data: Bankroll sessions, venue location history, friends and imported files stay on your device until you remove them. The Clear local data control in Settings deletes your Quest progress, bankroll, friends, uploads, sessions and location history in one action, and uninstalling the app removes them with it. Removing on-device data does not require an account deletion request.

12. Security

We implement industry-standard security measures to protect your data, including encryption at rest and in transit, secure HTTPS connections for all communications, and regular security reviews of our infrastructure and codebase.

13. Children's Privacy

Street Poker is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a user under 18, we will promptly delete that information.

14. Changes

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

15. Contact

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at privacy@streetpoker.pro.