Privacy Policy

1. Introduction

Poker Sense (“we,” “us,” or “our”) respects your privacy and is committed to protecting your personal information. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

This policy applies to all users of the Poker Sense application and website at pokersense.app.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address — used for authentication (one-time codes) and essential communications
• Your device’s time zone and language — read once, the first time you sign in, so a reminder arrives at a reasonable hour and in a language you read. You can change the language at any time, and we do not read your location

We do not ask for your name. We use passwordless authentication, so we do not collect or store passwords.

2.2 OAuth Data

If you sign in via Google or Apple OAuth, we receive:

• Your email address
• A unique provider identifier

We do not receive or store your OAuth provider password or access tokens beyond what is needed for authentication.

2.3 Training Data

When you use the Service, we collect:

• Training decisions — the poker hands you play, the actions you choose, and the GTO feedback for each hand
• Session data — when you train, how many hands per session, and your configuration preferences
• Progress metrics — accuracy rates, EV loss trends, and identified leak patterns

This data is essential to the core functionality of the Service: tracking your progress and providing personalized feedback.

2.4 AI Coaching Conversations

When you use the “Ask Why” coaching feature, your conversation is sent to our AI provider (Anthropic’s Claude API) for processing. This includes:

• The poker hand context (cards, board, positions, stack sizes)
• Your conversation messages and the AI responses
• Token usage for billing and rate limiting

We retain coaching conversation data to provide conversation history within a session. We do not use your coaching conversations to train AI models.

2.5 Usage Data

We automatically collect:

• Device type and browser information
• IP address (used for security and rate limiting, not stored long-term). Our analytics provider sees it too, and derives an approximate location from it — a country, region and city, never a precise one — without keeping the address or attaching it to your account
• Pages visited and feature usage patterns
• Error logs and performance data
• Which reminders we sent you and on which channel, and — for an email — whether it was delivered, opened, clicked or unsubscribed from, and whether it bounced or was reported as spam. Kept against your account alongside the message we sent. A push notification is recorded the same way, with the devices it went to and whether each one accepted it

2.6 Feedback and Ratings

When you send us feedback or rate an AI coaching answer or a hand verdict, we collect:

• Your message — the text you write in the feedback form
• Rating comments — the optional note you attach to a rating, and the hand it was about
• The rated conversation — rating a coaching reply stores the whole conversation that reply came from, not just the reply, because an answer can only be judged in the context that produced it

A conversation you rate is kept with the rating for as long as your account exists, unlike an unrated one. Feedback and thumbs-down ratings are also emailed to our own support address when you send them, so a person sees them; so are notices that you signed up, that your billing changed, and summaries of errors your client reported. We use all of this to reply to you, fix bugs, and improve the quality of coaching and feedback.

2.7 Push Notifications

If you allow notifications on your phone, the Poker Sense app registers that device with us so the reminders you have turned on can arrive there instead of by email. We store, against your account:

• The device’s push token — the identifier Apple or Google issues for that installation of the app, and the only thing a notification can be addressed to
• The platform, the app version and the device’s language — so the notification is sent to the right service and written in a language you read
• When the device was last seen — the time of the last registration that reached us. The app re-registers as it runs, so this moves while you are using it and stops when you are not
• Which notification categories you want — the switches on Settings → Notifications. Streaks, practice and the weekly summary start on. Tips and offers is promotional and starts off. The app offers that switch where it has an upgrade for you, and keeps showing it wherever you have already turned it on, so it only ever sends because you asked for it and you can always turn it back off

The app never asks at first launch. It offers the permission by itself only after your first completed training session, and you can also ask for it earlier from Settings → Notifications if you want to. Either way nothing is registered unless you allow it. The notifications themselves are the reminders in section 3, and their text can name your hand count, accuracy, streak, days away and the position costing you the most, exactly as the reminder emails do.

Signing out of the app on a device tells us to stop sending to it. If that message cannot reach us — the phone is offline, or the session had already expired — that device keeps receiving notifications until you sign in on it again, or until Apple or Google report the token as no longer valid, which is what an uninstalled app reports; either way we disable it the moment we find out. The one thing that always works on the handset itself is turning Poker Sense notifications off in your phone’s own settings, which stops it showing them whatever the account is set to. The stored device record is erased when you delete your account (see 7.1); section 7 covers turning individual categories off and what happens to a reminder when you do.

3. How We Use Your Information

We use your information to:

• Provide the Service — authenticate your account, deliver training hands, generate AI coaching responses, track your progress
• Improve the Service — analyze aggregate usage patterns to improve features and fix issues
• Communicate with you — send authentication codes, service updates, and (optionally) training reminders and tips, by email or, if you have allowed them, as push notifications on your phone
• Enforce our Terms — detect violations such as automated access or real-time use during live play
• Process payments — coordinate with our payment processor for subscription billing
• Credit referrals — if someone referred you, we email them when you start a trial and when you subscribe. That message does not name you or give them your email address

We do NOT:

• Sell your personal information to third parties
• Use your training data for advertising
• Share your training data, coaching conversations or feedback with other users
• Use your coaching conversations to train AI models

4. Third-Party Services

We use the following third-party services:

Service	Purpose	Data Shared
Anthropic (Claude API)	AI coaching conversations	The hand, board, positions, stacks and betting line, the solver’s frequencies and your result, your messages, and the language to answer in. No email address, account ID or payment data
Google, Apple	OAuth sign-in	Whichever provider you choose sees that you signed in to Poker Sense, and returns your email address and an identifier for you
Plausible Analytics	Product analytics	Event name and its properties (training type and hand count; plan tier, billing period and whether a checkout is new or a plan change; which reminder a notification you tapped was, and whether you allowed or refused the notification permission), screen, platform, app version, and the IP address and user agent that any request carries. Plausible turns those into a rotating daily visitor hash and a country, region and city for its dashboard, and does not store them. No account identifier
Payment processor	Subscription billing	Email, and the payment and billing-address details the processor collects at checkout, never us. Also checkout metadata: our internal account ID, the plan’s price ID, and on a lifetime upgrade the subscription it replaces
Email delivery service	Authentication codes, billing notices, training reminders, and the notifications we send ourselves	Your email address and the contents of every message: one-time codes; billing notices; reminders carrying your hand counts, accuracy, streak, week-over-week change and the position costing you the most; the feedback and rating text you submit; notices naming your account on signup and on a billing change; and error diagnostics. Reminders and campaigns carry an unsubscribe link containing your account ID
Hosting provider (AWS)	Infrastructure	All data (encrypted at rest and in transit)
Apple Push Notification service	Delivering push notifications to iPhone and iPad	The device’s push token and the whole notification: its title and body — which can name your hand count, accuracy, streak or worst position — the in-app screen a tap opens, and a label naming which reminder it is, so an undelivered one can be replaced rather than queued behind. Nothing else: no email address, no account ID, no payment credentials or billing identifiers, and none of your training records beyond the figures the notification itself quotes. A tips-and-offers notification is about upgrading, so its text does reveal that you are on the free plan
Google Firebase Cloud Messaging	Delivering push notifications to Android	The same, for Android devices: the token, the notification’s text, its destination screen and its reminder label, and nothing else

Each third-party service is subject to its own privacy policy. We select providers with strong privacy and security practices.

5. Data Security

We protect your data with:

• Encryption at rest — sensitive data (authentication codes, OAuth tokens) is encrypted with AES-256-GCM before storage
• Encryption in transit — all data is transmitted over HTTPS/TLS
• Passwordless authentication — eliminates the risk of password breaches
• Access controls — internal access to user data is restricted to authorized personnel
• UUID v7 identifiers — user IDs are non-sequential, preventing enumeration attacks

6. Data Retention

• Account data — retained while your account is active; erased when you delete your account
• Training data — retained while your account is active to provide progress tracking; erased when you delete your account
• Coaching conversations — retained for the duration of the training session; conversation history is not stored indefinitely. A conversation you rate is the exception: it is kept with the rating until you delete your account (see 2.6)
• Usage logs — retained for up to 90 days for security and debugging purposes
• Administrative records — an entry recording an action an administrator took on your account is erased with the account, whether it is keyed by your account ID or by your email address
• Push device records — kept until you delete your account. Disabling one stops us sending to it, and it does not remove the record: the row, its token and its timestamps stay, marked disabled and with the reason. We disable as soon as we are told to or find out we should — a sign-out that reaches us, or a token Apple or Google report as no longer valid — and a sign-out that does not reach us leaves the device enabled until one of those happens (see 2.7)
• Email already delivered — feedback, thumbs-down ratings, signup and billing notices and error digests reach our own support mailbox as they happen and can name your email address or account ID, and a referral notification reaches the mailbox of whoever referred you. That last one names nobody, but it cannot be recalled either. All of these are kept under ordinary mailbox retention and are not reached by account deletion
• Payment records — retained as required by applicable tax and financial regulations

7. Your Rights

You have the right to:

• Access your data — request a copy of the personal information we hold about you
• Delete your account — delete your account and associated data yourself, at any time (see 7.1 below)
• Export your data — request an export of your training history and progress data
• Opt out of communications — unsubscribe from optional emails (authentication emails cannot be opted out of), and choose which push notifications you get, category by category, at Settings → Notifications in the mobile app
• Stop notifications on a device — turn Poker Sense notifications off in your phone’s own settings, which stops that phone showing them whatever the app is set to.
• Correct your data — ask us to correct anything we hold about you. Your email address is the account, so changing it is not self-service: contact us at privacy@pokersense.app

Push and email are one channel per reminder, not two. A reminder arrives as a notification when its category is on and your phone can receive one, and by email otherwise. Turning a category off at Settings → Notifications therefore moves those reminders to email rather than stopping them; unsubscribing from reminder emails is what stops them altogether. Turning notifications off in your phone’s settings stops the phone showing them, and does not move them to email.

To exercise the rights that are not self-service, contact us at privacy@pokersense.app. We will respond within 30 days.

7.1 Deleting Your Account

You can delete your account yourself, at any time, from Settings → Delete Account in the Poker Sense app on iOS, Android and the web.

Deletion is immediate and permanent. Your account record, training history, statistics, streaks, coaching conversations, the feedback and ratings you have sent, your email preferences, and the notification devices and category settings described in 2.7 are erased, and any active subscription is cancelled and purchased lifetime access is lost, with no refund. We cannot restore a deleted account, and neither can support: signing up again later starts a new, empty account rather than reopening the old one. Deletion cannot recall an email that has already been delivered: feedback, thumbs-down ratings, signup and billing notices and error digests reached our own mailbox as they happened, and a referral notification, which names nobody, reached the person who referred you. Those copies are covered by section 6 instead.

If you cannot reach the app, email privacy@pokersense.app and we will delete the account for you.

8. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information:

• Right to know — you may request that we disclose what personal information we collect, use, and share about you
• Right to delete — you may request deletion of your personal information, subject to certain exceptions
• Right to opt-out of sale — we do not sell your personal information to third parties. We have never sold personal information and have no plans to do so.
• Right to non-discrimination — we will not discriminate against you for exercising your CCPA rights

To exercise any of these rights, contact us at privacy@pokersense.app.

9. Children’s Privacy

Poker Sense is not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from individuals under 18. If we become aware that we have collected data from a minor, we will delete it promptly.

10. Cookies and Tracking

The Poker Sense application uses:

• Essential cookies — required for authentication and session management
• No advertising cookies — we do not use advertising trackers
• Cookieless analytics — we use Plausible Analytics, which sets no cookies, collects no advertising identifier, and does not build a profile of you across other sites or apps. Analytics events are not linked to your account
• No advertising identifiers in the mobile apps — the iOS and Android apps request no tracking permission and use no advertising ID. The push token in section 2.7 is not one: it addresses a notification to one installation of this app, it is never joined to data from another company, and it goes nowhere but Apple’s and Google’s delivery services

11. International Data Transfers

Our servers are located in the United States. If you access the Service from outside the US, your data will be transferred to and processed in the US. By using the Service, you consent to this transfer.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised “Last Updated” date. Material changes may also be communicated via email.

8 September 2026 — the mobile app can now deliver reminders as push notifications. Section 2.7 describes the device push token and the settings stored for it, and section 4 names two new processors, Apple’s Push Notification service and Google’s Firebase Cloud Messaging, which carry those notifications to your phone.

13. Contact

For privacy-related questions or requests:

Email: privacy@pokersense.app