♠ Poker Night

Privacy Policy

Last updated: 22 September 2026 · Version 1.0

Draft for legal review. Not reviewed by a lawyer. Check against the Digital Personal Data Protection Act 2023 and its Rules (once notified), the IT Act 2000 and the IT (Reasonable Security Practices) Rules 2011, and — if you have users there — the EU/UK GDPR and other applicable laws. Confirm every third party, data location, and retention period below is accurate for your actual setup before publishing.

This Privacy Policy explains what personal data Harshit Mittal ("we", "us") collects when you use Poker Night (the "Service"), why, who we share it with, how long we keep it, and the rights you have. It forms part of our Terms of Service.

1. The short version

No account = nothing leaves your device. Without an account, all your games and notes are stored only in your browser's local storage. We never receive them.
An account stores your email and syncs your data to our servers so you can use it on more than one device.
We use a small number of processors: a hosting/database provider, a payment processor, an AI provider (only when you use an AI feature), and a website host/CDN.
We do not sell your data, do not run advertising, and do not use your content to train AI models.
You can export or delete your data at any time.

2. Who is responsible for your data

The Data Fiduciary (controller) for personal data processed through your account is:

Harshit Mittal
28 Tarun Enclave, Pitampura, New Delhi, Delhi 110034, India
Email: support@poker-study.com

Where you enter information about other people (the players in your game — their names, notes, results), you are the fiduciary for that information and we act as a Data Processor on your instructions. See section 9.

3. What we collect

3.1 If you use Poker Night without an account

Your games, results, player names and notes, custom ranges, tournament structures, and settings are stored in your browser using localStorage on your device. This data is not transmitted to us. The website is served as static files; our host may log standard technical request data (see 3.4).

3.2 Account data

Data	Why
Email address	To create your account, sign you in (one-time codes / links), send service and billing notices, and respond to support.
Display name and (optional) avatar	To show who you are in shared games and on your account screen.
Sign-in method identifiers (if you use Google or Apple sign-in)	To link your login to your account. We receive a stable identifier and your email/name from the provider; we do not receive your password.
A device identifier we generate	To sync reliably across your devices and resolve conflicts. It is not linked to any hardware ID and stays on the device.

3.3 Content you sync

When you have an account, the data described in 3.1 is copied to our servers so it is available on your other devices and can be restored. This includes anything you choose to type in: game names, buy-in and cash-out amounts, chip counts, settlement records, tournament data, and free-text notes about players. Only put information here that you are comfortable storing and that you are entitled to record about other people.

3.4 Technical and usage data

Log data from our website host and backend: IP address, approximate location derived from it, browser and device type, pages/endpoints accessed, timestamps, and referrer. Used for security, abuse prevention, debugging, and understanding load.
Error reports: if the app hits an error, it may send us a diagnostic record (error message, a stack trace, the app version, and coarse context such as which screen you were on). We aim to keep personal data out of these; occasionally a note or name could appear in a stack trace.
Feature usage counters needed to enforce plan limits and meter AI usage (for example, how many games are synced, how many AI requests you have made this month).

3.5 Payment data

If you subscribe to Pro, payment is processed by Dodo Payments (Dodo Payments Inc.), who acts as the merchant of record for your subscription. Dodo collects and processes your card, UPI, or bank details directly — we do not see or store your full payment details. We receive from Dodo a payment/subscription identifier, the status, the amount, the last 4 digits or payment-method type, and the billing contact you provide, which we keep for accounting, tax, and fraud-prevention purposes.

3.6 AI feature inputs

If you use an AI feature (for example, "ask the coach about this hand"), the specific information you submit for that request — such as the hand history you paste or select — is sent to Anthropic to generate a response. See section 6.

4. Why we process your data and our legal basis

Purpose	Basis (DPDP / GDPR where relevant)
Create and operate your account; sync and restore your data	Performance of our contract with you / necessary for the specified purpose you signed up for
Process payments, issue invoices, prevent payment fraud	Contract; legal obligation (tax and accounting law)
Provide support and respond to your requests	Contract; your request
Keep the Service secure; detect and prevent abuse	Our legitimate interest / legitimate use in a secure Service
Fix bugs and improve the Service using aggregated, de-identified data	Legitimate interest
Send service messages (security, billing, material changes)	Contract; legal obligation
Send optional product updates or tips, if we ever offer them	Your consent — you can withdraw it any time
Run an AI feature you invoke	Your request / consent for that feature

We do not sell personal data and do not share it for advertising. We use the following processors, each under a contract that limits them to processing data on our instructions:

Provider	Role	Data	Location
Supabase	Database, authentication, file storage, backend hosting	All account data and synced content	Mumbai, India
Cloudflare	Website hosting, CDN, DDoS protection	Technical request/log data	Global edge network
Dodo Payments	Payment processing for Pro subscriptions (merchant of record)	Payment details you enter with them; billing contact	United States
Anthropic	AI model provider for AI features	Only the content you submit to an AI feature, plus a request identifier	Not yet in use — reserved for a future AI coach feature (Anthropic, United States)
Google / Apple	Optional sign-in providers	Only if you choose that sign-in method	Global
TBD — set once a transactional-email provider is configured	Sending sign-in codes and service emails	Your email address and message content	India / global (provider-dependent)

We may also disclose data:

to comply with a valid legal request, court order, or law;
to enforce our Terms or protect the rights, safety, or property of us, our users, or the public;
to a successor entity in a merger, acquisition, or sale of assets, under confidentiality obligations and with notice to you.

6. More about AI features

AI features are optional and only run when you trigger them.
The content you submit is transmitted to Anthropic's API to generate a response and is returned to you. We keep a short record that a request was made (for metering and support) and may retain the request and response for a limited period to investigate abuse and improve prompts.
Per Anthropic's API terms, your inputs and outputs are not used to train their models. Anthropic may retain data briefly for trust-and-safety purposes as described in its policies.
Do not submit sensitive personal data, other people's personal data, or confidential information into AI features.

7. International transfers

Some processors listed above store or process data outside India (for example, Anthropic in the United States, and possibly Supabase or the email provider depending on the region selected). Where we transfer personal data across borders, we do so in accordance with the DPDP Act and, for data subject to the GDPR, under appropriate safeguards such as Standard Contractual Clauses. By using the Service you understand that your data may be processed in these locations.

8. How long we keep data

Data	Retention
Account and synced content	While your account is active. Deleted within 30 days of you deleting your account, except items subject to a longer period below.
Backups	Rolling backups are retained for up to 30 days and then overwritten; deleted data disappears from backups within that window.
Payment and invoice records	Up to 8 years as required by Indian tax and company law. These are pseudonymised where possible after your account is closed.
Server and security logs	Typically 60 days, longer if needed for an active security investigation.
AI request records	60 days for abuse monitoring, then deleted or aggregated.
Support correspondence	2 years from the last contact.
Local data on your device	Stays until you clear it, sign out (which wipes it from that device), or your browser evicts it.

9. Your rights

Subject to applicable law, you can ask us to:

Access the personal data we hold about you and get a summary of how it is processed and shared;
Correct or update inaccurate or incomplete data;
Erase your data and close your account;
Export your data — you can do this yourself at any time from the app's backup/export feature;
Withdraw consent for any processing based on consent (this does not affect processing already carried out);
Nominate another individual to exercise your rights in the event of your death or incapacity (DPDP Act);
Object to or restrict certain processing, and, where the GDPR applies, complain to a supervisory authority.

To make a request, email support@poker-study.com. We will respond within the timeframe required by law (and in any case aim for 30 days). We may need to verify your identity first. There is no fee unless the request is manifestly unfounded or excessive.

Requests about another person's data you entered: if someone contacts us about information a Poker Night user recorded about them, we will refer them to that user (the fiduciary) and help facilitate the request as processor.

10. Grievance Officer

In accordance with the DPDP Act and the IT Rules, our Grievance Officer is:

Harshit Mittal
Harshit Mittal
28 Tarun Enclave, Pitampura, New Delhi, Delhi 110034, India
Email: support@poker-study.com
We aim to acknowledge grievances within 48 hours and resolve them within 30 days.

If you are not satisfied with our response, you may escalate to the Data Protection Board of India (once operational) or the relevant authority in your jurisdiction.

11. How we protect data

Data in transit is encrypted with TLS. Data at rest in our database and backups is encrypted by our hosting provider.
Access to production data is limited to people who need it, protected by authentication and, where available, row-level security so one account cannot read another's data.
Payment details are handled by a PCI-DSS-compliant processor, not by us.
We keep dependencies updated and follow reasonable secure-development practices.
No system is perfectly secure. If a data breach occurs that is likely to cause you harm, we will notify you and the relevant authority as required by law.

12. Children

The Service is intended for adults (18+) and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

13. Cookies and local storage

We use localStorage and similar browser storage to make the app work — to hold your games offline, remember your settings, and (when signed in) keep your session token. This is essential to the Service.
We do not use third-party advertising or cross-site tracking cookies.
Our website host and any privacy-friendly analytics we enable may set a minimal first-party cookie or use cookieless measurement for aggregate traffic stats. If we add analytics, this policy will name the provider.

14. Changes to this policy

We may update this policy. We will post the new version here with a new date and, for material changes, notify you by email or an in-app notice before it takes effect.

15. Contact

Questions about this policy or your data: support@poker-study.com
Data rights and grievances: support@poker-study.com
Post: 28 Tarun Enclave, Pitampura, New Delhi, Delhi 110034, India