Privacy Notice
Last updated: 18 October 2026
TO BE REVIEWED BY A LAWYER. This draft aims to follow the UK GDPR, the EU GDPR and common US state privacy laws, but it has not been reviewed.
What we collect
| Who | What | Why |
|---|---|---|
| Hosts | Email address, display name, password (stored only as a one-way hash), sign-in times | To run your account and send sign-in and verification emails |
| Players | Display name chosen by the host or player, optional photo, password hash | To show you at the table and let you sign in |
| Everyone | IP address and browser details for active sessions; security logs | To keep accounts secure and stop abuse |
| Rooms | Game actions, point changes (the ledger), reports | To run the game, let hosts verify points and handle reports |
We do not collect payment details, we do not sell personal data, and we do not use advertising trackers.
Cards dealt in a hand are encrypted at rest and never shown to other players unless revealed by the game rules.
Voice
Voice chat is peer-to-peer between browsers. Audio is not recorded or stored by us. When a direct connection is not possible, audio may pass through a relay (TURN) server in encrypted form.
Lawful bases (UK/EU)
- Contract: to provide the service you asked for.
- Legitimate interests: security, abuse prevention and keeping the ledger accurate.
- Consent: optional photos, which you can remove at any time.
How long we keep data
- Rooms and their ledgers are deleted after the retention period set by the operator (30 days after a room ends by default).
- Deleting a host account closes its rooms, deletes its roster and signs everyone out.
- Security logs are kept for up to 90 days.
Your rights
You can ask to access, correct, export or delete your personal data, and you can object to or restrict some processing. Hosts can delete their account from Settings. Players can ask their host, or contact us via "Report a problem". In the UK you may complain to the ICO; in the EU, to your local supervisory authority. California and other US state residents have similar rights to know, delete and correct, and the right not to be discriminated against for using them. We do not sell or share personal information for cross-context behavioural advertising.
Children
The service is not for children. Hosts must be 18 or older.
International transfers
Data is hosted in the region chosen by the operator (London by default). Where data leaves the UK/EU, appropriate safeguards are used.