Privacy

The operator of CashGameDBdecides what is collected here and why. Every data protection request — access, correction, erasure, objection — goes to [email protected], and is answered within one month.

We have not appointed a data protection officer; the scale and nature of what we process does not call for one.

Email address

Identifies your account and is how we reach you about it. Required. You must confirm it before the account works, which stops someone registering an address that is not theirs.Art. 6 (1) (b) — performance of the contract

Password

Stored only as a hash. We never hold the password itself and cannot recover it — a reset replaces it.Art. 6 (1) (b), and Art. 32 for the hashing

Sessions

One row per signed-in browser, holding a SHA-256 digest of the session token, never the token itself, plus its expiry. A stolen database yields nothing anyone can sign in with.Art. 6 (1) (b)

Device handle

A random opaque value in a cookie. It is not a fingerprint: it is generated by us, means nothing anywhere else, and is used only to tell one of your browsers from another so the device limit can sign out the least recently used one instead of refusing the newest login.Art. 6 (1) (f) — our interest in preventing account sharing

Notes and watchlists

What you write about a player, and which players you follow. Visible only to you.Art. 6 (1) (b)

Display preferences

Which panels you have switched off and which statistics you want in the headline strip.Art. 6 (1) (b)

Subscription and payments

Which plan you hold, the period it covers, and a reference issued by the payment provider. We do not receive or store your card number.Art. 6 (1) (b), and Art. 6 (1) (c) for the records tax law requires us to keep

Support messages

What you send us, so we can answer it.Art. 6 (1) (b) / (f)

• •IP addresses — the application does not log them
• •analytics of any kind: no Google Analytics, no Plausible, no self-hosted equivalent
• •advertising or marketing identifiers, and no third-party scripts, pixels or social plugins
• •your real name, address, date of birth or any identity document
• •your card or bank details, which go to the payment provider and never reach us
• •anything about which poker rooms you personally play at, unless you tell us in a support message

Because there is no analytics or advertising, there is nothing to ask your consent for — which is why this site has no cookie banner. See §5.

Plans include a number of distinct players you may look up in a rolling 24-hour window, so that number has to be counted. The count lives in Redis, keyed to your account, and every key carries a time-to-live: entries older than the window are dropped as the window moves, and nothing is swept up later because nothing outlives its own expiry.

It is not kept as a history, it is not analysed, and it is not used for anything except deciding whether your next lookup is inside your plan.

Session cookie

Keeps you signed in. Strictly necessary — without it there is no account.

pokerdb_device

The opaque device handle from §2. Strictly necessary for the device limit that protects the subscription you are paying for.

Theme (local storage)

Which colour theme you picked. Set by your own click, kept in your browser, never sent to us.

All three are strictly necessary for a service you asked for, so no consent is required for them and none is requested. We set no other cookies, and there is nothing here that consent would be about.

Hosting

A third-party hosting provider runs the servers the application and its databases sit on. It has no reason to look at the data and no role in what we do with it.

Email

Our transactional mail provider sends confirmations, password resets and receipts. It receives your email address and the content of those messages, and nothing else.

Payments

— TO BE COMPLETED — handles the transaction and holds your payment details under its own privacy policy. We receive confirmation that a payment succeeded and a reference for it.

Each acts under a data processing agreement. We share your data with nobody else, and we sell it to nobody. We disclose it to an authority only where the law obliges us to.

7.1 What we hold.A screen name, the room it plays at, the stakes and dates it was seen at, and counts of the actions it took in hands that have finished — how often it raised first in, folded to a three-bet, and so on. Aggregated figures, not a transcript.

7.2 What we do not hold, and cannot. We do not know who is behind a screen name. We hold no real names, no email addresses, no locations, no payment details, and no way to connect a screen name to a person. A screen name is personal data because the room could identify its owner; we cannot.

7.3 Where it comes from (Art. 14 (2) (f)): hand histories of completed cash games, recorded and shared by players who sat in those hands. We do not obtain them from the poker rooms.

7.4 Why we consider it lawful (Art. 6 (1) (f)). Our interest is in operating a database that helps players understand the games they are in. Weighed against that: the actions recorded were taken in public at a table where every other participant saw them and could write them down; they are attached to a pseudonym the player chose; and they concern how a hand was played, not who the player is. No special-category data under Art. 9 is involved. We consider the interference limited — but this is a balance, and §7.6 exists because a balance can come out differently for you.

7.5 Why you were not told directly (Art. 14 (5) (b)): we have no contact details for any player and no means of obtaining them. Notifying each one is impossible rather than merely burdensome, so this page is the notice, and it is public.

7.6 Your right to object (Art. 21 (1)). You may object at any time on grounds relating to your situation. We then stop processing unless we can show compelling legitimate grounds that override your interests. In practice: tell us the screen name and the room at [email protected]. We may ask you to show that the account is yours — anyone could otherwise erase anyone — and we will accept proof from within the account itself rather than an identity document. Where the objection succeeds we remove the screen name from the site and exclude it from future imports.

7.7 What survives a removal. Anonymous, aggregated figures — the pool and field averages that every player is compared against — are not personal data and are not reconstructible into an individual. Those remain. Nothing that identifies the screen name does.

Your account

Until you delete it. Deleting the account removes your email, your notes, your watchlist and your preferences.

Sessions

Until they expire, and expired rows are cleared as they are encountered.

Lookup counts

The length of the rolling window — 24 hours. They expire on their own (§4).

Invoices and payment records

As long as the accounting and tax rules that apply to us require, which is several years, and which we cannot shorten at your request. Nothing beyond the transaction record is kept for this.

Support messages

Up to two years, so that a follow-up has its context.

Player statistics

While the hands are in the archive, subject to §7.6.

Under the GDPR you may:

• •ask what we hold about you, and get a copy (Art. 15)
• •have inaccurate data corrected (Art. 16)
• •have data erased (Art. 17)
• •have processing restricted (Art. 18)
• •receive your data in a portable form (Art. 20)
• •object to processing based on legitimate interests, including the statistics in §7 (Art. 21)
• •withdraw consent where processing rests on it — none of ours does today

Write to [email protected]. We answer within one month. There is no charge unless a request is manifestly excessive.

Passwords are hashed. Session tokens are stored as digests, so the cookie in your browser is the only copy. Traffic is served over HTTPS only. The databases are not reachable from the public internet except through the application.

If you are unhappy with how we have handled your data, you can complain to the data protection authority where you live. That right stands whether or not you raise it with us first — though we would rather hear from you, and we can usually just fix it.

When this policy changes materially we will say so by email to account holders and update the date at the top. The current version is always the one on this page.