Privacy policy

1. Scope

This Privacy Policy explains how PokerNexus LLC ("PokerNexus," "we," "us," or "our") collects, uses, shares, and protects personal information when you use pokernexus.com, the PokerNexus mobile applications, and any related services (together, the "Service"). It should be read together with our Cookie Policy, which covers the technical detail of cookies and local storage, and our Child Safety Standards, which cover our policies for a platform limited to adults. If you have questions about this policy, write to us at legal@pokernexus.com.

2. Information We Collect

Information you provide

• Account information: your email address and display name or handle, and a password, stored in hashed form and never in plain text, if you created your account that way. If you instead created your account by signing in with Google or Apple, we receive your name, email address, and whether that email address is verified from the provider, we keep the provider's account identifier so a later sign-in is recognized as the same person, and we make and store our own copy of any profile picture the provider offers rather than linking to the provider's copy of it, all as described in the section on signing in with Google or Apple below.
• Content you post: profile information, posts, forum threads, comments, direct messages, images, and anything else you upload or write on the Service.
• Communications: anything you send us directly, such as a support request or a report filed under our reporting tools.

Information collected automatically

• Session and security data: your IP address and browser or app user-agent string are recorded when your session begins, in order to recognize you between requests and to detect unauthorized access. This record is deleted within a day of the session expiring.
• Abuse-prevention data: we hold a short-lived, per-address count of requests, kept in memory for a few minutes, to limit abusive traffic.
• Hosting logs: our infrastructure provider keeps an operational log of requests to our servers, retained for seven days and used only to diagnose faults and investigate abuse.
• Location, if you grant it: if you allow location access to find nearby venues, the coordinates are sent to our servers to run that search but are not written to any record there. The same coordinates and any venue filters you set are stored on your own device, as described in our Cookie Policy, so they can be recalled the next time you browse.
• Diagnostic data: see "Error Monitoring (Sentry)" below.

Information we do not collect

We do not collect payment card information, government identification, or precise biometric data. We do not use advertising or cross-site tracking identifiers, and we do not build an advertising profile of you. Our Cookie Policy describes this in more detail.

3. How We Use Information

• To operate the Service: creating and maintaining your account, displaying and delivering the content you and others post, and keeping you signed in.
• To keep the Service and your account secure, including detecting and investigating unauthorized access and abusive traffic.
• To communicate with you, including transactional messages such as email verification, password resets, and notifications you have not turned off.
• To respond to reports, support requests, and legal process, and to enforce our Terms of Service and Child Safety Standards.
• To diagnose and fix problems with the Service, including through the error-monitoring tool described below once it is in place.
• To improve the accuracy of tournament listings, including by using an automated tool operated by a third-party vendor to extract event details from a poker room's publicly posted schedule or, in limited cases, from a photograph an administrator has submitted.

We do not sell personal information, and we do not share it with third parties for their own advertising or marketing purposes.

4. Service Providers

We use a small number of third-party service providers to operate the Service. Each acts on our behalf under a written agreement, and none is permitted to use what it receives for its own independent purposes.

Railway (hosting)

Railway Corp., based in the United States, hosts our infrastructure: the API, background worker, web application, and our Postgres database and Redis cache. Because of that, Railway holds everything we store — account information, content, direct messages, follows, reports, and queued background jobs — and keeps its own request log of calls to our servers.

Amazon Web Services (image storage)

Amazon Web Services, Inc. (S3) stores every image uploaded to the Service and the variants we generate from it, including avatars, post and forum images, and message attachments, as well as our own copies of link-preview images.

Resend (transactional email)

Resend, Inc., based in the United States, delivers our transactional email — verification, password reset, email change, and similar messages — and receives the recipient's email address and the body of each message.

Anthropic (automated data extraction)

Anthropic, PBC, based in the United States, reads poker room tournament schedules — a public web page, PDF, or, in limited cases, a photograph an administrator has submitted — and returns structured event data for our staff to review before anything is published. Anthropic acts as a data processor on our behalf under its Commercial Terms of Service, is not permitted to use what it receives to train its models, and by default deletes what it receives within 30 days, except that content its own systems flag as a possible policy violation may be retained for up to two years. We do not send Anthropic any account information, and only in the limited photograph scenario does what we send it include User Content.

Apple and Google (push notifications)

If you enable push notifications, Apple Inc. (for iOS) or Google LLC (for Android, through Firebase Cloud Messaging) receives your device's push token and the notification payload, which can include a short excerpt of the underlying content, such as the opening of a direct message. On Android, the Firebase messaging library also registers your installation with Google and keeps an installation identifier on your device to address notifications to it; this is disclosed in our Cookie Policy as well.

Slack (internal alerts)

We use an internal, admin-only Slack workspace to receive limited operational alerts — for example, that an account was created or deleted, that a report was submitted, or that a venue was added. These alerts are seen only by PokerNexus personnel and are not a channel through which any outside party is given access to user data.

Simple Analytics (audience measurement)

Simple Analytics B.V., based in the Netherlands, measures traffic to our website. It sets no cookie, stores nothing on your device, and the provider states it retains no IP address. It is not present in our mobile applications. Our Cookie Policy sets out exactly what is reported to it.

Error Monitoring (Sentry)

We use Sentry, operated by Functional Software, Inc., as our error-monitoring tool on both the website and the mobile applications. Sentry receives information about application errors — the error message, a stack trace, the general route or screen where the error occurred, and technical context such as browser or device type and app version — for the purpose of finding and fixing bugs. Sentry's data region for our account is the United States, and error-monitoring data is retained for up to 90 days.

Our configuration is built to limit what Sentry receives about you specifically: we do not send your IP address or request headers, we do not send anything that identifies your account (no user ID, handle, or email address), request content and any values that could contain the substance of a post, comment, or message are scrubbed before an error report is sent, our messaging and administrative screens are excluded from event data entirely, and session replay, which would otherwise be capable of recording what is on your screen, is turned off.

App stores

If you install our mobile application, Apple Inc. or Google LLC, as the operator of the App Store or Google Play, separately collects installation and update records, device and operating system information, and any crash reports you have agreed to share with developers, governed by their own privacy terms. We receive only aggregate reporting through their developer consoles, not this information about any individual user.

Maps

If you tap a venue's location to get directions, your device opens Apple Maps, Google Maps, or another map application of your choosing, and that application receives the coordinates or address you looked up, along with whatever information it separately collects from you as its own user. This happens on your device, outside the Service, and is governed by that map provider's own privacy policy.

5. Signing In With Google or Apple

If you create your account or sign in using Google or Apple, that provider is acting as an independent party in its own right, not as a service provider bound by the agreement described above under Service Providers. When you choose this option, we ask the provider for your identity, email address, and basic profile, and Google or Apple returns to us its own account identifier for you, your email address, whether that address is verified, your display name, and a link to your profile picture. What Google or Apple itself does with the fact that you use PokerNexus is governed by that provider's own privacy terms, not this one.

If you sign in with Apple and choose not to share your real email address, Apple gives us a private relay address instead. That relay address becomes the email on your account, the address we use to reach you, and the address you would need for account recovery, and it stops working if you later turn off forwarding for PokerNexus in your Apple ID settings. Apple gives us your real address only on your first sign-in, if at all, and does not repeat it on any sign-in after that.

We keep your display name, email address, whether it is verified, and the provider's account identifier on your account, as described above under Information We Collect. We also fetch your profile picture once, re-encode it, and store our own copy of it on our systems, rather than storing the provider's link and having each viewer's browser request the image directly from Google or Apple. We do this because hotlinking the image would mean everyone who viewed your profile, post, or comment — not just you — would have their IP address, browser details, and the fact that they were looking at PokerNexus content sent to Google or Apple, without any of them having chosen that. Our own copy of your picture is treated like any other picture you upload: it is served only from our systems, it follows the same retention described below as anything else on your account, and it is replaced the moment you upload one of your own. We do not keep the provider's address for that picture, and we do not keep any Google access or refresh token; we hold none of those at all. Apple is the one exception, and it is not a choice we make: Apple requires every app offering Sign in with Apple to tell Apple when someone deletes their account, and the only thing Apple accepts when we do is a token it issues at the moment you sign in. So if you sign in with Apple, we keep that one token, an Apple refresh token, for as long as your account has Apple connected to it. We do not keep an Apple access token.

That token is used for one thing and nothing else: telling Apple the connection is over. It is never used to reach anything belonging to you, and it is never sent to anyone but Apple. When you delete your account, or disconnect Apple from your account settings, we use it for that one purpose and then delete it, normally within an hour. If Apple cannot be reached, we keep trying and delete it as soon as we succeed.

If Google or Apple confirms who you are but you do not finish creating an account, we briefly hold the name, email address, picture link, and the provider's signed confirmation needed to complete the sign-up on the next screen. This record is described further under Data Retention below. No account is created, and none of the representations you make when you accept these terms are recorded, until you complete that screen, in the same way and on the same terms as an account created with an email address and password.

This section, and the references to Google and Apple above under Service Providers and Information We Collect, apply equally to any other identity provider we may add in the future, such as another sign-in option alongside Google and Apple.

6. Cookies and Similar Technologies

Our Cookie Policy describes, in full technical detail, the cookies we set, the information stored in your browser's or app's local storage, and how you can control both.

7. Data Retention

We keep your account and content for as long as your account is active. If you delete your account, we remove your profile and content from the Service, other than copies that persist briefly in backups or that are reasonably necessary to retain for legal, security, or dispute-resolution purposes. Session records are deleted within a day of the session expiring; hosting logs are kept for seven days; abuse-prevention counters are kept in memory for a few minutes. A record created when Google or Apple confirms who you are but you have not finished creating an account, described above under Signing In With Google or Apple, is kept for up to ten minutes, can be used once, and is deleted immediately once the sign-up is completed. If it instead expires or is abandoned, it stops being usable at the ten-minute mark, but an automated process physically removes it only once an hour, so removal in that case can take a little over an hour.

Apple refresh token (Sign in with Apple only) is retained for as long as your account has Apple connected. Apple issues this token only at the moment you sign in, and it is the only thing Apple will accept as proof when we later ask it to end that connection — so we keep one in order to be able to do so. We use it for nothing else. When you delete your account, or disconnect Apple from your account settings, we use it to tell Apple the connection is over and then delete it, normally within an hour; if Apple cannot be reached we keep trying, and delete it as soon as that succeeds.

8. Your Choices and Rights

You can review and update your account information, and delete your account, from your account settings, as described on our support page. Depending on where you live, you may also have the right to request access to, correction of, or deletion of your personal information, and, in some states, the right to opt out of the sale or sharing of personal information for cross-context behavioral advertising. Because we do not sell personal information and do not engage in that kind of sharing, there is no such practice for an opt-out to stop, but we honor Global Privacy Control signals as a request to that effect regardless. If Google or Apple confirmed you but you did not finish creating an account, the brief record described under Data Retention above is not tied to any account and is deleted automatically within minutes; while it still exists, you may raise any concern about it using the same contact below. To exercise any of these rights, write to us at legal@pokernexus.com.

9. Children's Privacy

PokerNexus is intended for users 18 and older. We do not knowingly collect personal information from anyone under 18, and we remove accounts we determine belong to someone under that age. Our Child Safety Standards describe how to report a suspected underage account and what we do once we confirm one.

10. International Data

We are launching with a marketing focus on users in the United States, but registration is not restricted by geography, and we expect the Service to be used by people outside the United States over time. Our service providers are based primarily in the United States, with our audience-measurement provider based in the Netherlands. If you access the Service from outside the United States, your information will be processed in the United States, which may have different data protection laws than the country where you live. By using the Service, you understand that your information will be transferred to, stored, and processed in the United States.

11. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including hashed password storage and access controls on our infrastructure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above when we do, and, where a change is material, we will make that clear on this page rather than relying solely on the date.

13. Contact Us

PokerNexus LLC
5511 Parkcrest Dr., Suite 103
Austin, TX 78731
legal@pokernexus.com