Privacy policy

1. Scope

This Privacy Policy explains how PokerNexus LLC ("PokerNexus," "we," "us," or "our") collects, uses, shares, and protects personal information when you use pokernexus.com, the PokerNexus mobile applications, and any related services (together, the "Service"). It should be read together with our Cookie Policy, which covers the technical detail of cookies and local storage, and our Child Safety Standards, which cover our policies for a platform limited to adults. If you have questions about this policy, write to us at legal@pokernexus.com.

2. Information We Collect

Information you provide

• Account information: your email address and display name or handle, and a password, stored in hashed form and never in plain text, if you created your account that way. If you instead created your account by signing in with Google or Apple, we receive your name, email address, and whether that email address is verified from the provider, we keep the provider's account identifier so a later sign-in is recognized as the same person, and we make and store our own copy of any profile picture the provider offers rather than linking to the provider's copy of it, all as described in the section on signing in with Google or Apple below.
• Content you provide: content you create, post, send, or upload on the Service, including messages you send to the AI assistant in the Service and the answers it gives you.
• Communications: anything you send us directly, such as a support request or a report filed under our reporting tools. If you report an answer from the AI assistant, the report includes a copy of that answer and of the question it responded to, which our staff review.

Information collected automatically

• Session and security data: your IP address and browser or app user-agent string are recorded when your session begins, in order to recognize you between requests and to detect unauthorized access. This record is deleted within a day of the session expiring.
• Usage data: for each day on which your account uses the Service, we record the date, whether you used the website, the iOS application, or the Android application, and, for the mobile applications, which version of the application you were running. We also keep, on your account, the most recent date on which you used the Service, the time you most recently signed in, and whether you signed in with a password, with Google, or with Apple. This daily record notes that you used the Service on a given day. It does not record which pages or screens you viewed or what you did on them, and the separate AI assistant usage record below covers questions you ask the assistant.
• AI assistant usage record: for each question you ask the AI assistant, we record when you asked it, the processing used to answer it, and what that processing cost. This record does not include the text of your question, which is stored only with your conversation. We use it to apply the limits on how much each member can use the assistant and to monitor our costs.
• Sign-up source: We record the channel or campaign that brought you to sign-up (for example, a tagged link in a newsletter, a social media post, or printed material). If sign-up is not completed, this data is treated the same as other incomplete sign-up data and is retained only for the window described under Data Retention below. If sign-up is completed, it becomes part of your account record and is retained under our standard account data retention schedule.
• Notification engagement: when you open one of your notifications, we record whether you reached it from a push notification, from a link in an email, or from within the Service. To make this possible, links in an email about a notification carry an identifier for that notification. We do not use tracking pixels or any other means of detecting whether you have opened an email.
• Abuse-prevention data: we hold a short-lived, per-address count of requests, kept in memory for a few minutes, to limit abusive traffic.
• Hosting logs: our infrastructure provider keeps an operational log of requests to our servers, retained for seven days and used only to diagnose faults and investigate abuse.
• Location, if you grant it: if you allow location access, your device's coordinates are sent to our servers when you use features based on where you are and with each question you ask the AI assistant. Our servers use them only to run a search for places near you when one is needed, then discard them. They are not written to any record and are not sent to any service provider. The venues and events a nearby search finds for the AI assistant, each naming its city, are stored with that conversation and sent to Anthropic as described below, so a conversation can show roughly where you were when you asked. The same coordinates and any venue filters you set are stored on your own device, as described in our Cookie Policy, so they can be recalled the next time you browse.
• Diagnostic data: see "Error Monitoring (Sentry)" below.

Information we do not collect

We do not collect payment card information, government identification, or precise biometric data. We do not use advertising or cross-site tracking identifiers, and we do not build an advertising profile of you. Our Cookie Policy describes this in more detail.

3. How We Use Information

• To operate the Service: creating and maintaining your account, displaying and delivering the content you and others post, and keeping you signed in.
• To keep the Service and your account secure, including detecting and investigating unauthorized access and abusive traffic.
• To communicate with you, including transactional messages such as email verification, password resets, and notifications you have not turned off.
• To respond to reports, support requests, and legal process, and to enforce our Terms of Service and Child Safety Standards.
• To diagnose and fix problems with the Service, including through the error-monitoring tool described below once it is in place.
• To understand how the Service is used and how well it keeps the people who join it — for example, how many people use it on a given day, how many return in the weeks after signing up, which channels bring new members to the Service, and whether our notifications are useful to the people who receive them — and to improve the Service accordingly. We use the usage, sign-up source, and notification engagement records described above for this purpose, and not to build an advertising profile of you.
• To improve the accuracy of tournament listings, including by using an automated tool operated by a third-party vendor to extract event details from a poker room's publicly posted schedule or, in limited cases, from a photograph an administrator has submitted.
• To answer questions you ask the AI assistant in the Service, using information you can already access in the Service, to keep your conversations available to you, and to apply limits on how much each member can use the assistant.

We do not sell personal information, and we do not share it with third parties for their own advertising or marketing purposes.

4. Service Providers

We use a small number of third-party service providers to operate the Service. Each acts on our behalf under a written agreement, and none is permitted to use what it receives for its own independent purposes, other than keeping and reviewing it to enforce that provider's own usage rules or to comply with the law, as described for Anthropic below.

Railway (hosting)

Railway Corp., based in the United States, hosts our infrastructure: the API, background worker, web application, and our Postgres database and Redis cache. Because of that, Railway holds everything we store — account information, content, direct messages, follows, reports, and queued background jobs — and keeps its own request log of calls to our servers.

Amazon Web Services (image storage)

Amazon Web Services, Inc. (S3) stores every image uploaded to the Service and the variants we generate from it, as well as our own copies of link-preview images.

Resend (transactional email)

Resend, Inc., based in the United States, delivers our transactional email — verification, password reset, email change, and similar messages — and receives the recipient's email address and the body of each message.

Anthropic (AI processing)

Anthropic, PBC, based in the United States, provides the artificial intelligence the Service uses for two purposes. It reads poker room tournament schedules, which are public web pages, PDFs, or, in limited cases, a photograph an administrator has submitted, and returns structured event data for our staff to review before anything is published. It also writes the answers to questions members ask the AI assistant in the Service. For each question, Anthropic receives the conversation so far and the information the Service looks up to answer it. That information can include public information about venues and events, the asking member's own activity on the Service, information about other members that the asking member can already see in the Service, venues and events near the asking member with the city each is in, the date and the time zone of the asking member's device, and internal identifiers that have no meaning outside the Service. Anthropic does not receive members' email addresses, profile details beyond name and handle, or the coordinates of a member's device. Anthropic acts as a data processor on our behalf under its Commercial Terms of Service and is not permitted to use what it receives to train its models. It deletes what it receives within 30 days by default. It may keep content longer where its automated safety systems identify a possible violation of its usage policy (inputs and outputs for up to two years, and related safety classification scores for up to seven years) or where the law requires.

When another member asks the AI assistant about you, information about you that the asking member can already see in the Service, such as your name and handle and any activity your settings make visible to that member, may be sent to Anthropic and stored in that member's conversation. If your settings or a block hide your activity from that member, Anthropic receives only your name and handle and the fact that the rest is hidden.

Apple and Google (push notifications)

If you enable push notifications, Apple Inc. (for iOS) or Google LLC (for Android, through Firebase Cloud Messaging) receives your device's push token and the notification payload, which can include a short excerpt of the underlying content, such as the opening of a direct message. On Android, the Firebase messaging library also registers your installation with Google and keeps an installation identifier on your device to address notifications to it; this is disclosed in our Cookie Policy as well.

Slack (internal alerts)

We use an internal, admin-only Slack workspace to receive limited operational alerts — for example, that an account was created or deleted, that a report was submitted, or that a venue was added. These alerts are seen only by PokerNexus personnel and are not a channel through which any outside party is given access to user data.

Simple Analytics (audience measurement)

Simple Analytics B.V., based in the Netherlands, measures traffic to our website. It sets no cookie, stores nothing on your device, and the provider states it retains no IP address. It is not present in our mobile applications. Our Cookie Policy sets out exactly what is reported to it.

Error Monitoring (Sentry)

We use Sentry, operated by Functional Software, Inc., as our error-monitoring tool on both the website and the mobile applications. Sentry receives information about application errors — the error message, a stack trace, the general route or screen where the error occurred, and technical context such as browser or device type and app version — for the purpose of finding and fixing bugs. Sentry's data region for our account is the United States, and error-monitoring data is retained for up to 90 days.

Our configuration is built to limit what Sentry receives about you specifically: we do not send your IP address or request headers, we do not send anything that identifies your account (no user ID, handle, or email address), request content and any values that could contain the substance of a post, comment, or message are scrubbed before an error report is sent, our messaging and administrative screens are excluded from event data entirely, and session replay, which would otherwise be capable of recording what is on your screen, is turned off.

App stores

If you install our mobile application, Apple Inc. or Google LLC, as the operator of the App Store or Google Play, separately collects installation and update records, device and operating system information, and any crash reports you have agreed to share with developers, governed by their own privacy terms. We receive only aggregate reporting through their developer consoles, not this information about any individual user.

Maps

If you tap a venue's location to get directions, your device opens Apple Maps, Google Maps, or another map application of your choosing, and that application receives the coordinates or address you looked up, along with whatever information it separately collects from you as its own user. This happens on your device, outside the Service, and is governed by that map provider's own privacy policy.

5. Signing In With Google or Apple

If you create your account or sign in using Google or Apple, that provider is acting as an independent party in its own right, not as a service provider bound by the agreement described above under Service Providers. When you choose this option, we ask the provider for your identity, email address, and basic profile, and Google or Apple returns to us its own account identifier for you, your email address, whether that address is verified, your display name, and a link to your profile picture. What Google or Apple itself does with the fact that you use PokerNexus is governed by that provider's own privacy terms, not this one.

If you sign in with Apple and choose not to share your real email address, Apple gives us a private relay address instead. That relay address becomes the email on your account, the address we use to reach you, and the address you would need for account recovery, and it stops working if you later turn off forwarding for PokerNexus in your Apple ID settings. Apple gives us your real address only on your first sign-in, if at all, and does not repeat it on any sign-in after that.

We keep your display name, email address, whether it is verified, and the provider's account identifier on your account, as described above under Information We Collect. We also fetch your profile picture once, re-encode it, and store our own copy of it on our systems, rather than storing the provider's link and having each viewer's browser request the image directly from Google or Apple. We do this because hotlinking the image would mean everyone who viewed your profile, post, or comment — not just you — would have their IP address, browser details, and the fact that they were looking at PokerNexus content sent to Google or Apple, without any of them having chosen that. Our own copy of your picture is treated like any other picture you upload: it is served only from our systems, it follows the same retention described below as anything else on your account, and it is replaced the moment you upload one of your own. We do not keep the provider's address for that picture, and we do not keep any Google access or refresh token; we hold none of those at all. Apple is the one exception, and it is not a choice we make: Apple requires every app offering Sign in with Apple to tell Apple when someone deletes their account, and the only thing Apple accepts when we do is a token it issues at the moment you sign in. So if you sign in with Apple, we keep that one token, an Apple refresh token, for as long as your account has Apple connected to it. We do not keep an Apple access token.

That token is used for one thing and nothing else: telling Apple the connection is over. It is never used to reach anything belonging to you, and it is never sent to anyone but Apple. When you delete your account, or disconnect Apple from your account settings, we use it for that one purpose and then delete it, normally within an hour. If Apple cannot be reached, we keep trying and delete it as soon as we succeed.

If Google or Apple confirms who you are but you do not finish creating an account, we briefly hold the name, email address, picture link, and the provider's signed confirmation needed to complete the sign-up on the next screen. This record is described further under Data Retention below. No account is created, and none of the representations you make when you accept these terms are recorded, until you complete that screen, in the same way and on the same terms as an account created with an email address and password.

This section, and the references to Google and Apple above under Service Providers and Information We Collect, apply equally to any other identity provider we may add in the future, such as another sign-in option alongside Google and Apple.

6. Cookies and Similar Technologies

Our Cookie Policy describes, in full technical detail, the cookies we set, the information stored in your browser's or app's local storage, and how you can control both.

7. Data Retention

We keep your account and content for as long as your account is active. Conversations with the AI assistant are kept until you delete them or delete your account. Deleting a conversation removes it from the Service right away, other than copies that persist briefly in backups and the copy of any answer you reported and the question it answered, which is kept with your report until you delete your account. The AI assistant usage record is kept for as long as your account exists, including after you delete a conversation, so that deleting a conversation does not reset your usage limits, and it is deleted along with your account. If you delete your account, we remove your profile and content from the Service, other than copies that persist briefly in backups or that are reasonably necessary to retain for legal, security, or dispute-resolution purposes. Information about you that the AI assistant included in an answer to another member, such as your name, handle and results, is part of that member's conversation and is not removed when you delete your account: it is kept until that member deletes the conversation or their own account, and any copy of that answer kept with a report is kept until the reporting member deletes their account. Usage data, sign-up source, and notification engagement records are kept for as long as your account exists, and are deleted along with it. When an account is deleted, we keep a separate record that an account was deleted, holding only the week in which the account was created, the week in which it was last used, the week in which it was deleted, the platform and sign-in method it was created with, and the number of days on which it was used. That record contains no user ID, email address, handle, or other information that identifies you, records nothing more precise than a week, and is not linked to any other record we keep. We keep it for as long as we operate the Service in order to understand how long members stay with the Service. Session records are deleted within a day of the session expiring; hosting logs are kept for seven days; abuse-prevention counters are kept in memory for a few minutes. A record created when Google or Apple confirms who you are but you have not finished creating an account, described above under Signing In With Google or Apple, is kept for up to ten minutes, can be used once, and is deleted immediately once the sign-up is completed. If it instead expires or is abandoned, it stops being usable at the ten-minute mark, but an automated process physically removes it only once an hour, so removal in that case can take a little over an hour.

Apple refresh token (Sign in with Apple only) is retained for as long as your account has Apple connected. Apple issues this token only at the moment you sign in, and it is the only thing Apple will accept as proof when we later ask it to end that connection — so we keep one in order to be able to do so. We use it for nothing else. When you delete your account, or disconnect Apple from your account settings, we use it to tell Apple the connection is over and then delete it, normally within an hour; if Apple cannot be reached we keep trying, and delete it as soon as that succeeds.

8. Your Choices and Rights

You can review and update your account information, and delete your account, from your account settings, as described on our support page. Depending on where you live, you may also have the right to request access to, correction of, or deletion of your personal information, and, in some states, the right to opt out of the sale or sharing of personal information for cross-context behavioral advertising. Because we do not sell personal information and do not engage in that kind of sharing, there is no such practice for an opt-out to stop, but we honor Global Privacy Control signals as a request to that effect regardless. If Google or Apple confirmed you but you did not finish creating an account, the brief record described under Data Retention above is not tied to any account and is deleted automatically within the window described there; while it still exists, you may raise any concern about it using the same contact below. To exercise any of these rights, write to us at legal@pokernexus.com.

You have the right to object, on grounds relating to your particular situation, to our processing of your personal data where we rely on legitimate interest as the basis, including the usage, sign-up source, and notification engagement records described under Information We Collect. If you object, we will stop that processing unless we have compelling legitimate grounds to continue, or the processing is needed to establish, exercise, or defend a legal claim. To object, contact us at legal@pokernexus.com.

9. Children's Privacy

PokerNexus is intended for users 18 and older. We do not knowingly collect personal information from anyone under 18, and we remove accounts we determine belong to someone under that age. Our Child Safety Standards describe how to report a suspected underage account and what we do once we confirm one.

10. International Data

We are launching with a marketing focus on users in the United States, but registration is not restricted by geography, and we expect the Service to be used by people outside the United States over time. Our service providers are based primarily in the United States, with our audience-measurement provider based in the Netherlands. If you access the Service from outside the United States, your information will be processed in the United States, which may have different data protection laws than the country where you live. By using the Service, you understand that your information will be transferred to, stored, and processed in the United States.

11. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including hashed password storage and access controls on our infrastructure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above when we do, and, where a change is material, we will make that clear on this page rather than relying solely on the date.

13. Contact Us

PokerNexus LLC
5511 Parkcrest Dr., Suite 103
Austin, TX 78731
legal@pokernexus.com