Privacy Policy

1. Scope

This policy applies to the TableRival native app with package identifier app.tablerival.poker, the TableRival web/PWA trainer, TableRival’s first-party APIs and the public website. Some native and local features work without a TableRival web account. Account features on the web/PWA use WorkOS AuthKit Hosted UI. WorkOS handles the sign-in screen and credentials; TableRival does not receive or store your WorkOS password.

Controller and contact

2. Key principles

• Training is local-first. Data remains on your device unless you choose a feature that sends it, such as account cloud backup, checkout, analytics or support.
• A signed-in web/PWA account can hold device, session, quota, exercise and cloud-backup records. An account is therefore not anonymous merely because TableRival stores pseudonymous identifiers.
• TableRival does not accept poker deposits, pay prizes, display advertising or sell personal data.
• Only server-verified RevenueCat entitlement state can grant Pro. A local setting, backup file or checkout success screen cannot do so.
• Optional app analytics and Google Analytics on the public website each require a separate voluntary choice. Essential security, authentication, billing and request logs do not depend on analytics consent.

2a. Local data and Recovery Capsule v13

Training history, cards, boards, simulated amounts, stacks, aliases, notes, settings and review progress are processed locally by default. Recovery Capsule v13 contains twelve selected local areas:

• Trainer state and history.
• Learning progress, reviews and manually saved hands.
• Full Game and the saved current session.
• Coach preferences.
• Performance preferences.
• Solver Trainer learning history and reviews.
• Your explicit language preference.
• Beginner-tutorial state.
• Solver view and session preferences.
• Academy course progress.
• Additional Solver exercise history, reviews and skill-scoped observations, including earlier study history.
• Web settings: table configuration, interface and training preferences, and simulated amounts.

Billing identity, Pro entitlement, analytics, diagnostics, secrets, cookies and other browser or WebView data outside those areas are excluded. The separate imported hand-history library is excluded from the main capsule and automatic Android backup; its compact replay data can be exported or imported separately without the original raw hand-history text. A backup never restores Pro.

On Android, the operating system may include the selective capsule in its encrypted, best-effort Google backup when device backup is enabled. TableRival cannot guarantee that Android will back up or restore it. On iOS, use the manual export, share and import tools in Settings; TableRival does not promise automatic iCloud backup.

On web/PWA, signed-in users can use account-linked cloud backup when that capability is enabled. The client validates Recovery Capsule v13 before upload and after download. Sync is local-first: a download does not silently replace local progress, and a conflict requires review and confirmation. Manual import also requires confirmation before replacing local data.

2b. Web account, private exercises and cloud copy

• Authentication and account. WorkOS processes the sign-in identifier and authentication method. TableRival stores an opaque account ID, a one-way hash of the WorkOS subject, a masked email value, time zone and separate opaque RevenueCat user ID. Short-lived authentication-flow records contain hashed state/binding values and a PKCE verifier, not WorkOS access or refresh tokens.
• Devices and sessions. TableRival stores registered-device IDs, a device label, slot, creation/last-activity/revocation times, and server-session IDs, token hashes, expiry and revocation state. A personal web subscription is designed for up to five registered devices and one interactive Pro training session at a time. Device recovery records are short-lived and security-limited.
• Quotas and training. The server records daily mode-specific quota receipts and the single private exercise issued for a session, including exercise/catalog identifiers, the bounded scenario payload, access tier and time. When you answer, it also stores the submitted action and the bounded server-generated evaluation so retries remain consistent and abuse cannot create extra grants. Complete private catalogs are not stored in your account record or sent to the browser.
• Cloud backup. The current Recovery Capsule v13 bytes are kept in private, account-scoped object storage. D1 stores its revision, server-computed SHA-256 integrity hash, size, type, source session/device IDs and timestamps. The object store is not public and downloads pass through authenticated API access.
• No end-to-end encryption claim. Transport uses HTTPS and storage is access-controlled, but the capsule is not described as end-to-end encrypted. Do not assume that only your device can technically read its contents.
• Offline Pro. If enabled, the browser may keep a signed Pro lease for at most 72 hours, bound to the current account, registered device and a non-exportable browser key. The lease expires automatically and cannot grant Pro after its signed limit; clearing site data removes the device key and offline access.

2c. Optional native account and shared progress

This section applies to native versions in which account linking and shared progress are enabled. Guest training and a native-store purchase do not require a TableRival account. The RevenueCat SDK sends an app-scoped installation/purchaser identifier during ordinary initialization and entitlement checks; purchase history and purchase statistics are separate from consent-based feature analytics.

• Hosted sign-in. Device linking opens the dedicated TableRival account confirmation page and WorkOS hosted sign-in. WorkOS processes and stores the verified email address and the authentication method offered in that flow. TableRival stores a masked email value and a one-way provider-subject hash. Native pairing receives opaque account, device, session and purchaser identifiers, not your WorkOS password or full email.
• Account access. Linking registers a device and associates its session, purchase identity and entitlement metadata with the account. When signed offline Pro is available, its device-key binding and expiry are also processed. Linking or uploading a backup is not itself proof of a purchase and does not guarantee cross-store entitlement availability.
• Separate synchronization choice. Only after your explicit shared-progress confirmation may the app transfer training decisions/results, reviews, manually saved hands, opponent aliases/notes, course progress and preferences as an account-scoped Recovery Capsule. Android uses Recovery Capsule v12 with eleven domains; when exchanging web Recovery Capsule v13, the additional webSettings area is preserved opaquely and is not applied as native settings. Raw imported hand-history text, authentication tokens, billing secrets and diagnostics are excluded.
• Local recovery and account boundaries. The app may retain a guest backup, account-scoped offline progress and a local transition/recovery journal to avoid losing data when switching profiles or an installation fails. Unlinking a device does not erase those local recovery copies or the account cloud copy. A confirmed shared-progress reset establishes a reset boundary so older synchronized progress cannot silently restore reset history; it does not delete the account.
• Storage and deletion. Cloud bytes and revision/integrity, source device/session and reset-boundary metadata use the private account API/storage described above, without an end-to-end encryption claim. Already issued native offline leases may remain usable until their signed expiry, at most 24 hours; the web/PWA maximum is 72 hours. The native account settings provide a Request account deletion link. Opening it only shows the verified manual email-request instructions: it does not perform a remote purge, unlink a device, reset progress or cancel a subscription.

3. Data, purposes and legal bases

• Service and account data. Local training data, account identifiers, settings, cloud capsule, issued exercises, answers, evaluations, quotas, devices and sessions are used to provide the requested trainer, preserve progress, enforce access limits and secure the account. Legal basis: performance of the service contract and steps requested before entering it.
• Purchases and Pro. A pseudonymous purchaser ID, product, channel, environment, entitlement status, purchase, expiry, cancellation, refund or restore event and necessary payment metadata are used to sell and operate Pro. RevenueCat coordinates entitlement and web billing; Stripe processes web card payments. Apple and Google process native-store payments. TableRival does not receive full card details. Legal basis: contract, legal obligations, and legitimate interests in preventing fraud and resolving billing problems.
• Optional app analytics. A random pseudonymous installation ID, used feature, language and event time, without cards, amounts, aliases, notes or hand histories. Legal basis: consent, which can be withdrawn.
• Recommendation reports and support. Report ID/time, issue category, technical rule/model identifiers, language, optional comment, support email and correspondence. Do not include payment-card data, private raw hand histories or third-party personal information. Legal basis: your request, contract where relevant and legitimate interest in support and product reliability.
• Operational and security data. IP address, user-agent, requested URL, method/time, response status, request IDs, network-derived country and execution/security diagnostics may be processed in website, API, authentication and provider logs. This is not GPS location. Legal basis: legitimate interests in delivering, protecting and troubleshooting the service, and legal obligations where applicable.

3a. Public website analytics

Only with your consent, we use Google Analytics 4, provided by Google Ireland Limited, to understand traffic sources and public-website usefulness. Google may receive pseudonymous cookie identifiers, public pages visited, referral domain, language, time and basic browser/device information. We may measure guide-answer openings, screenshot views, exercise-link clicks, visits to download areas, store-link clicks and the QR-link click; a click does not prove an installation or purchase.

We do not send message contents, email addresses, training data or arbitrary URL parameters. Page addresses are sent without query strings or fragments. Google Signals, ad personalisation, granular location/device collection and automatic form measurement are disabled. See how Google uses partner-site data and the Cookies Policy.

GA4 user and event retention is set to 2 months without resetting the period on new activity. This does not limit standard aggregated reports. You can change consent in “Analytics settings” in the public-site footer; declining stops further optional measurement but does not automatically erase data already collected.

3b. Hosting and service logs

The public website uses OpenAI Sites on Cloudflare infrastructure. Provider-managed request logs and built-in traffic statistics are separate from optional analytics. Refusing analytics does not disable essential logs or provider traffic counts. The provider documentation does not establish an exact retention period for this deployment, so TableRival does not promise one.

When account-enabled web/PWA services are available, their API and account metadata use Cloudflare Worker/D1-style infrastructure and the cloud capsule uses private R2-style object storage. These components are configured to fail closed when required authentication, database, storage, billing or signing services are unavailable. Operational processing supports availability, security, abuse prevention, troubleshooting and capacity management.

4. Recipients

Depending on the feature and platform, recipients/processors may include WorkOS (hosted authentication), RevenueCat (entitlement and subscription management), Stripe (web payment processing), Apple App Store or Google Play (native distribution and payments), Cloudflare and OpenAI Sites (hosting, API, D1/R2 storage, logs and traffic statistics), Google Ireland Limited (consent-based public-site analytics), the email provider, professional advisers and authorities where legally required. Each provider acts under its own role, terms and data-processing arrangements. TableRival does not disclose personal data to advertisers or data brokers.

5. International transfers

Some providers may process data outside Poland or the European Economic Area. Where GDPR requires it, transfers rely on an applicable European Commission adequacy decision, Standard Contractual Clauses or another lawful safeguard. Provider privacy notices explain their locations and transfer mechanisms.

6. Retention

• Local data: until you delete it, reset the app/site data or uninstall. Exported files and operating-system backups remain under your control and must be removed separately.
• Account and web training records: retained while needed to operate the account, enforce quotas and security, provide consistent exercise evaluation and handle disputes. No separate automatic deletion deadline has yet been configured for quota, issuance and evaluation records. A verified deletion request is handled subject to necessary legal, fraud-prevention and dispute records.
• Cloud capsule: the service keeps the current account copy and revision metadata. Replacement or deletion queues the former private object for cleanup; a minimal deletion tombstone may remain to prevent a stale device from silently recreating deleted data. There is no public object URL.
• Sessions and recovery: sessions and recovery challenges are time-limited and can be revoked. A configured offline Pro lease expires within 72 hours. Security records may remain only as needed to protect the service and investigate abuse.
• Optional app analytics: cleanup targets events older than 12 months, measured from event time.
• Recommendation reports: cleanup targets reports older than 24 months, measured from creation.
• The two app-database cleanups above run when a new valid report or analytics event is processed, not on an independent timer; records may therefore remain longer if no such request occurs. You may request deletion.
• Hosting, authentication and payment providers: their logs, backups and transaction records follow provider cycles and applicable tax, accounting, consumer, anti-fraud and dispute duties. The exact Sites log/statistics period for this deployment has not been confirmed. TableRival does not invent an automatic deadline.
• Truly anonymised aggregate statistics may be retained longer. Pseudonymous IDs and raw logs are not treated as anonymous.

7. Security

Controls include HTTPS, data minimisation, opaque identifiers, hashed session and provider values, HttpOnly/Secure cookies, same-origin and CSRF checks, private object storage, server-side entitlement checks, bounded API bodies and signed offline leases. No internet service can promise absolute security. See the Security Policy for vulnerability reporting.

8. Your rights and controls

Where GDPR applies, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent without affecting earlier lawful processing. Email tablerival@gmail.com. You may complain to the Polish supervisory authority (UODO) or your local authority.

See Data deletion for the difference between local reset, cloud-copy deletion, account deletion and subscription cancellation. The current web UI does not yet provide a complete self-service account-deletion flow; a verified email request is available.

9. Automated decisions and children

Poker recommendations and grading are educational and do not produce legal or similarly significant effects. The service is for adults aged 18 or over and is not directed to children.

10. Changes

This policy will be updated before a materially different data practice is enabled. The current date remains visible here; material changes may also be announced in the app, web/PWA or store.