1. Controller
Pokalab is the data controller for the personal data described here. The operator is Maxime Fabre, 132 Route de la Balage, 12800 Naucelle, France. For anything in this policy, including access and deletion requests, write to contact@pokalab.com.
2. What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Email address and authentication identifiers | You, when you sign up | Creating and securing your account, sending service messages |
| Hand histories you import — including the screen names of players at your tables | You, when you upload them | Producing your own analysis only (your database, statistics and Leak Finder), shown to you alone. Never added to the population statistics. |
| Product settings and progress | Your use of the app | Restoring your filters, preferences and training progress across devices |
| Subscription status | Our payment processor | Knowing what your account may access |
| Your answer to “How did you hear about Pokalab?” | You, if you chose to answer when you signed up (no longer asked since October 2026) | Knowing which of our posts and videos bring people to Pokalab |
| Your choice about marketing emails | You, at sign-up or on your Account page | Sending the weekly PokaQuiz and product news only if you asked for them |
| Your email address, when you ask for the link on your computer | You, with “Send to my computer” on the home page | Sending you that one link. It is kept only if you tick the PokaQuiz box (then: see marketing emails below) |
| Technical logs (IP address, request, timestamp, errors) | Automatically, when you use the site | Security, abuse prevention, debugging |
| Visits from our tagged links — a daily count per campaign and page. No cookie, no identifier, nothing that singles you out (see section 7) | Automatically, when you open a link we posted that carries campaign tags | Knowing which of our posts bring visitors |
| Audience counts — daily totals of visits and page views by page, type of device, referring site, country and browser language. No cookie, no identifier, your IP address is not kept (see section 7) | Automatically, when you browse the site | Knowing how many people visit, from where, and which pages they read |
We never receive your payment card details. Checkout runs entirely on Stripe, and we only see whether a subscription is active, along with the invoices issued in our name.
3. A word about the players in your hand histories
A hand history necessarily names the other players at the table. Our aggregate population statistics — how a pool as a whole plays a spot — are built from hand histories we obtain ourselves, never from the ones you upload. Those aggregates are computed over large numbers of hands.
Signed-in subscribers can also look up per-player aggregates — screen name, number of hands observed, and headline frequencies — for accounts that appear in that population data, the same information any opponent can derive by sitting at the table. This is not public: it requires an account and an active subscription, and it is never exposed to unauthenticated visitors, search engines or third parties. We do not sell this data, we do not use it to identify anyone away from the tables, and we do not combine it with any off-table source. If you play under a screen name that appears in our data and want it removed from these lookups, contact us and we will exclude it.
4. Legal bases
- Performance of a contract — running your account, analysing the hands you upload, delivering what your subscription includes.
- Legitimate interests — keeping the Service secure, preventing abuse, improving the product, and computing aggregate population statistics.
- Legal obligation — accounting and tax records for purchases.
- Consent — where we ask for it, for example before sending non-essential email. You can withdraw it at any time.
Marketing emails. When you sign up with an email address, or ask for the link on your computer, you can tick a box to receive the weekly PokaQuiz and product news. It is unticked by default, and nothing depends on it; if you sign up with Google or Facebook, you are not subscribed. You can withdraw at any time with the switch on your Account page, and every one of these emails carries an unsubscribe link. Withdrawing does not stop the emails we must send about your account or billing.
5. Who processes data on our behalf
| Processor | What it does |
|---|---|
| OVHcloud | Hosting of the website, the application servers and the analysis database, on a dedicated server in France |
| Supabase | Authentication, user settings and progress, your sign-up answers and email preference, the anonymous visit and audience counts (hosted in the European Union) |
| Resend | Sending account emails, such as the link that confirms your sign-up |
| Cloudflare (R2) | Storage and delivery of solution libraries and files |
| Google Cloud (Cloud Run) | The desktop solver’s services: uploading solutions to your cloud library, and checking for app updates |
| Stripe | Checkout, card payments and card storage, fraud prevention, invoices and receipts, the billing portal |
| Sanity | Content for the blog and learn sections |
Some of these are established outside the European Economic Area. Where data is transferred out of the EEA, it is covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard.
6. What we do not do
- We do not sell or rent personal data.
- We do not run advertising networks, social pixels or third-party analytics on this site, and we do not track you across other websites. Our only measurement is our own anonymous counting of visits and page views (section 7).
- We do not make automated decisions with legal effects about you.
7. Cookies
We use cookies only where they are needed to make the site work: session cookies set by our authentication provider to keep you signed in, and small preference cookies that remember a choice you made in the interface. There are no advertising or tracking cookies, which is why the site does not show a consent banner.
When you open a link we posted that carries campaign tags (such as “utm_source=youtube”), we add one to an anonymous count for that day, campaign and page. Nothing is stored on your device, nothing identifies you, and the count cannot be linked to you or to an account, so it needs no consent.
We also count our audience the same way. Each page you view adds one to a daily total for that page, kept per type of device (phone, tablet or computer), the site you came from, your country and your browser’s language. Your country is worked out from your IP address when the page loads, and the address itself is then discarded: it is never stored with these counts. Nothing is stored on your device, no identifier is created, and a count cannot be linked to you, to your other visits or to an account, so it needs no consent either. Country data: IP Geolocation by DB-IP, licensed under CC BY 4.0.
Blocking cookies in your browser will prevent you from signing in, but the public pages will still work.
8. Our YouTube channel
Pokalab publishes its own videos on YouTube, using the YouTube API Services. The tool that does it is used only by the Pokalab team: it never accesses your YouTube account or any data about you. When you watch our videos on YouTube, YouTube’s own terms apply — the YouTube Terms of Service and the Google Privacy Policy.
9. How long we keep data
- Account data — while your account exists, then deleted within 30 days of account closure.
- Hand histories you uploaded — until you delete them or close your account. They are never part of the population statistics.
- Technical logs — a rolling period of up to 12 months.
- Billing records — as long as accounting law requires, typically 10 years.
10. Your rights
Under the GDPR you can ask for access to your data, correction, erasure, restriction of processing, portability of the data you gave us, and you can object to processing based on legitimate interests. Write to contact@pokalab.com and we will answer within one month. You also have the right to complain to your national data protection authority.
11. Security
Data is transmitted over TLS and stored with access restricted to what the Service needs. No system is perfectly secure; if a breach affects your personal data and is likely to present a risk to you, we will notify you and the relevant authority as the law requires.
12. Children
The Service is not intended for anyone under 18 and we do not knowingly collect data from minors.
13. Changes
We may update this policy. The effective date at the top of the page reflects the current version, and we will notify account holders of material changes. See also our Terms of Service.