1. Controller
Pokalab is the data controller for the personal data described here. For anything in this policy, including access and deletion requests, write to contact@pokalab.com.
2. What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Email address and authentication identifiers | You, when you sign up | Creating and securing your account, sending service messages |
| Hand histories you import — including the screen names of players at your tables | You, when you upload them | Producing your own analysis, and, de-identified and aggregated, the population statistics the product runs on |
| Product settings and progress | Your use of the app | Restoring your filters, preferences and training progress across devices |
| Subscription status | Our payment processor | Knowing what your account may access |
| Technical logs (IP address, request, timestamp, errors) | Automatically, when you use the site | Security, abuse prevention, debugging |
We never receive your payment card details. Checkout runs entirely on Lemon Squeezy, LLC, and we only see whether a subscription is active.
3. A word about the players in your hand histories
A hand history necessarily names the other players at the table. We use those records to build aggregate population statistics — how a pool as a whole plays a spot. Those aggregates are computed over large numbers of hands and are not published as individually identifying profiles. We do not sell them, and we do not use them to identify anyone off the tables.
4. Legal bases
- Performance of a contract — running your account, analysing the hands you upload, delivering what your subscription includes.
- Legitimate interests — keeping the Service secure, preventing abuse, improving the product, and computing aggregate population statistics.
- Legal obligation — accounting and tax records for purchases.
- Consent — where we ask for it, for example before sending non-essential email. You can withdraw it at any time.
5. Who processes data on our behalf
| Processor | What it does |
|---|---|
| Supabase | Authentication, user settings, progress |
| Vercel | Hosting and delivery of the website |
| Cloudflare (R2) | Storage and delivery of solution libraries and files |
| Lemon Squeezy, LLC | Checkout, payment, invoicing, refunds, tax |
| Sanity | Content for the blog and learn sections |
Some of these are established outside the European Economic Area. Where data is transferred out of the EEA, it is covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard.
6. What we do not do
- We do not sell or rent personal data.
- We do not run advertising networks, third-party analytics trackers or social pixels on this site.
- We do not make automated decisions with legal effects about you.
7. Cookies
We use cookies only where they are needed to make the site work: session cookies set by our authentication provider to keep you signed in, and small preference cookies that remember a choice you made in the interface. There are no advertising or tracking cookies, which is why the site does not show a consent banner.
Blocking cookies in your browser will prevent you from signing in, but the public pages will still work.
8. How long we keep data
- Account data — while your account exists, then deleted within 30 days of account closure.
- Hand histories you uploaded — until you delete them or close your account. Aggregate statistics already computed from them are de-identified and are not reversed.
- Technical logs — a rolling period of up to 12 months.
- Billing records — as long as accounting law requires, typically 10 years.
9. Your rights
Under the GDPR you can ask for access to your data, correction, erasure, restriction of processing, portability of the data you gave us, and you can object to processing based on legitimate interests. Write to contact@pokalab.com and we will answer within one month. You also have the right to complain to your national data protection authority.
10. Security
Data is transmitted over TLS and stored with access restricted to what the Service needs. No system is perfectly secure; if a breach affects your personal data and is likely to present a risk to you, we will notify you and the relevant authority as the law requires.
11. Children
The Service is not intended for anyone under 18 and we do not knowingly collect data from minors.
12. Changes
We may update this policy. The effective date at the top of the page reflects the current version, and we will notify account holders of material changes. See also our Terms of Service.