Privacy Policy

Effective date: October 16, 2026

Overview

Poker with Friends collects only the information needed to run accounts, games and notifications. We do not sell or rent personal information, we do not show ads, and we do not use tracking or analytics tools.

Who is responsible

The data controller is Sudopop, 3704 Maple St, San Diego, CA 92104. For any privacy question or request, contact business@sudopop.io.

Data we collect

  • Account data: username, email address, a hash of your password (never the password itself), your avatar choice, when you accepted the Terms and when you verified your email.
  • Game data: the games you join, your seats, hands, actions and results, and your balance and its ledger history.
  • Chat: the messages you post at a table, and any reports or blocks you make.
  • Notifications: your notification settings, the notifications we create for you and, if you turn on push notifications, the push subscription your browser gives us.
  • Technical data: session records and server logs. Logs include IP addresses, request paths and timestamps, and are used for security, rate limiting and troubleshooting.

How we use data

  • To create and secure your account, including email verification and password resets.
  • To run games, keep hand history and keep the balance ledger.
  • To send the in-app, email and push notifications you choose.
  • To moderate chat and to detect abuse, cheating and technical problems.

We rely on our legitimate interest in running the service you asked to use, and on your consent for optional email and push notifications, which you can turn off in your profile.

Who can see your data

  • Other members: any signed-in member can see your username and avatar, watch games in progress and read finished games. They see the board, the actions, the cards shown at showdown and the chat messages, both live and in archived games. Folded and mucked cards stay private. Only seated players and admins can post chat messages.
  • Admins: the operator's admins can see account data (including email addresses), balances, ledgers, games and chat, so they can run the service and handle reports.
  • Service providers: we share data only with providers that run the service for us, and only for that purpose:
    • Hosting and database: Railway (United States).
    • Email delivery: our transactional SMTP email provider, which receives your email address and the message.
    • Push delivery: the push service of your browser or device (for example Google, Mozilla or Apple) receives notification messages for your subscription.

All scripts, styles and fonts are served from our own server. Pages load no third-party content delivery networks, so your browser does not contact other sites when you use the app. We do not send your data to AI services.

Cookies and browser storage

We use only cookies that the app needs to work. There are no advertising or analytics cookies, so there is no cookie banner.

  • Session cookie (__Host-session_id, or session_id on a development server): keeps you signed in. It is HttpOnly and expires after your session ends (7 days by default) or when you log out.
  • Flash cookie (flash_messages): carries a one-time message, such as "Game created", to the next page. It expires after 5 seconds.
  • Browser storage: if you turn on push notifications, your browser keeps a note of its push subscription so it is not registered twice. The service worker caches the app's own files so pages load faster and an offline page can show.

How long we keep data

  • Account, game, ledger and chat data: while your account exists. After you delete your account, see below.
  • Sessions: until they expire or you log out. Expired sessions are deleted automatically.
  • Read notifications: 30 days.
  • Delivered email and push jobs: 7 days. Failed jobs: 30 days.
  • Push subscriptions: deleted when you log out on that device, when the push service rejects them, or after 90 days without use.
  • Server logs: up to 30 days, set by our hosting provider.
  • Backups: up to 30 days. Deleted data leaves the backups when they expire.

Deleting your account

You can delete your account yourself from your profile (Delete my account). You need your password, and you cannot delete it while you are seated in a game in progress. If you are in, or host, a game that has not started, you leave it and get your buy-in back first.

  • Erased: your username, email address, password, avatar, notification settings, sessions, push subscriptions, notifications, and every queued, sent or failed email and push record (these hold your email address).
  • Kept: the balance ledger, your seats and actions in past games, and your chat messages. They are shown under an anonymous name such as "deleted#42", so other players' history and balances still add up.
  • Your balance is not paid out. Balances track amounts among friends. The platform does not hold, settle or pay out money. No real-money wagering happens through the app.

Your rights

Depending on where you live, laws such as the GDPR (EU and UK) and the CCPA (California) give you rights over your data:

  • Access and portability: download a copy of your data at any time from your profile (Download my data). The file is JSON and holds your profile, ledger, games and chat messages.
  • Correction: change your email address and password in your profile, or ask us to correct other data.
  • Deletion: delete your account from your profile, as described above.
  • Objection and restriction: turn off email and push notifications in your profile, or contact us.
  • No sale or sharing: we do not sell personal information or share it for advertising.
  • Complaints: you can complain to your local data protection authority.

For any request we cannot handle in the app, contact business@sudopop.io. We answer within 30 days. We will not treat you differently for using these rights.

Children

The app is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has an account, contact business@sudopop.io and we will delete it.

Security and changes

Passwords are stored as Argon2 hashes and session identifiers are stored hashed. Traffic is encrypted with HTTPS. We may update this policy and will show the new effective date on this page.

Contact

Privacy questions and requests: business@sudopop.io.