1. Scope of this policy
This policy applies to the TableRival app with package identifier app.tablerival.poker, the first-party API used for explicitly enabled features and the public website. There is no TableRival login account.
2. Key principles
- No TableRival account is required. Purchases and optional app analytics use persistent pseudonymous identifiers; no login does not mean that all processing is anonymous.
- Training history, hands, opponent aliases, notes, settings and local diagnostics remain on the device by default. Hosting logs are separate and described below.
- TableRival does not accept poker deposits, pay prizes, display ads or sell data.
- Optional app analytics and Google Analytics on this website each require separate voluntary consent. Hosting logs and the provider’s built-in traffic statistics are separate.
- Payment-card details remain with Google or Apple.
3. Data that may be processed
| Category | Scope and purpose | Legal basis |
|---|---|---|
| Local data | Progress, decisions, hands, cards, simulated amounts, opponent profiles and aliases, notes, settings, backups and local diagnostic incidents used to operate the trainer. The Operator does not receive them automatically. | Performance of the service; data remains under the user’s control. |
| Optional app analytics | A random pseudonymous installation identifier, feature event, language and event time. No cards, amounts, aliases, notes or hand histories. | Consent, which may be withdrawn. |
| Recommendation reports | Report identifier and creation time, issue category, technical rule identifier, model type/version, language and optional comment. Network metadata is processed separately by hosting. Please do not include private hand histories or third-party personal details in comments. | Your voluntary request and legitimate interest in improving the service. |
| Pro purchases | A persistent pseudonymous app-user/purchaser identifier, product, store, environment, entitlement status, purchase, expiry, refund or restore event and necessary device/network/receipt metadata. RevenueCat processes these for entitlement delivery, purchase troubleshooting and purchase/subscription statistics. | Performance of contract, legitimate interest in service and purchase analysis, fraud prevention and legal obligations. |
| Website and API logs | IP address, user-agent, requested URL, method and time, response status, request identifiers, execution diagnostics and network-derived country information. Used to deliver the service, prevent abuse and investigate incidents; not a GPS location reading. | Legitimate interest in secure, reliable operation; legal obligations where applicable. |
| Support | Email address, correspondence and technical information you choose to provide. | Handling your request and legitimate interest in user support. |
3a. Public website analytics
Only with your consent, we use Google Analytics 4, provided by Google Ireland Limited. Its purpose is to understand traffic sources and website usefulness; the legal basis is your voluntary consent, which you can withdraw. Google receives pseudonymous cookie identifiers, public pages visited, referral source, language, time and basic browser and device information. We also measure guide-answer openings, app-screen selections and full-size image openings, exercise-link clicks, visits to the download section, clicks on available store links and clicks on the QR-code link. We do not measure the act of scanning a code. A click does not mean the app was installed or a purchase occurred. Google processes the network data needed to connect to its service.
We do not send message contents, email addresses, training data or arbitrary URL parameters. Page addresses are sent without query strings or fragments; traffic sources use only the referring domain or predefined campaign labels. Google Signals, ad personalisation, granular location and device data collection and automatic form measurement are disabled. Learn how Google uses data on partner sites.
GA4 user and event data retention is set to 2 months, without resetting the period on new activity. This setting does not limit retention of standard aggregated reports. You can change consent in “Analytics settings” in the footer; declining stops further measurement but does not automatically erase previously collected data. See the Cookies Policy for cookie lifetimes and storage of your choice. Website analytics is separate from app analytics.
3b. Hosting logs and built-in traffic statistics
The website and first-party API are hosted through OpenAI Sites on Cloudflare infrastructure. Technical request logs can be retained beyond the time needed to answer a request. An IP address, user-agent and request time may allow a report or request to be linked to a visitor, even though the report form does not send a purchase or analytics identifier. We therefore do not describe submitted reports as fully anonymous.
Sites also automatically records traffic and provides counts of unique visitors and page views over time, as described in the hosting documentation. These provider-managed statistics are separate from consent-based app analytics and Google Analytics. Refusing those optional tools does not switch off hosting request logs or built-in statistics. The provider’s documentation does not explain whether these statistics include API requests or how unique visitors are recognised; we do not claim that their source data is anonymous.
The legitimate interests for operational processing are service availability, security, troubleshooting and understanding demand on the website. We do not use hosting data for personalised advertising or advertising tracking across apps and websites. See section 6 for retention and section 8 for your rights, including the right to object where applicable.
4. Recipients
Depending on the platform and enabled features, data may be processed by Google Play or Apple App Store (distribution and payments), RevenueCat (purchase verification, Pro entitlements and purchase statistics), OpenAI Sites and Cloudflare (website, API, database hosting, logs and built-in traffic statistics), the email provider and authorities or advisers where legally required. Google Analytics is described separately in section 3a. Providers act within the scope of their services and applicable terms or data-processing agreements. The Operator does not disclose data to advertisers or data brokers.
5. Transfers outside the EEA
Some providers may process data outside the European Economic Area. Required safeguards include an applicable European Commission adequacy decision, Standard Contractual Clauses or another GDPR-approved mechanism.
6. Retention
- Local data: until you delete it, reset the app or uninstall. A separately exported file or Android/Google system backup may remain; manage those copies separately. A backup is not a TableRival account or guaranteed cross-device synchronisation, and does not restore Pro purchases.
- Optional app analytics: cleanup targets events older than 12 months, measured from the event time.
- Recommendation reports: cleanup targets reports older than 24 months, measured from creation, not from closure.
- Both database cleanups run when the service processes a new valid analytics or report submission, not on an independent timer. If no such request arrives, records may remain longer. You may request deletion using the contact in section 8.
- Hosting logs and built-in traffic statistics have a separate provider-managed retention cycle. The actual duration for this Sites deployment has not yet been confirmed. The 2-month Google Analytics setting and the 12-/24-month database rules do not apply to them.
- For support and incident records managed by the Operator, the retention criteria are the time needed to resolve the request or investigate the incident, followed only by any necessary period for a specific dispute or applicable legal obligation. Purchase and entitlement data is retained for subscription delivery, refunds, disputes and applicable tax, accounting or consumer-law obligations.
- Truly anonymised aggregate statistics that cannot identify a person may be kept longer. Pseudonymous identifiers and raw hosting logs are not treated as anonymous aggregates.
Before commercial release, the Operator must confirm the hosting provider’s retention periods, including built-in traffic statistics and any separate copies, and verify deletion or review arrangements. This policy does not promise an unverified automatic deletion deadline. Questions and requests: tablerival@gmail.com.
7. Security
TableRival uses data minimisation, encrypted HTTPS transport, pseudonymous identifiers, narrow API contracts, access controls and signed store releases. See the Security Policy for details and vulnerability reporting.
8. Your rights and choices
Where the GDPR applies, you may request access, correction, erasure, restriction or portability, object to processing and withdraw consent without affecting prior lawful processing. Email tablerival@gmail.com. You may also complain to the Polish supervisory authority (UODO) or your local authority.
Local reset and remote deletion instructions are on the Data deletion page.
9. Automated decisions and children
Poker recommendations are educational information and do not produce legal or similarly significant effects. The service is for adults aged 18 or over and is not directed to children.
10. Changes
This policy will be updated before a new material data-collection practice is enabled. The current date will remain visible here; material changes may also be announced in the app or store.
11. Controller and contact
The data controller is Mariusz Twaróg (the “Operator”). Privacy contact: tablerival@gmail.com.
Service provider details and postal contact address are directly available in the terms. You may also use that address for data-protection enquiries.