TatoPoker

Privacy Policy

Last updated: July 27, 2026 · Leer en español

TatoPoker is a poker hand-history study tool operated by an individual based in Argentina. This page explains what data TatoPoker collects when you use the website or the Android app, why, and how you can request access to or deletion of your data.

What we collect

• Account data: username, email address, and password (stored as a salted hash — we never store or can recover your plaintext password). We also log the IP address and browser/device user-agent associated with login attempts and active sessions, for account security.
• Poker study data: the hand histories you upload (hole cards, board, stacks, actions, and the raw hand text), along with any tags, notes, and review status you add. This data is private to your account by default.
• ClubGG ledger data: if you use the ClubGG feature, buy-ins, prizes, bounties, and settlement transfers you or your group record. This tracks money already exchanged outside the app between players you know — TatoPoker does not host real-money gambling, betting, or payments of any kind.
• Community content: posts, comments, and votes you choose to publish on the community wall. Content you post there is visible to other users.
• Profile and progress data: display name, avatar, achievements, and any leaderboard visibility settings you opt into.
• Aggregated study data (MDA): if enabled in your study preferences, anonymized, pooled statistics derived from your hands may contribute to population-wide trends shown to all users. This aggregation never exposes your raw hands or opponents' identities, and you can opt out at any time from your study preferences.
• Discord link (optional): if you link a Discord account, we store your Discord user ID and username to power Discord-side features (roles, challenges, leaderboard posts).
• Support and bug reports: if you report an issue in the app, we collect the page you were on, your browser/device information, and the message you write.

How we use this data

To provide the core product (storing and analyzing your hand histories), to keep your account secure, to operate optional community and ClubGG features you choose to use, to send account-related emails (verification, password reset, and optional product updates), and to improve the study tools through aggregated, anonymized statistics.

Who we share data with

We do not sell your data and we do not use third-party advertising or behavioral tracking SDKs (crash diagnostics tooling like Sentry, listed below, is not advertising or tracking). We do use the following service providers to operate TatoPoker:

• Resend — sends transactional emails (verification, password reset, optional newsletters) on our behalf; your email address is shared with them for this purpose only.
• Discord — if community, ClubGG, or announcement webhooks are enabled, related content (e.g. a ClubGG session summary or a community post excerpt) may be posted to a Discord server. If you link your Discord account, your Discord user ID/username is stored to support that integration.
• Twitch — used only at the application level, to detect when admin-configured streamers go live. This does not involve per-user Twitch accounts or OAuth.
• Google (Firebase Cloud Messaging) — if you enable push notifications in the Android app, your device's push token is shared with Google to deliver achievement and streak-at-risk notifications. No additional personal data is shared beyond the token itself.
• Sentry — used in the Android app only, for crash and error diagnostics. We do not send your email, username, or IP address to Sentry, and session replay and performance tracing are disabled. Only technical crash context (device/OS info, app version, and scrubbed request URLs) is sent when the app crashes or hits an unhandled error.
• Railway — our hosting provider; the application and its PostgreSQL database run on Railway's infrastructure, and all persistent data described above is stored there.

Data retention

We keep your data for as long as your account is active, or as needed to provide the service. If you request deletion (see below), we remove your account data as described.

Your rights: access, correction, and deletion

You can review and update most of your own data (profile, hand histories, notes, study preferences) directly from within the app. To request a copy of your data, a correction, or full deletion of your account and associated data, email us — see Contact below. We do not currently offer automatic self-service account deletion; deletion requests are reviewed and processed manually.

Security

Passwords are stored as salted hashes, never in plaintext. Study data is isolated per account at the database level (row-level security), so one user's hands are never visible to another user's queries. All traffic is served over HTTPS.

Children's privacy

TatoPoker is not directed at children, and we do not knowingly collect data from anyone under 13 years old.

Changes to this policy

If this policy changes, we will update the "Last updated" date above. Continued use of TatoPoker after a change means you accept the updated policy.

Contact