Privacy Policy

DirtyStack Poker is run by Table Master Gaming, Inc. TableMaster also makes the software some poker rooms use to run their games. For privacy questions, email privacy@tblmaster.com.

You must be 18 or older to use DirtyStack Poker.

• Sign-in details. Your email address and password, or the account you use with Sign in with Apple, Google or Facebook. From Apple, Google or Facebook we get your name and email address. We do not import your profile photo from them.
• Your phone number. Every account needs a verified mobile number. We send the code by text message through Twilio. Your number identifies your account. It also links your account to the player record a poker room already has for you, so your results and points follow you. Staff at poker rooms that use TableMaster can see your name and phone number to find your record. We do not use your number for marketing.
• Your age. We ask for your date of birth to confirm you are 18 or older. We do not store your date of birth. We store only the date and time you confirmed it.
• Your agreement. We keep a record of which version of our Terms of Service your account accepted, and when.

• What you add: your handle, first and last name, bio, profile photo or avatar, and your home poker room and region.
• What other players see: your handle is always public. Your name, bio, photo and home room are public unless you make them private in Edit Profile. Other players can also see who you follow and who follows you, the tournaments you plan to attend (you can turn this off in Edit Profile), and wins you add yourself (the tournament, venue, date, finish and amount won).
• Leaderboards: poker rooms record tournament results, entries and points. These appear on public leaderboards, in the app and on the web, under your public name.

To keep DirtyStack Poker safe, we check profile photos and profile text for inappropriate content before other players can see them. OpenAI, an AI company, does the check. We send OpenAI only the photo or the text being checked: your photo, name, handle or bio, or the names in a win you add. We do not send your email address, phone number or account ID.

• In the app, you choose. The app asks before it sends anything. If you say no, you keep your account, but you can't add or change anything other players see, and your name is hidden from them. You can change your choice any time in Settings > App Experience > Content checks by OpenAI.
• If the check can't run when you create your profile, the app picks a temporary handle for you and keeps your name private. You can set your own in Edit Profile once the check is back.
• On the website, your handle and name are checked when you create a profile.
• We keep a record of each check: the result and up to the first 280 characters of the text. We do not keep photos that fail the check.

• The app lets you keep private notes about players and hands, and a log of your sessions (for example stakes, buy-in and cash-out).
• Other players and poker rooms cannot see them.
• The app encrypts the text and amounts on your device before they are sent to us. We manage the encryption keys, so this is not end-to-end encryption.

• If you report a player, we keep your report: the reason, what you wrote, and a copy of their profile at that moment. We email it to our team, and we review every report within 24 hours.
• If you block a player, only you can see that. They are not told.

• In the app: we ask for your location only when you choose to see rooms or events near you. The app uses it on your device to sort by distance and pick your region. Your location is not sent to us or stored by us.
• On the website: the site can ask your browser for your location. We send the coordinates to our server and to Google's geocoding service to find your city and region, and we save your location in your browser. We also estimate your region from your IP address. The Terms, Privacy, Support and Data deletion pages never ask for your location.

• If you allow notifications, we store a push token for your device, its platform and its device name. We send notifications through Expo's push service, which passes them to Apple or Google.
• You choose which alerts you get in Settings > Notifications. This includes occasional news and offers from DirtyStack, which are off until you turn them on there.

• Camera and photos: used only to take or choose a profile photo.
• Calendar (iPhone and iPad): used only to add a tournament you choose to your calendar. The app reads the list of your calendars so you can pick one. It does not read your events.
• Face ID or Touch ID: optional, to lock the app. Your device does the check. We never receive your face or fingerprint data.
• Wallet: when you add your player card to Apple Wallet, we create a pass with your name, handle, player number, a QR code with your account ID, and your photo. We do not keep a copy. If you use Google Wallet, Google stores the pass with your name, handle, player number and QR code.

• In the app: we use PostHog (US) to understand how the app is used. It records events, such as opening the app and the features you use, with your account ID, device model, app version, language and time zone. It also records the IP address your device uses and the approximate location that address suggests, such as your city. Analytics are on by default. You can turn them off any time in Settings > App Experience > Share usage analytics.
• On the website: we use Vercel Web Analytics and PostHog. In the EEA and UK they run only if you agree. Elsewhere they run unless you opt out in Your Privacy Choices. On the website, PostHog can record your visit (what you click and see on the page) and build heatmaps. Vercel Speed Insights measures how fast pages load on every visit.

We use Sentry (US) to find and fix crashes and errors. Error reports include your account ID, device and app details, and technical details of what failed, including the steps just before it. In the app, error reports do not include your email address or IP address.

• In the app, Apple or Google handles purchases. We use RevenueCat to check your subscription, and it receives your account ID.
• On the website, Stripe handles payments. We never see your full card number.

• We use Resend to send account emails, such as confirming your email address, resetting your password and security notices.
• Our team gets an email when a new account is created (with its email address, name, handle and sign-in method), when a player is reported, and when you send feedback.
• When you send feedback in the app, we keep your message and topic, your account ID, email address and name, and your app version and device system version.

• If you ask us to tell you when DirtyStack Poker comes to your area, we store your email address and IP address.
• Comments you post on The Rail are stored with your account.

We show sponsored placements labeled “Sponsored”. We serve them ourselves and count views and clicks with PostHog. We do not use ad networks, and we do not track you across other companies' apps or websites.

We share information only to run DirtyStack Poker, with these service providers:

• Supabase (US): hosting, database, sign-in and file storage
• Vercel (US): website hosting and website analytics
• OpenAI: content checks
• Twilio: phone verification codes
• Resend: email
• Expo: push notifications
• PostHog (US): usage analytics
• Sentry (US): error reports
• RevenueCat: app subscriptions
• Stripe: website payments
• Apple, Google and Meta (Facebook): sign-in with their accounts, maps, Wallet and notifications

Each provider gets only what it needs to do its job, and must protect your information at least as well as this policy does.

Poker rooms that use TableMaster see your player record, as described above. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Manage your optional analytics and tracking preferences any time with Your Privacy Choices.

• Contract: providing your account, profile, leaderboards, notes and notifications.
• Consent: website analytics, content checks by OpenAI in the app, and location and notifications through your device's permissions.
• Legitimate interest: keeping players safe (reports, blocks and content checks on the website), app analytics you can turn off, fixing errors, and securing accounts.

• In the app: Edit Profile (what is public), Settings > App Experience (analytics and content checks), Settings > Notifications, your device settings (location, camera, photos, calendar, notifications), and Settings > Security > Delete account. If you signed in with Apple, deleting your account also asks Apple to disconnect DirtyStack Poker from your Apple sign-in.
• On the website: Your Privacy Choices, for analytics.

EEA/UK visitors may also request access, correction, deletion, restriction, or portability where applicable, and lodge a complaint with a supervisory authority.

To delete your DirtyStack Poker account and the data attached to it, see our account deletion instructions. You can delete it yourself in the mobile app, or email us and we will do it for you. The app is not required either way. That page also covers exactly what is removed and what is kept.

California residents (and residents of other US states with similar laws) may have additional rights, including knowing what categories of personal information we collect and requesting deletion. We currently do not sell or share personal information for cross-context behavioral advertising. If that changes, you can opt out any time via Your Privacy Choices, and we honor Global Privacy Control (GPC) browser signals as a valid opt-out.

We keep account data while your account is active. Analytics and error data are kept under our providers' settings (PostHog, Vercel, Sentry).

Deleting your account does not erase every record, and the difference matters. Permanently deleted: your sign-in account, your profile and profile photo, your notes and sessions, your account activity history, and tournament actions recorded against you as the person who performed them. Anonymized rather than deleted: your player record, where your display name is replaced with “Deleted player” and your phone number and the link to your account are cleared. Kept, but no longer linked to your account: tournament results, entries, and points recorded by the poker rooms you played at, which are those rooms' own competition records; reports you made or that were made about you; and records of content checks, including text excerpts. Reports and check records can still include your name, handle or words you wrote at the time. Emails already sent to our team are not recalled. Our account deletion page lists each item in full.

DirtyStack Poker is for people 18 or older. We do not knowingly collect information from anyone under 18.

We may update this policy. Material changes will be reflected by updating the date above and, where required, prompting you to review cookie preferences again.