Privacy Policy

Username — required, and public: it is the name you sit under at the table and the name on leaderboards.

Password — stored only as a salted hash. We cannot read it, and a copy of our database does not reveal it.

Recovery email — required. You give one when you create your account. It is used for exactly two things: confirming the address is yours, and sending a password reset you asked for. It is never shown to other players and never used for marketing. You can remove it later in Settings, but then we cannot help you recover a lost password.

Optional profile details — a chosen avatar, a one-line “about”, and a favourite starting hand, all public on your profile. Avatars come from a fixed catalog; there is no image upload anywhere in the product, deliberately.

Terms acceptance — which version you agreed to, and when.

Playing generates records we keep so the game works and your history is real: hands, betting actions and results; who sat where; chip movements and session results; your wallet and bankroll; achievements; and table snapshots so a table survives a restart.

Every chip credit gets a receipt — purchases and free grants alike — so a balance can always be accounted for.

Chat messages are not stored. They pass between players in the moment and are never written to the database.

One cookie: poker_token. It signs you in and nothing else — httpOnly so no script can read it, sent only over HTTPS, expiring after 30 days. There are no advertising, analytics, or tracking cookies.

Local storage stays local. Your felt colour, card back, chip style, volume and similar preferences are saved in your own browser. They reach us only if you are signed in, and only so your table looks the same on your next device.

IP addresses. The game uses your IP in memory to rate-limit sign-ins and password resets — it is never written to the application database. Separately, our web server keeps standard access logs (IP, time, URL, browser), as essentially every web server does. We use them to count visitors and to investigate abuse and faults. They rotate and are eventually discarded.

Bug reports — only if you send one. Your message plus technical context: browser, screen size, the table and hand you were on, and the build.

The absences matter as much as the list above:

• No analytics service. No Google Analytics, no Tag Manager, no product analytics.
• No advertising or social trackers. No Meta pixel, no conversion tags. The site loads exactly one third-party script, and it is not an advertising one: Cloudflare Turnstile, on the signup form only, which checks that a new account is being opened by a person rather than a script.
• No uploaded images. Not from you, not of you.
• No payment card details. Chip purchases are not live. When they are, a payment processor will handle them and card numbers will not reach our servers.
• No location tracking, contacts, or device fingerprinting.
• We do not sell, rent, or trade your information. There is no data-broker relationship of any kind.

Some pages reserve space for advertising, currently empty — no ad network is loading. If that changes, this policy changes with it, first.

To run your account and keep you signed in; to deal cards, settle hands and keep chip balances correct; to show your record, stats and the leaderboards; to send a password reset or verify an address when you ask; to stop abuse through rate limits, flood protection and filtering; and to find and fix bugs.

We do not profile you for advertising, and we make no automated decisions about you with legal effects.

Only the services needed to run the site:

• DigitalOcean — hosts the server and database (United States)
• Brevo — sends verification and password-reset email
• Cloudflare — runs the human check on the signup form (Turnstile). It sees your IP address and browser signals at the moment you create an account, and is not loaded on any other page.
• Google Workspace — receives mail sent to bad-poker.com
• Let’s Encrypt — issues the HTTPS certificate (no personal data)

We may also disclose information if the law requires it, or to protect the Service and its players from harm or fraud.

Account data stays while your account exists. Game records are kept as the permanent record of play — they are what your career page and the leaderboards are built from. Receipts are kept as the audit trail behind chip balances. Server logs rotate and are discarded on a rolling basis.

If you ask us to delete your account, we remove your account and personal details. Some records may survive in anonymised form where removing them would break another player’s game history or the chip ledger.

• Remove your email. A recovery address is required to sign up, but you can clear it afterwards in Settings; the trade-off is that we cannot then help you recover a lost password.
• Change or remove your email, avatar, about line or favourite hand at any time in Settings.
• Ask for a copy of your data, a correction, or deletion — write to admin@bad-poker.com from the address on the account.

Depending on where you live you may have further rights — access, portability, objection, or complaint to a regulator. We honour these requests wherever you are.

Passwords are salted and hashed. Login, password-reset and email-verification tokens are stored hashed, so the raw value exists only in your browser or in the mail we sent you — a copy of our database does not let anyone sign in as you. Reset and verification links are single-use and short-lived, and using a reset signs out every existing session. The site is served over HTTPS.

No system is perfectly secure, and we do not claim otherwise.

BAD POKER is for adults: 18 or older, or the age of majority where you live if it is higher. We do not knowingly collect information from anyone under 18. If we learn we have, we delete the account.

On servers in the United States. If you are elsewhere, using the Service means your information is transferred there.

If we change it materially — new tracking, a new category of data, a new recipient — we will update the version and date above and say so in the product before the change takes effect.

Questions, requests, or complaints: admin@bad-poker.com.

By post: Bad Poker LLC, 5900 Balcones Drive STE 100, Austin, Texas 78731.