Privacy policy

Last updated: 18 October 2026

1. Controller

The controller for the processing of personal data on poker-studio.org, app.poker-studio.org, api.poker-studio.org and play.poker-studio.org is me:

Email: [email protected]
Contact form: app.poker-studio.org/kontakt?lang=en

I have not appointed a data protection officer; there is no obligation to do so (§ 38 BDSG).

The German and the English version of this policy are equally valid.

2. Overview

Poker Studio is a tool for poker players (hand tracker, hand replayer, trainer) and is currently in a closed beta. I process personal data only as far as necessary to run the website, handle beta requests and contact requests, and provide the app. I do not sell data, do not use advertising, tracking or analytics cookies, and do not use any service for visitor statistics.

3. Hosting and visiting the pages

Poker Studio runs on these services:

• The start page (poker-studio.org) and the web app (app.poker-studio.org) are delivered by Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.
• The app’s API (api.poker-studio.org) and your stored data are on my server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in the Falkenstein data centre (Germany). All connections to the API run encrypted through Cloudflare’s network (proxy): Cloudflare receives the connection, protects it against attacks and forwards it to my server. The content you transfer (for example hand histories) passes through Cloudflare as well.
• The public hand replayer and shared hands (play.poker-studio.org) run on Cloudflare Workers; Cloudflare stores the shared hands in a D1 database (section 11). Cloudflare’s Workers logs are switched on for troubleshooting; they contain request data such as time, requested address and technical request details.

Cloudflare processes the content transferred and the logs of my Cloudflare account (customer logs) on my behalf. In addition, Cloudflare processes certain technical network and security data under its own responsibility, in particular to secure its network. Cloudflare explains the details in its privacy policy: www.cloudflare.com/privacypolicy.

Every visit processes technically necessary data: IP address, date and time, requested address, amount of data transferred, and browser and operating system (user agent). The purpose is delivering the pages, keeping the service secure and finding errors. The legal basis is Art. 6 (1) (f) GDPR; my legitimate interest is a secure and working service.

On my server I delete the web server’s access logs (nginx) after 14 days and the system log (journald) after 30 days. Cloudflare deletes the Workers logs after 3 days.

4. Spam protection without a captcha provider

I protect the “Request an invite” form (app.poker-studio.org/einladung) and the contact form (app.poker-studio.org/kontakt) against automated requests with a proof-of-work method (ALTCHA). I do not use an additional captcha provider for the spam protection. The locally delivered program solves a computing task; my server checks the solution. The hosting providers described in section 3 remain involved in the technical transmission. The program is part of the app, sets no cookies and stores nothing in your browser’s storage. The task contains no information about you and is valid for at most 10 minutes. In addition, both forms contain a field that is invisible to people and only filled in by bots. The legal basis is Art. 6 (1) (f) GDPR; my legitimate interest is protecting the forms and other people’s mailboxes against abuse.

5. Closed beta requests

When you request an invite, I process:

• your email address,
• your answer to the question why you would like to join,
• game type, hands per week and the platforms you play on,
• the language you chose, the time of your request and of your confirmation, the processing status, and the version (the date) of this privacy policy you took note of,
• if I decline, the reason I send you.

The purpose is reviewing your request, sending the related emails and, if I accept, enabling your email address for registration. The legal basis is Art. 6 (1) (b) GDPR (handling your request to join the beta). With the checkbox “I have taken note of the privacy policy” you only confirm that you have seen this information; it is not consent.

Required are email address, reason, game type, hands per week, platforms (with “Other” also its name) and the two checkboxes. You are not obliged to provide them, but without them I cannot handle your request.

To prevent abuse I count how many requests come from your IP address (at most 5 per hour). For this counter I keep the IP address only in the server’s memory and never write it to a file or database; only requests of the last hour count, and a restart of the server deletes all entries (Art. 6 (1) (f) GDPR).

Double opt-in

After you submit the form, you receive an email with a confirmation link that is valid for 48 hours. The link opens a page with the button “Confirm request”; only your click on it confirms the request. Only after the confirmation is your request shown in my processing area and handled by me. This prevents a request from being processed without access to the mailbox given. My server deletes unconfirmed requests older than 7 days in its hourly cleanup.

Retention

I delete the data of your request when the beta ends, at the latest 12 months after your request (my server’s daily deletion run), and at any time earlier if you ask me to. If I accept your request, I keep your email address and your account identifier in the list of beta members as long as your membership exists, that is until your account is deleted.

6. Contact form and emails to me

You can send me a message through the contact form (app.poker-studio.org/kontakt?lang=en). Required are your email address and the message; without them I cannot answer you. Your name is optional. The form sends exactly one email to my mailbox [email protected], with your address as the reply-to address. The message is not stored in a database or file on my server. To prevent abuse, the spam protection of section 4 and the same IP-based limit as for beta requests apply (at most 5 per hour, in memory only).

The purpose is answering your message. The legal basis is Art. 6 (1) (b) GDPR if it concerns your beta participation or your account, otherwise Art. 6 (1) (f) GDPR (my interest in answering inquiries). The same applies to emails you write to me directly. I delete contact messages once your inquiry has been handled, at the latest after 12 months.

7. Sending emails and mailbox

My mailbox [email protected] is a mailbox of its own at ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany; it does not forward anything to other mailboxes. I also send the emails about your beta request (confirmation, acceptance, rejection) through All-Inkl’s mail server. This processes your email address, the content of the email and the time it was sent. The legal basis for the emails about a beta request is Art. 6 (1) (b) GDPR.

I delete emails about a beta request from the mailbox once the request is closed, at the latest after 12 months. The email confirming your address at registration is not sent by All-Inkl but by Auth0 (section 8).

8. Registration and sign-in

For registration and sign-in I use Auth0, a service of Okta, Inc., 100 First Street, San Francisco, CA 94105, USA. My Auth0 tenant runs in the EU region. It processes your email address, your password (stored by Auth0 as a hash only), sign-in times, and IP address and browser data to secure the sign-in. Auth0 sends the email confirming your address. The legal basis is Art. 6 (1) (b) GDPR (providing your account). Your Auth0 account exists until it is deleted. Auth0 deletes the sign-in logs after 1 day.

If you sign in with Google, I receive the profile data needed for this (identifier, email address, name) from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If you connect Discord in the settings, I receive the profile data needed for this (identifier, username, where applicable email address) from Discord Netherlands BV, Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands. Google and Discord also process data under their own responsibility according to their own privacy policies.

Checking the approval

During the beta, only people whose email address I have approved can register. For this, Auth0 asks my server at registration whether your address is approved. A registration with email and password without approval is rejected by Auth0 before an account is created. At the first sign-in with Google or with a Discord account that is not linked, Auth0 creates the account first. Without approval, the sign-in is rejected and the deletion of the temporarily created account is triggered immediately. Failed deletions are carried out again. Every rejected attempt leaves an entry in Auth0’s sign-in logs (1 day). If a temporary account was created with Google or Discord in the process, the rejection also leaves an entry with the account identifier in my server’s system log (30 days). On every access my server checks whether your account belongs to the beta; it keeps the result in memory for at most 60 seconds. The legal basis is Art. 6 (1) (b) and (f) GDPR (protecting the closed beta).

9. Storage in your browser

The app stores only the following entries in your browser. Each one states its purpose and why it is necessary for the feature you explicitly use (§ 25 (2) no. 2 TDDDG):

• Sign-in data from Auth0 in the local storage (localStorage) of app.poker-studio.org: access token (valid for 10 hours), ID token and refresh token, and a cookie that only shows whether you are signed in. Purpose: you stay signed in without signing in again on every visit. The refresh token is valid for at most 30 days and expires after 15 days without use. This data is removed when you sign out.
• For the sign-in process, Auth0 temporarily stores technical transaction data in sessionStorage, in particular security values that match and protect the sign-in. Purpose: protecting the sign-in against forged responses. It is deleted as soon as the sign-in completes or you close the tab.
• On the sign-in page (pokerstudio.eu.auth0.com) Auth0 sets its own cookies for the sign-in session and to protect the sign-in. Purpose: you do not have to enter your password at every sign-in. The session ends after 3 days without use, at the latest after 7 days.
• The theme (light/dark) only after your choice: until you switch the theme yourself, the default applies and nothing is stored. Purpose: your choice also applies on your next visit.
• Settings of the hand list and the replayer, seat layouts, and the display name and social links you enter for shared hands. Purpose: your own settings are kept.
• Filters and saved filter profiles of the hand list. Purpose: on your next visit the hand list shows the selection you last set or saved as a profile.
• Trainer: the current training round, your trainer options and the queues of answers from training, flashcards and equity training not yet sent to my server. Purpose: no answer is lost when the connection drops; every answer leaves the queue as soon as my server has confirmed it.
• On the start page the theme and whether animations are paused, in the public replayer the replayer settings (table design, card style, playback speed), each only after your choice. Purpose: your choice also applies on your next visit.

Everything except the sign-in data stays until you change it in the app or delete the site data in your browser. The public pages (invite, contact, legal notice, privacy policy) keep the language and a theme passed on by the start page only in the address, not in your browser.

10. Data in the app

What you store in Poker Studio (imported hand histories, notes and thoughts on hands, ranges, trainer results, settings) is processed on my server at Hetzner in Germany to provide the features to you (Art. 6 (1) (b) GDPR). The transfer runs through Cloudflare (section 3). I keep this data until your account is deleted; on request I delete your account with all app data, an informal email is enough.

Data of other players

Hand histories also contain the player names (screen names) of the other players at the table and their actions. I process them only so that you can view and analyse your hands, and I do not combine them into profiles of other players (Art. 6 (1) (f) GDPR; the legitimate interest, mine and yours, is analysing your own game). When you share a hand, I replace every player name with the seat position (for example “BTN”) and yours with “Hero”; hand number, table name, tournament ID and the time of the hand are not included in the shared hand.

Information for other players (Art. 14 GDPR)

This paragraph is addressed to players who appear in the hand histories of other users. When other users upload hand histories, I may receive your player name and your actions in the game from them, even if you do not have an account at Poker Studio yourself. The source is the hand histories of their poker site that these users provide. I process this data only so that the uploading user can view and analyse their own hands (Art. 6 (1) (f) GDPR), and I do not combine it into profiles. The data is kept as long as the hand in question stays in the uploading user’s account.

You have the right of access, the right to object and the right to erasure. Write to me via the contact details above and state your player name and the poker site; I handle such requests manually. I cannot notify you individually, because the only thing I know about you is the player name (Art. 14 (5) (b) GDPR); therefore I provide this information here.

11. Shared hands

When you share a hand, anyone who knows its link can view it. What is stored is the hand with replaced player names and without direct hand identifiers (section 10), plus the details you choose when sharing: if you want, the result and your opponents’ cards at showdown, your thoughts on the hand and up to two questions. What you write there yourself may contain personal details. The shared hand is kept in Cloudflare’s D1 database. Internally the link stays assigned to your account: on my server I store which of your hands you shared under which link, and Cloudflare stores a pseudonymous owner identifier for it. The legal basis is Art. 6 (1) (b) GDPR.

The shared hand stays stored until you delete the link. On deletion I remove the active share and its preview image. Restore copies of the D1 database (Cloudflare Time Travel) may still contain them for up to 7 days. Browsers and caches may keep the link’s preview image (for example for previews in messengers) for up to 1 year; such copies remain after the link is deleted until then. I cannot recall copies that others have already saved or passed on.

12. AI access

In the settings under “AI access” you can give an AI tool of your choice (for example Claude, ChatGPT, Gemini or Codex) or a script of your own access to your account, for instance to import hand histories, read or change ranges, or analyse trainer results. There are two ways:

• a personal access key (token) that you create and enter in your tool yourself; it covers the areas (scopes) you choose and expires after the period you choose, from 1 to 365 days,
• a connection via OAuth: you approve the access on a page of the app, and the tool receives access tokens for it, each valid for 1 hour; the approval itself is valid for 90 days.

On your instruction, my API provides the connected tool with the data covered by your approval. With a locally run tool, the data is provided to that tool; with a cloud service, its provider receives the data fetched. Who the recipient is and in which country it is located follows from the tool you choose; its privacy policy applies to the processing there. If the provider is located outside the EU, the transfer takes place on your explicit instruction in order to perform the service you requested (Art. 49 (1) (b) GDPR). I do not use any AI of my own for this feature. You can revoke the access key or the OAuth approval at any time in the settings.

For this I store on my server at Hetzner in Germany:

• Access keys: not the key itself, only its hash (SHA-256), plus name, scopes, type of access, the times of creation, expiry, rotation and revocation, and a recognition hint (the first six and the last two characters). You see the full key only once, when you create it.
• Access log: for every access and every management action the time, the access identifier, the function called, the result, the shortened IP address (IPv4 to /24, IPv6 to /48), the shortened identifier of the calling program (user agent, at most 80 characters) and quantities (for example the number of imported hands), no content. You can see this log yourself in the settings. My server deletes entries older than 90 days in its daily deletion run.
• System log: for every access my server also writes a line with your account identifier, the access identifier, the function called, quantities and, for imports, the file name to the system log (journald); it is deleted after 30 days.
• To limit the frequency of access, my server counts accesses in memory only.

Revoked or expired accesses no longer work; their entry stays visible in your list. When your account is deleted, I delete all accesses and the access log with it. The legal basis is Art. 6 (1) (b) GDPR. AI access is optional; Poker Studio is fully usable without it.

13. Recipients and transfers to third countries

Only these recipients receive your data:

• Cloudflare, Inc., USA (delivery of the start page and the web app through Cloudflare Pages, proxy in front of the API, replayer and shared hands through Cloudflare Workers with Workers logs and D1 database), on my behalf; certain technical network and security data under its own responsibility (section 3). Transfer to the USA on the basis of the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR) and the European Commission’s standard contractual clauses (Art. 46 (2) (c) GDPR). Privacy policy: www.cloudflare.com/privacypolicy, data processing agreement: www.cloudflare.com/cloudflare-customer-dpa.
• Hetzner Online GmbH, Germany (server for the API and app data), on my behalf.
• ALL-INKL.COM – Neue Medien Münnich, Germany (mailbox and sending emails), on my behalf.
• Okta, Inc. (Auth0), USA, tenant in the EU region (registration and sign-in), on my behalf. Where data reaches the USA: EU-US Data Privacy Framework (Art. 45 GDPR) and standard contractual clauses (Art. 46 (2) (c) GDPR). Privacy policy: www.okta.com/legal/privacy-policy.
• Google, only if you sign in with Google: Google Ireland Limited, Ireland, under its own responsibility. Google also transfers data to Google LLC, USA, on the basis of the EU-US Data Privacy Framework (Art. 45 GDPR). Privacy policy: policies.google.com/privacy.
• Discord, only if you connect Discord: Discord Netherlands BV, Netherlands, and Discord Inc., USA, under their own responsibility. Transfer to the USA on the basis of the EU-US Data Privacy Framework (Art. 45 GDPR) or the standard contractual clauses (Art. 46 (2) (c) GDPR). Privacy policy: discord.com/privacy.
• Anyone who knows the link of a hand you shared (section 11).
• The AI tools you connect yourself, with a cloud service its provider, with the data they fetch through your access; recipient, country and basis of the transfer (Art. 49 (1) (b) GDPR) see section 12.

Beyond that, I only pass on your data if I am legally obliged to.

You can obtain information on the transfer safeguards used in each case and a copy of the relevant safeguards on request via the contact details above.

14. Retention at a glance

• Web server access logs (nginx): 14 days.
• Server system log (journald): 30 days.
• Backups taken before updates on the server: at most 31 days.
• Workers logs at Cloudflare: 3 days.
• Sign-in logs at Auth0: Auth0 deletes them after 1 day.
• Auth0 refresh token in your browser: 30 days, expires after 15 days without use.
• Sign-in session at Auth0: ends after 3 days without use, at the latest after 7 days.
• Unconfirmed beta requests: 7 days (hourly cleanup).
• Beta requests: until the beta ends, at the latest 12 months after the request (daily deletion run).
• List of beta members (email address, account identifier): as long as the membership exists.
• Emails about beta requests in the mailbox [email protected]: until the request is closed, at the latest 12 months.
• Contact messages: until the inquiry has been handled, at the latest 12 months.
• IP addresses for limiting requests: in memory only, only the last hour counts.
• Account and app data (also at Auth0): until your account is deleted.
• AI access log: 90 days (daily deletion run).
• Shared hands: until you delete the link; in restore copies of the D1 database up to 7 more days; preview images in caches up to 1 year.
• Data of other players in hand histories: as long as the hand stays in the uploading user’s account.
• Data in your browser: see section 9.

15. Your rights

You have the right to

• access the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object (Art. 21 GDPR, section 16).

An informal email to [email protected] or a message through the contact form is enough.

16. Right to object

You can object at any time, on grounds relating to your particular situation, to the processing of your data that I base on Art. 6 (1) (f) GDPR (Art. 21 (1) GDPR). This concerns above all the server and access logs, the spam protection and the request limit, answering contact messages outside your beta participation, and the data of other players in hand histories. I will then no longer process the data unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An informal email to [email protected] is enough.

17. Complaint to a supervisory authority

You can lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The authority competent for me is:

18. No automated decisions

I decide on beta requests myself. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.