Legal & Privacy

Privacy Policy

Effective 26 October 2026 · Version 2026-10-26

Play-money only. The Poker Tribe is a play-money-only social poker platform intended for entertainment and recreational play. The platform does not offer real-money wagering, gambling, cash prizes or monetary rewards. Virtual chips can never be bought, sold, redeemed or settled for money.

1. Who we are

This Privacy Policy explains how The Poker Tribe ("we", "us") collects, uses, stores and shares personal information when you use our website and games (the "Service"). We act as the data controller (under the GDPR and UK GDPR) and the Data Fiduciary (under India's Digital Personal Data Protection Act, 2023) for the processing described here.

Operator / data controller: OWNER REVIEW REQUIRED: legal name of operator
Registered or business address: OWNER REVIEW REQUIRED: postal address
Contact & grievance email: OWNER REVIEW REQUIRED: monitored contact email
Grievance Officer: OWNER REVIEW REQUIRED: name and designation

2. Scope and play-money nature

The Service is a free-to-play social poker platform. All chips, stacks, balances, winnings and ledgers are virtual gameplay records. They have no monetary value, cannot be bought, sold or redeemed for cash, cryptocurrency, goods, gift cards or anything of value, and we do not process deposits, withdrawals, payouts or payment card data. We do not collect financial information.

3. Information we collect

3.1 Information you give us

Guest players: the display name you choose. No email or password is required.
Registered accounts: email address, username, display name and password. Passwords are stored only as a one-way bcrypt hash; we cannot read them.
Google sign-in (if you choose it): your name, email address and profile picture URL, received through our authentication provider after you approve the sign-in with Google.
Gameplay content: table names and settings you create, chat messages and reactions you send at a table, and gifts or top-up requests you make with virtual chips.
Feedback and requests: the category, your message, an optional reply email and an optional attachment (JPG, PNG, WEBP or PDF). Images are re-encoded on upload to remove embedded metadata such as camera details and location.
Legal acknowledgements: your acceptance of the Terms of Service, Virtual Chips Policy and this Privacy Policy, including confirmation that you are 18 or older, the policy version accepted, the time of acceptance, whether you were a guest or registered player, the IP address used and your browser/device type (user agent). This record is stored on our servers with your account or guest profile so we can show that the confirmations were given and ask again only when the policies materially change. It records what you confirmed; it does not prove that you read the documents, and we do not independently verify your age.

3.2 Information created when you play

Table participation: tables you host, join, watch or were granted access to; seat, stack and session records.
Hand histories and results: actions taken, community cards, cards shown at showdown and hand results. Your private hole cards are only shown to you during play and are stored in hand records for history and replay features you can access.
Virtual chip ledgers and session summaries: buy-ins, top-ups, gifts, corrections and final net figures in play chips.
Player statistics derived from completed hands.

3.3 Technical and security information

A random guest browser identifier (see Section 6) and sign-in session tokens.
IP address and email used in failed sign-in or table-password attempts, used for brute-force protection and automatically deleted after 24 hours.
IP address, browser user-agent, screen size and page associated with feedback submissions, used for troubleshooting, rate-limiting and abuse prevention.
When you submit feedback from a table: the table ID and name, game variant, hand number, game stage, number of players and your seat number. We never attach other players' hole cards or any credentials.
Standard server logs generated by our hosting infrastructure.

3.4 Analytics (only with consent)

If, and only if, you accept optional analytics cookies, we load PostHog product analytics, which may record page views, clicks, device and browser information and session replays of your interactions with the Service. If you reject or do not choose, the analytics script is not loaded. We do not use advertising cookies, do not show targeted advertising and do not sell or share personal information for cross-context behavioural advertising.

4. How we use information

Recognising guests and account holders and keeping you signed in.
Operating multiplayer poker tables, including seating, turn timers, chat and host controls.
Preserving your Recent Tables, completed results, hand histories and play-chip ledgers.
Enforcing the Terms, including fair-play rules and the prohibition of real-money wagering.
Security, fraud and abuse prevention, including rate-limiting and brute-force protection.
Responding to feedback, support, privacy requests and grievances.
Troubleshooting and improving the Service; with consent, product analytics.
Complying with legal obligations and responding to lawful requests.

5. Legal grounds for processing

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (providing the games and accounts you request); legitimate interests (security, abuse prevention, troubleshooting, preserving game records other players rely on), balanced against your rights; consent (optional analytics cookies and optional reply email), which you may withdraw at any time; and legal obligation where applicable. Under India's DPDP Act we process personal data on the basis of your consent given through our notice and acceptance flow, or for legitimate uses permitted by law. You can withdraw consent as described in Section 12; withdrawal does not affect processing already carried out.

6. Cookies, guest recognition and analytics

We use a small number of cookies and browser storage items:

Name	Type	Purpose	Duration
tpt_gid	Essential, first-party, HttpOnly cookie	Random guest browser key that lets us recognise a returning guest browser and restore recent tables	Up to 400 days (browsers may remove it sooner)
session_token	Essential, HttpOnly cookie	Keeps Google sign-in sessions active	7 days
rh_token, rh_is_guest, tpt_no_resume	Essential, local storage	Sign-in token (expires after 7 days) and guest/sign-out state	Until sign-out or cleared
Theme, sound and chat-mute settings; tpt_consent	Functional, local storage	Remembers your display preferences and cookie choice	Until cleared
PostHog (ph_*)	Optional analytics	Product analytics and session replay. Loaded only after you accept	Per PostHog settings, up to 1 year

Guest identity

The guest cookie helps identify a returning browser so you can see the tables you previously joined without signing in.
Browser recognition is not the same as a registered account. Anyone using the same browser profile may see that browser's recent tables.
Clearing cookies, using private browsing or switching browsers or devices may prevent automatic recovery of your guest history.
A registered account keeps its own account-linked history across devices.
You can use "Forget this browser" under Recent Tables to revoke the guest key on our servers and remove the cookie. Game results and ledgers other players rely on are kept.

Essential cookies and storage are strictly necessary to sign you in, recognise your guest browser, keep tables and settings working and protect the Service. They do not track you across other websites, are not used for advertising and do not require consent. Your acceptance of our policies is recorded on our server, not in a cookie.

Essential cookies are necessary to provide the Service and do not require consent. Rejecting optional cookies never disables sign-in, guest recognition or gameplay. You can change or withdraw your choice at any time via . We do not currently respond to browser "Do Not Track" signals because analytics already stay off without your consent; we treat a Global Privacy Control signal as a rejection of optional analytics where required by law.

7. Tables, invitation links and game history

Private invitation links and room codes may give access to anyone holding a valid link or code. Treat them like a key and share them only with intended players.
Active gameplay information (display names, stacks, actions, chat and cards revealed at showdown) is visible to authorised participants and spectators of that table according to the game's rules. Your hole cards are visible only to you unless shown at showdown or by your choice.
Completed results and ledgers may be viewable by anyone holding the corresponding results or replay link.
Host and owner controls (approvals, settings, removing access, ending a game) remain restricted to the authorised host.
Please avoid sharing screenshots or links that contain your or other players' personal information with unintended recipients.

We do not sell personal information. We share information only as needed to run the Service:

Our application hosting, database and private file-storage provider, which operates the infrastructure the Service runs on, including storage of feedback attachments.
Our authentication provider and Google, when you choose Google sign-in.
PostHog analytics (through our provider's analytics endpoint), only if you consent.
Other players, as described in Section 7.
Authorities or other parties where required by law, to enforce our Terms, or to protect the rights, safety and security of users and the Service.
A successor entity in the event of a merger, acquisition or reorganisation, subject to this Policy.

OWNER REVIEW REQUIRED: list the legal names of the hosting, storage, authentication and analytics providers and confirm data-processing agreements

9. Storage and cross-border transfers

Your information may be stored and processed outside your country of residence, including outside India, the EEA and the UK. Where required, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses, and we comply with any transfer restrictions notified under India's DPDP Act.

OWNER REVIEW REQUIRED: confirm the server and storage locations and the transfer safeguards in place

10. Retention

Failed sign-in and table-password attempt records: deleted automatically after 24 hours.
Sign-in tokens and Google sessions: expire after 7 days.
Guest browser cookie: up to 400 days in your browser; the server-side guest key remains until revoked through "Forget this browser" or a deletion request.
Account, table, hand-history, ledger and statistics records: kept while your account or the relevant game records are needed to provide the Service, because other players' completed results depend on them. On deletion we remove or de-identify your personal information where we are able to.
Feedback, attachments and requests: kept as long as needed to handle the matter and keep a record of requests.
Information may be retained for longer where required by law or to resolve disputes.

OWNER REVIEW REQUIRED: approve fixed retention periods for accounts, inactive guests, game records and feedback

11. Security

We use measures appropriate to a play-money social service, including HTTPS for data in transit, HttpOnly and Secure cookies, bcrypt password hashing, rate-limiting and brute-force protection, server-side permission checks for tables and admin functions, server-side validation of uploads, and private storage of feedback attachments that are accessible only to authorised administrators. No system is completely secure. If we become aware of a personal data breach, we will notify affected users and authorities where required by law.

12. Your privacy rights

Depending on where you live, you may have the right to:

access a copy of, or a summary of, your personal information and how it is processed;
correct inaccurate or incomplete information, or update it (you can change your display name in your profile);
delete your account or guest data, subject to legal retention obligations and to preserving other players' legitimate completed-game results, which we de-identify where appropriate;
withdraw consent, including for optional analytics, at any time;
object to or restrict certain processing, and data portability (GDPR/UK GDPR);
nominate another person to exercise your rights in the event of death or incapacity (India DPDP Act);
know, delete and correct personal information and not be discriminated against for exercising your rights (California and other US state laws). We do not sell or share personal information for cross-context behavioural advertising;
lodge a complaint with a supervisory authority, including the Data Protection Board of India, an EU/EEA supervisory authority or the UK Information Commissioner's Office.

13. Making a request

Submit a privacy request through our Contact page by choosing "Privacy / Data Request", ideally while signed in or from the browser that holds your guest session. To protect you, we verify that the request comes from the account or guest session concerned before disclosing or changing any information, and we may ask for additional confirmation. We aim to respond within one month, or sooner where local law requires. Deleting your data will not alter or erase other players' completed-game results; your name in those records will be removed or de-identified where appropriate.

14. Children and age limits

The Service is intended only for adults aged 18 or over, or any higher age required where you live. We ask every player to confirm they are 18 or older before playing. We do not knowingly collect personal information from children. If you believe a child has used the Service, contact us and we will delete their information.

15. Regional disclosures

India: this notice is provided under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as they come into force in phases. Notices and grievance handling are available in English. OWNER REVIEW REQUIRED: confirm whether notices in additional Indian languages are needed

EEA and UK: see Sections 5, 9 and 12 for legal grounds, transfers and rights. OWNER REVIEW REQUIRED: confirm whether an EU/UK representative is required

California and other US states: in the last 12 months we have collected identifiers (name, email, IP address, cookie IDs), internet activity (gameplay and, with consent, analytics) and user-provided content (chat and feedback), for the purposes in Section 4. We have not sold personal information or shared it for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics.

16. Complaints and grievances

For complaints about privacy, misuse or content, use the Contact page and choose "Grievance / Report Misuse", or contact our Grievance Officer using the details in Section 1. We will acknowledge grievances and aim to resolve them within the timelines required by applicable law.

17. Changes to this policy

We may update this Policy. We will change the effective date above and, for material changes, notify you within the Service before they take effect.