Privacy Policy

Updated October 22, 2026. This version reorganizes the policy and adds: a table of the information we collect and where it comes from, our legal bases under EU and UK law, a named list of service providers, retention by category, how to use your privacy rights and how fast we respond, a California notice (including “Do Not Sell or Share” and Global Privacy Control), other US state rights, the AI connector, and how we handle security incidents. Visitors in Europe are now asked before any ad cookies are set, as visitors in California already were. Earlier sections on shared games, game links, Apple account deletion and website cookies are kept.

This Privacy Policy explains how HG Poker (“HG Poker,” “we,” “us,” or “our”) collects, uses, shares and keeps personal information when you use HG Poker’s mobile apps, web app, websites (including hgpoker.io, app.hgpoker.io and play.hgpoker.io), game links, shared displays, AI connector and support services (together, the “Service”). We are the controller of this information, except where we process information on behalf of a host as described in Section 3.

Who we are. HG Poker is published and operated by Keven Bermeo. That includes the HG Poker apps, the hgpoker.io website, the HG Poker web app and the “HG Poker for Claude & ChatGPT” connector; Keven Bermeo also distributes the app on the Apple App Store. On Google Play, the app is distributed through the developer account Lead Catch LLC, a Georgia (United States) limited liability company. “We” means Keven Bermeo and, for the app obtained through Google Play, Lead Catch LLC. A dedicated HG Poker company is being formed; when the Service moves to it, we will update this Policy and tell you. You can reach us at keven@hgpoker.io.

HG Poker is scorekeeping and bookkeeping software for privately arranged, in-person poker games. It records buy-ins, rebuys, chip counts, results and who owes whom, as typed in by users. It does not accept wagers, hold or move money, process payments between players, deal cards or run online poker. The money amounts in HG Poker are records, not transactions.

1. Information we collect

The table lists what we collect, where it comes from, and why.

We do not collect GPS or background location, contacts, or biometric information. A location typed into a game is just text. The country in our records comes from your device’s language and region setting, not from your location. We do not ask for bank account or card credentials. Please do not put sensitive information (such as health information or government ids) in notes, names or support messages.

2. How we use information and our legal bases

If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, we must have a legal basis for each use. We rely on:

We do not use the information in your game records for advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We use setup answers and subscription history to decide which plan screens and offers to show; this never denies you the Service.

3. Shared games, standings and game links

HG Poker is built for shared tables, so information you enter is not private to you alone. Hosts and participants can see shared game information, including player names, buy-ins, rebuys, chip counts, results and settlement status. When a host has Pro, eligible connected members of that host’s table can view that host’s table-scoped Insights and player comparisons, including results from that host’s sessions the member did not personally attend. This access does not extend to other tables and does not give host permissions.

A host can send a game link for a cash game (for example, to a group chat). Anyone who opens that link can see, without an account, the game name, the host’s display name, the date and stakes, the player names at the table, their buy-ins and rebuys, the pot, and the results once the game is finished, along with a leaderboard of that host’s recent games (or, for hosts with Pro, all of that host’s finished games). A person can pick their name and ask the host to link it to their HG Poker account; the host decides whether to approve. Standings, viewer, summary and display links work in a similar way. Practice games never have a game link. Share links only with the people you intend to see them.

Hosts keep saved-player records for people who may not have an account, and they are responsible for having a proper basis to record and share those people’s information. Where a host enters someone else’s information, we process it to provide the host’s game records. If you are named in a host’s records and want something reviewed, corrected or removed, contact us (Section 10). Accounts created through different sign-in providers are not merged automatically.

4. Who receives information

4.1 Other users

As described in Section 3. In addition, your payment handle is shown to the people you owe or who owe you in a game, so they can pay you outside HG Poker. HG Poker is not part of those payments.

4.2 Service providers (processors)

These companies process information on our behalf, under terms that limit their use of it to providing their services to us:

• Supabase (United States) — database, sign-in, file storage, server functions and logs.
• RevenueCat — purchase and subscription management, including optional setup answers stored as subscriber attributes, and web checkout (RevenueCat Web Billing) when available.
• Stripe — payment processing for web purchases, through RevenueCat Web Billing, when web purchases are available.
• Apple and Google — the sign-in you choose, App Store and Google Play purchases, and push delivery (Apple Push Notification service; Firebase Cloud Messaging).
• Lovable and Cloudflare — hosting and delivery of our websites and web app, including game-link, standings and claim pages.
• Resend — sending player invitation emails.
• Telegram — an internal alert to our team when you submit a support report (report text, category, account id and diagnostics).
• Formspree — delivery of website feedback forms.
• HighLevel — managing Android beta sign-ups from the website.
• Vidalytics — the video player on the website (configured not to set its own cookie).
• Google Workspace — our email, used to answer you. Microsoft Outlook receives website feedback-form messages.

4.3 Advertising partner

Meta receives website information through the Meta Pixel and uses it under its own terms (Section 6). For that use Meta is an independent business, not only our processor. The apps do not include the Meta SDK.

4.4 AI assistants you connect

If you connect an AI assistant (Section 7), the information it requests is sent to that assistant’s provider (for example OpenAI or Anthropic) at your direction and is handled under that provider’s terms and privacy policy.

4.5 Legal, safety and business transfers

We may disclose information when reasonably necessary to comply with law or valid legal process; protect the rights, property or safety of users, the public or HG Poker; investigate fraud or security issues; enforce our Terms; or get professional advice. If HG Poker is involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, information may be transferred as part of that deal, subject to this Policy.

We do not sell personal information for money. The Meta Pixel on our website may count as “selling” or “sharing” for cross-context behavioural advertising under some US state laws; see Section 11 for how to opt out.

If you cancel an App Store subscription, Apple may send our server a request that identifies the subscription so we can show a message or an offer on Apple’s cancellation screen. That request contains subscription and transaction identifiers, not payment-card details.

5. Notifications and messages

If you allow them, HG Poker uses push notifications, Live Activities, Dynamic Island, local notifications and system timer or alarm features to show timers, tournament levels, blinds, player counts or links to a game. Hosts can get notifications when a player marks a payment as sent, responds to an invitation, asks to leave a game or asks to be matched to a saved player, and reminders about a game that is still open. You can change this at any time in the app or your device settings. Notifications are not needed for core game tracking.

We send transactional emails (for example, a player invitation a host asks us to send). We send promotional emails or texts only with any consent the law requires, and each includes a way to opt out. If you text us, we use your number to reply. No mobile opt-in information or consent is shared with third parties or affiliates for their own marketing.

6. Cookies, the Meta Pixel and website analytics

The HG Poker apps do not use advertising cookies or advertising identifiers. The hgpoker.io website uses the Meta Pixel, which sets cookies and sends Meta information such as the pages you visit, store-button clicks, scroll depth, time on page and that a video on a page was played (but not which video), together with your browser and device information and IP address. We use it to measure our advertising and to show HG Poker ads to people who visited the site. Meta may combine it with other information it has about you under Meta’s own policies.

Visitors whose browser is set to a California (US Pacific) time zone or to any European time zone (including the EEA, the UK and Switzerland) are asked first, and the pixel does not load unless they choose Accept. For other visitors the pixel loads with the page, unless they have opted out on this page or their browser sends a Global Privacy Control signal. We detect your region from your browser’s time zone setting, not from your location.

You can change your choice at any time: use the opt-out in Section 11, the “Cookie settings” link at the bottom of the website (shown to visitors who are asked), or clear this site’s data in your browser. You can also manage how Meta uses information for ads in your Meta ad preferences and block third-party cookies in your browser. The website also uses your browser’s local storage to remember your cookie choice and the page that brought you to the site. The Vidalytics video player loads from Vidalytics’ servers and receives your IP address and playback information; it is configured not to set its own cookie.

7. AI connector (connecting HG Poker to an AI assistant)

This section applies if you connect an AI assistant to your HG Poker account. You can connect HG Poker to an AI assistant that supports the Model Context Protocol (MCP), such as ChatGPT or Claude. This is optional and off until you connect it yourself.

How you connect. In the AI assistant, you add HG Poker and are sent to HG Poker’s sign-in pages (mcp.hgpoker.io and the HG Poker web app at play.hgpoker.io). You sign in and choose Allow or Don’t allow. HG Poker never sees your password for the AI assistant, and the assistant never receives your HG Poker password. After you allow access, HG Poker’s sign-in service (Supabase) issues the assistant a short-lived access token and a refresh token for your account only.

Sign-in information the assistant receives. The tokens identify your account. They contain your HG Poker account id, the email address (and phone number, if any) on your account and basic account details from sign-in (such as your name and sign-in method), and, depending on the permissions the assistant asks for and you allow, the assistant can request your email address and whether it is verified.

What the assistant can read. Records of games you host, and your own results as a player in games other people host, with the same plan rules as the HG Poker app:

• your host display name, currency and time zone, and counts and dates of your games;
• games you host: names, dates, start and end times, status, format, game type, stakes, venue or location names, buy-ins, cash-outs, chip counts, final results, session lengths, and expenses with their descriptions;
• the players in your games: the names you or they entered, their player ids, whether they have their own HG Poker account, attendance, standings, records, streaks, patterns and head-to-head figures from your games;
• seat order, only for games where a seat draw was saved;
• who owes whom, amounts, and whether and when a settlement was marked paid;
• tournaments you host: names, dates, buy-ins, finishing places and the amounts recorded for each place;
• your own results as a player in games hosted by others where you are linked to your HG Poker account (dates, your buy-ins and results), and, when you ask how you do against one specific player, both of your results in the games you both played.

Names, venue labels, descriptions and explanations are returned exactly as entered, so they can contain whatever personal information was typed into them. The assistant cannot read other people’s games beyond your own seat in them, or another user’s account history. It does not read other people’s stored payment handles, purchase or subscription records, or push-notification data, and nothing the assistant receives includes a payment handle, including your own.

Making changes. When you ask it to, the assistant can start a cash game, add a player, record a buy-in, cash out a player or end a game; import past games; mark a payment as received; create a tournament from a plan; and schedule a game and invite your saved players, all in your account. Assistants are told to confirm each change with you first. HG Poker keeps a receipt of each change (your account id, the action, a request id, everything sent with the change, including names, locations and any explanation, and the result) so a retried request is never recorded twice. Receipts are deleted after 30 days, and when you delete your account. When you import past games, the optional “who hosted” details and notes you provide are stored with the imported game in your account and are deleted with your account. Marking a payment as received through the assistant records it the same way as marking it Received in the app. Scheduling a game, inviting players, creating a tournament or marking a payment through the assistant sends the same in-app notices to the players involved as the same action in the app. An import preview (the parsed games and names you sent) is kept until you confirm it or for up to 30 days. To prevent abuse, HG Poker counts assistant requests per account (account id, a time window and a count only, no request content) and deletes those counts within a few hours.

Why and who. We process this only to answer the requests you make in the assistant and to keep your records correct, not for advertising, and we do not sell it. What the assistant reads is sent to the company that runs it (for example OpenAI for ChatGPT or Anthropic for Claude) and handled under that company’s terms and privacy policy, including how long it keeps your conversations. HG Poker does not receive your conversation; it receives only the specific requests the assistant makes, which can include text from your conversation (for example a player name you asked it to record). Supabase hosts the sign-in service, database and server function that answer those requests.

Logs. When a request fails, our server function may log technical error details (the action, the database function, an error code and the error message, which is not filtered and can include parts of the data involved). Successful requests are not logged by the function. These logs are kept by Supabase for up to 7 days and used only to fix problems.

How to stop it. Access lasts until you disconnect. Open the HG Poker web app (play.hgpoker.io) → Settings → Connected apps and choose Disconnect; the assistant’s tokens stop working right away. Removing HG Poker in the assistant’s own settings may not revoke HG Poker’s tokens, so use Connected apps too. Deleting your HG Poker account ends all connections.

8. Account deletion and Apple sign-in revocation

You can delete your account in the app (Settings). Deletion removes your account, profile and account links, and the deletion workflow handles the games you host. Another host’s own records of games you played can remain under that host’s saved-player name after your account link is removed; a saved name and result can still identify a person, so this is not full anonymization. Information already shared with others cannot be recalled. Deleting your account does not cancel an App Store or Google Play subscription; cancel it in the store.

For accounts that sign in with Apple, our backend can store an encrypted Apple refresh token for one purpose: revoking HG Poker’s Apple authorization when you delete your account. The token is server-only. When it exists, revocation runs before account cleanup; if revocation fails, that deletion attempt stops and you are told. The token is erased after successful revocation. Some older Apple accounts have no stored token; they can still be deleted, and you will be told how to disconnect HG Poker in your Apple Account settings.

9. How long we keep information

We keep information only as long as needed for the purposes in this Policy, then delete or de-identify it.

We may keep information longer where the law requires it, to resolve disputes, to enforce our agreements, or while a legal hold applies.

10. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy;
• correct inaccurate information;
• delete your information;
• export it in a portable format;
• opt out of the sale or sharing of personal information for targeted advertising, and of profiling with significant effects;
• object to or restrict certain uses, and withdraw consent at any time (this does not affect earlier processing); and
• appeal our decision on your request, and complain to a regulator.

How to make a request. Many controls are in the app: edit your profile, manage saved players, export eligible data, turn off notifications, disconnect from a table or an AI assistant, and delete games or your account. For anything else, email keven@hgpoker.io with the subject “Privacy Request” or contact us through hgpoker.io/support. Tell us what you are asking for and the email address on your account.

Verification. To protect you, we confirm that a request comes from the account holder, usually by asking you to write from, or confirm through, the email on your account. You can use an authorized agent; we may ask for proof of the agent’s authority and confirm your identity directly.

Response times. We confirm receipt within 10 business days and respond within one month for EEA/UK requests and within 45 days for US requests. If we need more time, we will tell you why; extensions are up to two further months (EEA/UK) or 45 more days (US states). Requests are free unless they are clearly unfounded or excessive.

Appeals. If we decline your request, you can appeal by replying to our decision with the subject “Privacy Appeal.” We will answer within 45 days (60 days where the law allows). If you are not satisfied, you can contact your state Attorney General or data protection authority.

We will not discriminate against you for using your privacy rights. Some requests are limited by other people’s rights: for example, we may not delete another host’s record of a shared game, but we will review the request and remove or correct information where appropriate.

11. California notice and other US states

11.1 Notice at collection (California)

In the last 12 months we collected these categories of personal information under the California Consumer Privacy Act (CCPA): identifiers (name, email, account id, device and install ids, IP address); customer records (payment handles, phone number for Android beta sign-ups); commercial information (purchases and subscriptions); internet or other electronic network activity (app events, website interactions, logs); general location (country from device settings; no precise geolocation); audio or visual information (photos and screenshots you upload); and inferences (for example, offer eligibility). The sources, purposes, recipients and retention are in Sections 1, 2, 4 and 9. We collect account log-in information (email and password, for email sign-in) only to sign you in, and we do not use sensitive personal information to infer characteristics about you.

11.2 “Sale” and “sharing”

We do not sell personal information for money. The Meta Pixel on our website discloses identifiers and internet activity to Meta for cross-context behavioural advertising, which California law treats as “sharing” and may treat as a “sale.” We do not do this in the apps. We do not knowingly sell or share the personal information of anyone under 16.

11.3 Your opt-out: Do Not Sell or Share My Personal Information

Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of sale and sharing for that browser, and the Meta Pixel does not load. Because the website does not know who you are, an opt-out applies to the browser you use; repeat it on other browsers and devices.

11.4 Other California rights

California residents have the rights in Section 10 (to know, access, correct, delete, and opt out of sale or sharing) and the right not to be discriminated against for using them. We do not offer financial incentives for personal information. Under California’s “Shine the Light” law, you may ask whether we disclosed personal information to third parties for their direct marketing; we do not.

11.5 Other US states

Residents of other states with consumer privacy laws (including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia) may have similar rights to access, correct, delete, export, and opt out of targeted advertising, sale and certain profiling, plus the right to appeal. Use the opt-out above or Section 10 to make a request; we honour these requests for all US users, whether or not a particular law applies to us.

12. EEA, UK and Swiss users

The controller is the operator identified at the start of this Policy and in Section 20. Our legal bases are in Section 2 and your rights are in Section 10. You can complain to the data protection authority where you live or work, or where you think a problem happened (in the UK, the Information Commissioner’s Office), though we would like the chance to help first. Requests and questions from the EEA, the UK and Switzerland can be sent to keven@hgpoker.io.

13. International transfers

HG Poker is based in the United States, and our main database is hosted in the United States. If you use the Service from outside the United States, your information is transferred to and processed in the United States and other countries where our providers operate, which may have different data-protection laws. Where EEA, UK or Swiss law requires it, we rely on the European Commission’s Standard Contractual Clauses (with the UK addendum), the EU-US Data Privacy Framework where a provider is certified, or another lawful transfer mechanism. You can ask us for more information about these safeguards.

14. Children and age requirement

The Service is for adults. You must be at least 18 to create an account. The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13 (or under 16 in the EEA and UK). If you believe a child has given us information, contact us and we will delete it.

15. Security

We use administrative, technical and organizational safeguards appropriate to the information we handle. These include encrypted connections (HTTPS), sign-in through Apple and Google, database access rules that limit each account to the records it is allowed to see, encryption of stored Apple tokens, restricted server credentials, audit logging of financial records, signed app updates, and encrypted backups.

No method of transmission or storage is completely secure, and we cannot guarantee the security of your information. We review and improve our safeguards over time. Keep your devices and sign-in methods secure, and share game links only with people you trust.

16. Security incidents and breach notification

If we learn of a security incident that affects your personal information, we will investigate, take steps to contain it, and notify you, regulators (for EEA/UK users, the relevant authority within 72 hours where required) and others as the law requires, without undue delay. Notices will explain what happened, what information was involved, what we are doing, and what you can do. We may notify you by email, in the app or on our website.

17. Third-party services and links

App stores, sign-in providers, payment providers, AI assistants and websites we link to are run by other companies under their own terms and privacy policies. We are not responsible for their practices.

18. Do Not Track

There is no common standard for browser “Do Not Track” signals, so we do not respond to them. We do respond to Global Privacy Control as described in Section 11.

19. Changes to this Policy

We may update this Policy. We will post the new version with a new effective date and an “Updated” note, and for material changes we will give additional notice (for example in the app or by email) before they take effect. Where the law requires your consent to a new use of your information, we will ask for it.

20. Contact

HG Poker — published and operated by Keven Bermeo, Georgia, United States (apps, website, web app and the “HG Poker for Claude & ChatGPT” connector). On Google Play the app is distributed through the developer account Lead Catch LLC.
Privacy requests and questions: keven@hgpoker.io
Phone: (404) 200-1250
Support: hgpoker.io/support