Privacy Policy

Scope

This policy covers the thinking.poker website and the Thinking Poker mobile app (iOS and Android, bundle poker.thinking.app).

What the app collects

• Anonymous sign-in: each install signs in with a Firebase anonymous user ID. No name, email or phone number is needed.
• What you post: hands, an optional question or note, comments, votes, your display name, reports and blocks.
• Usage events: Firebase Analytics records events such as screen views, feed_view, vote, comment, post_done and share, together with the Firebase app instance ID.
• Device attestation: writes are checked with Firebase App Check to confirm the request comes from the genuine app.

IP address

We use your IP address only while handling a request, and store only a hash of it, for rate limiting and abuse prevention. We do not store the raw IP address.

What we do not do

• No ads and no advertising identifiers.
• No tracking across apps.
• No location data.
• No access to your contacts.

Translation

The app's translation uses Apple Translation or Google ML Kit on your device. Translation happens on the device; the text is not sent to us for translation.

Website accounts

You can sign in to the website with a Firebase email account. When you do, we store in our database your Firebase user ID, account state and last-seen time, display name and language preference, and what you create: hands, comments, likes, training stats, course progress, saved items, charts, feedback and deletion requests. Your email address is held by Firebase Authentication.

You can download your own data (JSON export) from your account page.

Data processors

We use Google Firebase (sign-in, Analytics, App Check) and Cloudflare (website hosting and the D1 database) to process data.

Retention

Your content and account data are kept until you delete them. IP hashes are used only for rate limiting and are not linked to your content. Firebase Analytics events follow Google's default retention.

Deleting your data

• App: go to Me, then Settings, then Delete my data. The anonymous user's data is deleted immediately.
• Website: when signed in, send a deletion request from your account page. We review and process it.

Children

This service is not directed at children under 13 (under 16 in the EU), and we do not knowingly collect their data.

Contact

Questions about this policy: see the contact page.