Privacy policy

1. Who is responsible

The Poker Director (thepokerdirector.com) decides why and how your personal data is used. You can reach us about anything in this policy at hello@thepokerdirector.com.

2. What we collect, and why

• Your account. Your email address, the nickname you choose, and your password - which we never store as such, only as a one-way hash. We also keep your avatar choice, your plan, and when you joined. We use this to run your account and sign you in. Legal basis: performing our agreement with you.
• What you do on the site. Games you run or play in (names, players, buy-ins, results and the record of what happened), tournaments you set up, saved blind structures, players you track, and forum posts. This is what the service is for. Names of players that a director types into a game are whatever the director chose to enter. Legal basis: performing our agreement with you.
• Seat invites. A director on a paid plan can invite a player to a seat at their game by typing in the player's email address; we send that address one email with a link to the seat. The address is shown only to that director, is not added to any mailing list, and is deleted once the player takes the seat, the director takes the invite back, or the game ends or is deleted. If you got an invite and don't want it, ignore it - nothing else is sent unless the director invites you again. Every invite has a "No more invites from" link: it stops that director's invites to your address. To remember that, we keep the director's account and a one-way code (a hash) made from your address - not the address itself - until you undo it from the same link or the director's account is deleted; the director is told you asked not to be invited if they try again. When a director runs a game again, a seat your account held is saved for your account; if they choose to email you your invite, it goes to your account's address, which they never see. Legal basis: our legitimate interest, and the director's, in letting players take their own seat.
• Co-directors. A director on the Club plan can let another account run their game with them, by picking a player who took a seat or by typing that account's email address. If an address has a confirmed account, the director learns that it does; the address itself is not stored. A co-director's name is shown to the director, and the link between your account and the game is kept until the director removes you, you step down, the game is handed to someone else or deleted, or your account is deleted. Legal basis: our legitimate interest, and the director's, in sharing the running of a game.
• Clubs. A director on the Club plan can run a club and invite people to it by email or with a join link. An emailed invite goes to the address the owner typed; the address is shown only to that owner and is deleted once the invite is used or taken back. The invite email has the same "No more invites from" link as a seat invite. Members of a club see each other's names and profiles, the club's tournaments and games, and its standings - the places, knockouts and winnings of everyone who played in the finished games filed under it, members or not; your membership is kept until you leave, the owner removes you or deletes the club, or your account is deleted. A logo the owner uploads is kept with the club and shown on the club's pages and on the clock of its games to anyone watching, until the owner removes it or deletes the club. What members write on the club's wall - posts, comments and likes - is seen by the club's members only, and kept until its author or the owner deletes it, the club is deleted, or the author's account is deleted. The wall also shows the club's games as they're scheduled and as they finish, with the top three and what they won. We note when you last opened a club's wall, only to show you what's new there since; it goes when you leave the club. When the owner schedules a game, members see each other's answers (going, maybe, can't make it), and a member who says they're going gets a seat saved at that game in their name. Members with a verified address get one email per scheduled game; every one has a "No more emails from" link that turns them off for that club, and the same switch is on the club page. Legal basis: performing our agreement with you, and the owner's legitimate interest in running their club.
• Payments. If you buy a paid plan, you pay on the checkout page of Link, our payment provider Stripe's service, which sells the plan on our behalf as the seller of record and handles your payment details under its own privacy policy. We keep only Stripe's customer and subscription reference numbers and your plan - never your card details. Stored with your subscription at Stripe is also the time you asked for it to start straight away. Legal basis: performing our agreement with you; keeping the records the law requires.
• Emails about your account. Verifying your address, resetting your password, confirming a change of email or password. You can't opt out of these while you have an account, because the account can't work without them.
• Security. Your IP address is used, briefly and in memory, to limit how fast someone can try to sign in or sign up. Our hosting provider also keeps ordinary server logs. Legal basis: our legitimate interest in keeping the service safe.
• Visitor statistics. We count, ourselves, which pages are visited, which site or campaign link brought a visit (the linking site's name, and any utm_ tags in the link), whether it was on a phone, and how many visits go on to start a clock or open an account. To tell one day's visitors apart without a cookie, your IP address and browser type are turned into a one-way code mixed with a random value that changes every day and is never stored; the address itself is never kept. Once the day is over, nobody (us included) can tell whose visit a code was or link it to another day. Where a table's code or a tournament is in the address, we record only the kind of page, never the code. When you open an account, where the visit you signed up in came from (for example "reddit.com" or "Direct") is kept with your account. Legal basis: our legitimate interest in knowing how people find and use the service.

We don't use third-party analytics, advertising or tracking tools, nothing is stored in your browser to recognise you, and we don't sell or rent your data.

3. Email about news

There are two ways to end up on our mailing list, and both are your choice:

• The news sign-up. On our front page you can leave your email address for news and updates, without an account. We first email that address a link to confirm it is really yours; you are only on the list once you click it. An address that is never confirmed is not used for anything else, and is deleted 30 days after we last sent it a confirmation link.
• News and updates from an account. When you sign up, or later on your profile, you can tick "Email me news and updates". It is never ticked for you. We only use it once your email address is verified.

Legal basis: your consent. Every mailing has a link that removes you from the list in one click, and you can also untick the box on your profile at any time. Unsubscribing removes your address from every list. If you unsubscribe from the news sign-up we delete the address; if you opt out on your profile we stop using your address for this and keep only what your account needs.

4. Who else handles your data

We use a small number of providers to run the service. They handle data only for that purpose:

• Microsoft Azure hosts the site and its database (the application runs in Germany).
• Azure Communication Services (Microsoft) delivers our emails.
• Stripe and its checkout Link take payments and sell our paid plans as the seller of record.
• Google Fonts. Our pages load their typefaces from Google's servers, so Google receives your IP address and browser details when a page loads.

Some of these are US companies. Where personal data leaves the EU/EEA, it is covered by the safeguards the law requires, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

Forum posts are shown with your nickname to everyone who is signed in to the site. Your public profile (nickname, avatar, plan, when you joined, the bio you write if you write one, and your game stats unless you turn off "Show on my profile") and the games you share by link can be seen by anyone who has the link. The games listed on your profile show their name, date and your finish, but only you get the links into them. On Plus, your stats also show the days in the last year you played or directed a game, and your milestones. A signed-in Plus player who opens your profile sees their own record against you - the games you both took a seat in, who finished ahead and the knockouts between you - unless your stats are off. Your email address is never shown.

5. Cookies and similar

We set one cookie, tpd_auth, and only when you sign in. It keeps you signed in for up to 30 days and is needed for the site to work, so it doesn't need your consent. Your browser also stores a couple of layout preferences (like how tall you made a list on the clock screen) on your own device; they never reach us. Stripe sets its own cookies on its payment page. We have no analytics or advertising cookies: our visitor statistics (section 2) work without any.

6. How long we keep it

• Your account and what you did on the site: until you delete your account (on your profile, under Delete account) or ask us to. Games, tournaments and clubs you ran stay for the players in them, without your name; your name comes off the seats you played.
• A seat or club invite's email address: until the invite is used or taken back, the game ends or is deleted, or the account with that address is deleted.
• A game made without an account: 48 hours after it was created, then deleted along with its link - unless its director signs in before then, or a player took a seat at it with their account (their result stays on their profile).
• "No more invites" from a director: the hashed address, until you undo it or the director's account is deleted.
• News sign-up address: until you unsubscribe or ask us to delete it. Unconfirmed: 30 days, as above.
• Payment records: as long as the law requires us to keep them.
• Server logs: for the period our hosting provider keeps them.
• Visitor statistics: kept for a year, then deleted. The daily visitor code stops meaning anything at the end of each day, so what remains can't be traced to anyone.

7. Your rights

You can ask us for a copy of your personal data, to correct it, to delete it, to limit how we use it, or to move it to another service. You can object to processing that rests on our legitimate interest, and you can withdraw a consent at any time (it doesn't affect anything done before you did). You can delete your account yourself, on your profile; for anything else, email hello@thepokerdirector.com and we'll answer within a month.

If you think we've handled your data wrongly, you have the right to complain to your national data protection authority.

8. Changes

If we change this policy in a way that matters, we'll update the date above and, if it affects something you agreed to, ask you again.