Privacy Policy

1. What we collect

Your account. Your email address and display name, and — when you sign in with Google — your Google account ID and the address of your Google profile picture. If you sign in with an emailed link, we store a one-time code for 15 minutes. We never see or store a password.

Study and Trainer. The hands you play in the Trainer and the spots you build in Study, your decisions and their grades, your stats (accuracy, EV loss), your most recent finished trainer hands (so you can reopen them), your settings, and how many trainer hands you play each day.

Home games. The clubs you start or join (your role, join requests, any nickname the club gives you), the name you choose for the tables, the tables you host or sit at and their settings, your buy-ins, top-ups and cash-outs (the ledger), every hand dealt at your tables (cards, actions, results and who owes whom), the grades of your decisions, your chat messages and reactions, the profile picture you upload, the table settings you last used as a host, and the records of the verified shuffle for each hand. A hand's record keeps every player's cards — folded hands too — so hands can be graded and old deals proven; other players are only ever shown what the table showed.

Billing (only if paid plans are ever switched on). Your subscription status, Stripe customer and subscription IDs, and payment records (amount, date, Stripe reference). Card numbers go straight to Stripe; we never see or store them.

Technical. Standard server logs — IP address, browser, pages requested, times — kept for security and debugging, and a log of actions taken by administrators.

2. How we use it

To run the service: sign you in, save your hands, stats and games, grade decisions, show your clubs and tables the right things, keep home-game ledgers adding up, prevent abuse and fix problems. That's the whole list. We don't sell or rent data, run ads, or use analytics trackers.

3. Who can see what

Study and Trainer data is visible only to you (and to us, running the service). A Study spot you share by link is visible to whoever opens the link.

Home games. The people at your tables and the members of your clubs see your display name, picture, chat and table actions. Inside a club they can also see your results, the ledger, your stats and your hand histories. Your hole cards are shown to others only as the table's rules reveal them (at showdown, or when you choose to show them), and grades of your decisions follow the table's “show grades” setting. Your email address is not shown to other players (a club's owner and admins see a partly hidden form of it on a request to join their club).

4. Cookies and local storage

One essential cookie keeps you signed in (it lasts about 30 days, or until you sign out). Your browser's local storage keeps interface preferences on your own device — for example the last tab you used, amounts in big blinds or dollars and your dollar rate, bet size buttons, collapsed panels, sound, and any private notes you keep about other home-game players. No third-party or advertising cookies.

5. Who else handles your data

A few service providers, each only for its job:

• Google — sign-in, if you use it. The site's fonts are also loaded from Google's servers, which see an ordinary request from your browser.
• Cloudflare — the network in front of the site.
• Hetzner — the server that runs WrapGTO, in the United States.
• An email delivery service — only to send the sign-in links you ask for.
• A backup storage provider — holds encrypted copies of the database.
• Stripe — payments, only if paid plans are ever switched on (see Stripe's privacy policy for how it handles card data).

We disclose data beyond this only if the law requires it.

6. How long we keep it

Your data is kept while your account exists. Home-game hands, ledgers and chat stay with the clubs they belong to. Server logs rotate automatically.

Backups. The database is backed up every night. About two weeks of backups are kept on the server; encrypted copies kept with a separate storage provider are thinned out over time (daily for two weeks, then weekly, then monthly) and kept for up to two years. Backups are used only to restore the service after a failure.

When you delete your account (account menu → Delete account, any time — Download my data first if you want a copy), your email, name, picture, trainer stats, chat messages and settings are removed straight away and every device is signed out. Hands you played in home games stay in the other players' histories and ledgers under “Deleted player”, so their records still add up. Deleted data ages out of the backups on the schedule above. Stripe keeps payment records as financial regulations require.

7. Your choices and rights

From the account menu you can download a copy of your data (a JSON file), sign out your other devices, and delete your account. For anything else — to ask what we hold, correct it, or object to something — email us and we'll answer, usually within a few days.

8. Security

All traffic is encrypted (HTTPS). The database lives on a locked-down server with key-only access, and pages are served with strict security headers. Payment credentials never touch our systems. No internet service is perfectly secure, but the attack surface here is deliberately small.

9. Children

WrapGTO is for adults (18+). We don't knowingly collect data from minors; if you believe a minor has an account, email us and we'll delete it.

10. Changes and contact

If this policy changes, the current version lives at wrapgto.com/privacy and we'll flag material changes in the app or by email before they take effect.

Privacy questions or requests: [email protected]