Privacy policy

1. In short

• No account needed, no real money, no ads. Guests are identified by a random token in your browser, not by name, email or IP address.
• Hand history is the game’s record. Every card and action at a table is stored so the game can be replayed, recapped and, for signed-in players, reviewed. Deleting your account unlinks you from it.
• An account is an email address and a player name, plus an optional picture. Sign-in is by emailed link; we never see a password.
• Everything runs in the European Union (Frankfurt and the Netherlands) on servers of the providers listed in section 10.
• Third-party statistics only with your consent. Google Analytics and Ahrefs load only after you accept them; our own usage counters work without any tracking cookie.
• Table chat is never stored. Messages and reactions are relayed to the players at the table and gone when the table closes.

2. Who is responsible

The controller under the General Data Protection Regulation (GDPR) is Libaty GmbH, Am Krummen Graben 23, 63150 Heusenstamm, Germany, represented by Ulrich Linnebank. Email: hello@fizzpoker.com. Full details are in the Impressum. The company is small enough that no data protection officer has to be appointed; write to the address above for every data protection matter.

3. Visiting the site

When you open any page, the hosting provider (Vercel, section 10) receives what every web server receives: your IP address, the page requested, the time, the referring page and your browser string. This is needed to deliver the page and to defend against abuse; it is kept in the provider’s request logs for up to 30 days. Legal basis: our legitimate interest in running a secure site (Art. 6(1)(f) GDPR).

The site is a web app that can be installed on your home screen. A service worker caches the app shell in your browser so it loads fast; your browser settings (theme, legibility mode, sound) and a few preferences are kept in your browser’s local storage and never sent to us. The cookie policy lists every entry.

4. Playing as a guest

You can deal or join a table without an account. To keep your seat across a page reload and to tell you from the other players, the site creates a random device token and stores it in your browser (a cookie and local storage, 12 months). The token is tied to nothing but itself: not your name, email or IP address. You choose a player name for the table; it is shown to the other players and stored with the game.

While you play, the game server (Railway, Netherlands) holds the live table over a WebSocket connection and writes the game to the database: the table settings, who sat where under which name, every hand with its cards, actions, pot and result, and timestamps. This is the record of the game. It is shown to the players at the table during the game, in the post-game summary, and on the recap page of that game (section 7).

Legal basis: performance of the user agreement (the terms of use, Art. 6(1)(b) GDPR) and our legitimate interest in keeping a complete, tamper-proof record of every game (Art. 6(1)(f)).

5. Accounts and sign-in

A free account is needed for tables of 5–9 players, for more than one bot, for leagues and for statistics. Signing up means entering your email address: the sign-in service (Supabase Auth) emails you a link that works once, for 15 minutes; the email is delivered by Resend. We store your email address, the player name you pick, your picture if you set one (a drawn preset, or a photo you upload, which is resized in your browser and stored under an unguessable address), the time the account was created and the sign-in service’s user id. The sign-in service additionally logs each sign-in with time and IP address; we delete those entries after 30 days.

To stop email bombing and account probing, each sign-in request is counted for a short window under a hash of the email address and a hash of the IP address; these hashes are deleted after 30 days.

Your account links your device tokens to you, so the games you played as a guest on that device before signing up become part of your history. The site also stores, in your browser only, your account id and player name for quick display.

Legal basis: performance of the user agreement (Art. 6(1)(b)); abuse protection: legitimate interest (Art. 6(1)(f)). You delete the account yourself at any time under Account → Settings; section 11 says what deletion removes.

6. The post-game review (Fizz Score)

After each game, the review service compares every decision a signed-in player made with game-theory models and labels it acceptable, inaccuracy, mistake or blunder, then folds those labels into a score and a rating history. Guests and bots are never evaluated. The evaluation uses only the hand record; it is advisory, it appears only after the hand, and it has no effect on anything but the statistics shown to you and the post-game Fizz lines shown to the players of that game. It is therefore not a decision with legal or similarly significant effect in the sense of Art. 22 GDPR. The Fizz Score page explains the method and its limits.

Legal basis: performance of the user agreement (Art. 6(1)(b)) — the review is the feature an account is for. You can wipe it at any time with “Clear play history” or by deleting the account.

7. What other players and the public can see

• At the table: your player name, picture, chips, the actions you take and the cards you show at showdown — to everyone seated or watching through the table link.
• Recap page: every finished game has a recap page reachable by anyone who has its join code (the link is unguessable but shareable). It shows the players’ names, places and the key hands, exactly as they were public at the table. It never shows cards that were not shown, and a deleted account appears as “Seat N”.
• Leagues: members of a league see each other’s league nickname, results and the league’s tables; they never see email addresses or account ids.
• Chat and reactions: relayed live to the players at that table only and never stored by us. The host can mute a player. Other players may of course screenshot the table.
• Pictures: an uploaded picture is served from a public address that cannot be guessed and is removed when you replace it, remove it or delete the account.

8. Our own usage statistics (no consent needed)

To see which features are used and where the app breaks, the site records usage events — “table dealt”, “hand finished”, “sign-in link sent”, “client error” and the like — with a one-way hash of your device token, your account id if you are signed in, a session id, the platform, the app version and the event’s own properties. No IP address, no browser string and no free text is stored (error messages are hashed). The first page you arrived from (the referrer and any campaign tag) is kept in your browser and attached to the sign-up event, so we can tell which channel brings players. Crawlers and automated browsers are dropped on arrival. These events live in our own database in Frankfurt for 24 months. The operator sees them as aggregate charts; an individual record is looked up only to investigate an error or an abuse report.

Legal basis: our legitimate interest in understanding and improving the game (Art. 6(1)(f)). No information beyond what the game itself needs is read from your device, so no consent under §25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) is required. You may object (section 12).

9. Google Analytics and Ahrefs (with your consent only)

On your first visit a banner asks whether we may load two third-party statistics tools. Nothing loads before you answer, and “No, thanks” is as easy as “Yes”. If you accept:

• Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) sets the cookies _ga and _ga_… (2 years) and sends page views and events together with a pseudonymous client id, your approximate location derived from the IP address (the address itself is not logged by GA4 for EU visitors) and device data to Google, including Google LLC in the USA. Google keeps event-level data for up to 14 months and may use it for its own purposes as described in its privacy policy.
• Ahrefs Web Analytics (Ahrefs Pte. Ltd., 16 Raffles Quay, Singapore) counts page views without setting a cookie and sends the page URL, referrer, device type and a truncated IP address to Ahrefs.

Legal basis: your consent (Art. 6(1)(a) GDPR, §25(1) TDDDG). You can withdraw it at any time with effect for the future on the cookie policy page; withdrawing clears the Google cookies and stops both scripts from loading.

10. Who processes data on our behalf, and where

We do not sell or share personal data with anyone for their own purposes. The following providers process data under our instructions, bound by data processing agreements (Art. 28 GDPR). Where a provider is based outside the European Economic Area, the transfer rests on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c)) and, where the provider is certified, on the EU-US Data Privacy Framework adequacy decision (Art. 45).

The operator’s own staff access the production data only through an administration console whose actions are logged, and only to run the service, answer support requests or investigate abuse.

11. How long we keep what

Deleting your account (Account → Settings → Delete account) does all of this at once: your email, player name and picture are removed, your sign-in user is deleted so the address can register again, your evaluations and rating history are deleted, you leave every league, and every hand you played is unlinked from you. The hands themselves stay in the games’ records, without your name. Clear play history hides all games before that moment from your account and resets your score without affecting the other players’ records.

12. Your rights

Under the GDPR you can, free of charge, ask us to:

• tell you whether and what personal data we process about you, and give you a copy (Art. 15);
• correct inaccurate data (Art. 16) — player name and picture you can change yourself;
• erase your data (Art. 17) — the self-service deletion in section 11 does this without waiting for us;
• restrict processing (Art. 18);
• receive the data you gave us in a machine-readable form (Art. 20);
• object to processing that rests on our legitimate interest, in particular to the usage statistics of section 8, for reasons arising from your situation (Art. 21);
• withdraw a consent you gave, at any time, with effect for the future (Art. 7(3)).

Write to hello@fizzpoker.com; we may ask you to prove it is your account (for example by writing from its email address). You also have the right to complain to a data protection supervisory authority, for instance the one responsible for us: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, datenschutz.hessen.de.

13. Age

FizzPoker is for people aged 16 and older (see the terms of use). We do not knowingly collect data from anyone younger; if you believe a child has created an account, email us and we will delete it.

14. Security

Every connection to the site and the game server is encrypted (TLS). Session cookies are marked HttpOnly and Secure; device tokens are stored hashed in the usage events; the database rejects direct access from browsers; secrets are rotated when there is any doubt. No system is perfectly secure: should a breach ever affect your data, we will inform you and the supervisory authority as the GDPR requires.

15. Changes to this policy

We update this page when the service changes what it processes. The date at the top is the date of the current version; substantial changes are announced on the site. Previous versions are available on request.