Last updated: 27 October 2026 · Effective: 27 October 2026
Wersja polska: Polityka prywatności
JustPoker (the "Game", the "App") is operated by Piotr Nawrocki, Piłsudskiego 98a, [[POSTAL CODE AND CITY]], Poland ("we", "us"). We are the controller of the personal data described in this policy within the meaning of the EU General Data Protection Regulation (GDPR).
You can reach us about anything in this policy, including exercising your rights, at wolterace@gmail.com. We have not appointed a data protection officer, as the law does not require one for our processing. We answer privacy requests within one month.
| Data | Why we need it | Legal basis (GDPR) |
|---|---|---|
| Account data E-mail address, account identifier (UID), sign-in method (e-mail and password, Google, Apple), account creation date, the version of the Terms you accepted and when you accepted them and confirmed that you are 18 or older. If you sign in with Google or Apple, Firebase Authentication also receives the name and profile-photo link of that account (Apple may give us a relay e-mail address instead of yours). We do not use or display that name or photo. |
To create your account, sign you in, keep your progress attached to you, confirm your identity when you ask to delete the account or exercise your rights, and be able to prove that you accepted the Terms | Art. 6(1)(b) — performance of our contract with you; Art. 6(1)(f) — our legitimate interest in being able to prove the agreement |
| Profile data Nickname, chosen avatar |
To show you at the table, in friends lists and in friend requests | Art. 6(1)(b) — performance of our contract |
| Game data Chip balance, game tokens, VIP status and expiry, mission progress, hands played, hands won, heads-up hands, best hand, playing-style statistics (VPIP, PFR, C-bet, WTSD, aggression), results of your game sessions and the type of table, hand history where kept, and timestamps of top-ups, rewarded ads and daily bonuses |
To run the game, save your progress, show your statistics, unlock avatars, run missions, award free chips and tokens, apply cooldowns, and prevent abuse of the free-chip mechanics | Art. 6(1)(b) — performance of our contract; Art. 6(1)(f) — our legitimate interest in preventing abuse |
| Live table data Your seat, cards, bets and actions, and the emoji you send, while you are at a table |
To deal and play the hand and show the table to the other players. Kept in the game server's memory only while the table exists; afterwards only the statistics above remain | Art. 6(1)(b) — performance of our contract |
| Social data Friends list, pending friend requests, number of hands played with each friend; a push-notification token for each device you play on |
To provide the friends feature you choose to use, including invitations to a table that your friends send you as push notifications. The token only lets us deliver those notifications to your device; it is invalidated when you sign out | Art. 6(1)(b) — performance of our contract |
| Safety data Your list of blocked players; abuse reports you submit or that are submitted about you, including the reason, any description you write, the table and the reported nickname; report counters and daily report limits |
To hide players you blocked, to review reports, to take and document moderation decisions, and to prevent misuse of reporting | Art. 6(1)(f) — the legitimate interest of all players in a safe game; Art. 6(1)(c) — our obligations under the EU Digital Services Act |
| Purchase data Anonymous store transaction identifier, product purchased, purchase, renewal and expiry dates, subscription status. We never receive your card number, billing address or bank details. |
To activate and maintain VIP, restore it on a new device, handle withdrawals, refunds and complaints | Art. 6(1)(b) — performance of our contract; Art. 6(1)(c) — tax and accounting obligations |
| Advertising data Advertising identifier (Android Advertising ID, Apple IDFA if you allow it), IP address and the approximate location derived from it, device type, operating system and language, app information, ad views, clicks and completions, and your consent choices — collected by the advertising software inside the App |
To show ads, to give you rewards for rewarded ads, to limit how often the same ad is shown, to prevent ad fraud, to measure and bill ad performance and, if you agree, to personalise ads | In the EEA, UK and Switzerland: Art. 6(1)(a) — your consent, together with the consent required for storing and reading information on your device. Elsewhere: Art. 6(1)(f) — our legitimate interest in funding a free game, with your right to object (section 4) |
| Technical and security data IP address, device model, operating system version, app version, connection identifiers, timestamps, server logs |
To deliver the game to your device, keep your connection to a table, diagnose faults, and detect fraud, cheating and attacks | Art. 6(1)(f) — our legitimate interest in a secure, working service |
| Correspondence Messages you send us, including complaints, withdrawal notices, appeals and privacy requests, and our replies |
To answer you and to keep a record of how we handled your matter | Art. 6(1)(c) — our legal obligations (e.g. consumer and DSA law); Art. 6(1)(f) — establishing and defending legal claims |
Providing your e-mail (or a Google or Apple account) and a nickname is necessary to create an account; without them we cannot provide the game. Everything else in the table is generated by your use of the Service. Consent to personalised advertising is always voluntary.
We do not collect your postal address, your phone number, your precise GPS location, your contacts, your photos, your microphone or camera input, or any health data. There is no free-text chat in the App, so we do not process messages between players. We do not currently use analytics or crash-reporting tools.
JustPoker is free to play because it is funded by advertising. We show rewarded ads that you choose to watch and small banner ads; we do not show full-screen or pop-up ads. Ads are served by Google AdMob and by the advertising networks that Google works with through mediation and real-time bidding. For part of the processing — for example building advertising profiles — Google and these partners act as independent controllers under their own privacy policies. The full, current list of partners is shown in the consent form in the App.
EEA, United Kingdom and Switzerland. The first time you launch the App, it shows you a consent form provided by Google's User Messaging Platform, a consent management platform certified under the IAB Transparency and Consent Framework. You can accept personalised ads, choose individual purposes and partners, or refuse. If you refuse, you can still play everything; Google will then show you non-personalised or limited ads, which still use some data for fraud prevention, frequency capping and aggregated measurement. You can change your choice at any time in the App under Settings → Privacy options. Withdrawing consent does not affect processing that happened before.
iOS. Personalised advertising additionally requires your permission through Apple's App Tracking Transparency prompt, everywhere in the world. If you decline it, the App cannot access your IDFA. You can change this in iOS Settings → Privacy & Security → Tracking.
Android. You can reset or delete your advertising ID in Settings → Google → Ads (or Settings → Privacy → Ads, depending on your device). Deleting it stops personalised ads based on it.
Everywhere else, where we rely on legitimate interest, you have the right to object to advertising processing: use the device settings above, or write to us. Google explains how it uses data in advertising at business.safety.google/privacy.
We share personal data only with the providers we need to run the game. Where they process data on our behalf, they do so under a data processing agreement and on our instructions. Where they act as independent controllers, this is noted below.
| Recipient | What it does for us | What it receives |
|---|---|---|
| Google (Firebase Authentication, Cloud Firestore, Firebase Cloud Messaging, Firebase Hosting) | Accounts, sign-in, the database holding your profile and progress, delivery of push notifications, and this website | Account, profile, game, social, purchase and safety data; push-notification tokens and the content of invitations |
| [[BACKEND HOST]] | Hosting our game servers | All data in section 3 except advertising data, in transit and at rest |
| Google Cloud (Cloud Run, EU – Belgium) | Running the AInstein model | Anonymous game information only (section 5) |
| Google (AdMob) and its mediation and bidding partners | Serving and measuring ads. Independent controllers for part of the processing | Advertising data (section 3) |
| RevenueCat, Inc. (USA) | Managing and validating the VIP subscription across both stores | Your account identifier, store transaction data, and the device and IP data its software needs to validate purchases |
| Google LLC and Apple Inc. | Payment for VIP, and sign-in if you use a Google or Apple account. Independent controllers | Your payment and account details, which go to them directly and never to us |
| Google (Gmail) | Our e-mail inbox | Messages you send us |
We also disclose data where the law requires it, for example in response to a valid order from a public authority, and to advisers bound by professional confidentiality (such as a lawyer or accountant) where necessary to establish, exercise or defend legal claims.
Some of our providers, such as Google LLC, RevenueCat, Inc. and some advertising partners, are established in the United States or other countries outside the European Economic Area. Where personal data is transferred outside the EEA, the transfer is covered by an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified companies), by the Commission's Standard Contractual Clauses, or by another safeguard permitted under Chapter V GDPR. You can ask us for a copy of the relevant safeguard at the contact address above.
| Data | Retention |
|---|---|
| Account, profile, game and social data, blocked-players list | For as long as your account exists. Deleted immediately when you delete your account. Technical copies in our providers' systems, such as logs, disappear within their standard cycles, at most 90 days. If you do not sign in for more than 24 months, we may delete your account after notifying you by e-mail at least 30 days in advance |
| Live table data | Only while the table exists, in server memory |
| Abuse reports involving your account | 12 months from the last report, then deleted automatically. If you delete your account earlier, reports remain for that period in pseudonymised form so that moderation decisions stay auditable and legal claims can be defended (Art. 17(3)(b) and (e) GDPR) |
| Purchase data | VIP status for as long as the account exists; accounting records for as long as Polish tax law requires, currently 5 years from the end of the relevant tax year |
| Correspondence, complaints, withdrawals and appeals | As long as needed to handle the matter, and then until related claims become time-barred |
| Server and security logs | Up to 90 days |
| Advertising data held by Google and its partners | Under their own retention policies, linked in section 4 |
Under the GDPR you have the right to:
To exercise any of these, write to wolterace@gmail.com, preferably from the e-mail address on your account so that we can confirm it is you. We do not charge for this and we reply within one month.
You can delete your account and everything attached to it at any time, in two ways, with no need to contact us:
Deletion is immediate and irreversible. It removes your login credentials, e-mail address, nickname, avatar, chips, game tokens, VIP status, missions, statistics, hand history, friends list and blocked list, and removes you from your friends' lists. The only exceptions are abuse reports and records we must keep by law, as described in section 9.
JustPoker simulates casino gameplay and is intended for adults only. It is not directed to children, we do not knowingly collect personal data from anyone under 18, and the App is not distributed in any children's or family programme in either store. If you believe a child has created an account, write to wolterace@gmail.com and we will delete the account and its data.
If you live in California or another US state with a comprehensive privacy law, you have the right to know what personal information we collect, to access, correct and delete it, to receive a copy of it, and not to be discriminated against for exercising those rights. The categories we collect, the sources and the purposes are listed in section 3, and the recipients in section 7.
We do not sell personal information for money. However, allowing our advertising partners to collect advertising identifiers and related data through the App, so that they can show you personalised ads, may be considered "sharing" for cross-context behavioural advertising, "targeted advertising", or a "sale" under some state laws. You can opt out at any time: in the App under Settings → Privacy options where available, through the device settings described in section 4, or by writing to wolterace@gmail.com. We do not knowingly sell or share the personal information of anyone under 16, and we do not process sensitive personal information.
All traffic between the App and our servers is encrypted with TLS. Passwords are never stored by us — authentication is handled by Firebase Authentication, which stores them in hashed form. Players cannot read other players' records in our database; they receive only the fields they are allowed to see. Access to production data is restricted to the operator named in section 1. Deleting your account revokes all your sessions immediately.
No system is perfectly secure. If a personal data breach is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours of becoming aware of it, and inform you without undue delay where the law requires it.
This website does not use analytics, advertising or tracking cookies. When you sign in on the Delete account page, Firebase Authentication stores your sign-in session in your browser's storage; this is strictly necessary for the function you requested and is removed when you cancel, delete your account or sign out. That page loads the Firebase software from Google's servers, which therefore receive your IP address. Our hosting provider records technical access logs, including your IP address, for security.
If we change this policy we will update the date at the top. For changes that materially affect you — a new category of data, a new purpose, or a new recipient — we will notify you in the App before the change takes effect, and where the law requires consent we will ask for it again.
Piotr Nawrocki, Piłsudskiego 98a, [[POSTAL CODE AND CITY]], Poland
wolterace@gmail.com