Privacy Policy

Stacked Poker (“Stacked,” “we,” “our,” or “us”) operates the Stacked Poker platform, an educational poker analysis tool available at stacked.ai.

This Privacy Policy describes how we collect, use, store, and protect information about you when you use our website and services. By creating an account or using the platform, you consent to the practices described in this policy.

If you have questions, you can reach us at any time at privacy@stacked.ai.

We collect the following categories of information:

We use the information we collect to:

• Provide, operate, and improve the Stacked Poker platform
• Process your hand histories and generate coaching analysis
• Manage your account, subscription, and billing
• Send transactional emails (password resets, billing receipts, important notices)
• Analyze aggregate, anonymized usage patterns to improve our features
• Detect and prevent fraudulent or abusive activity
• Comply with legal obligations

We do not use your data for advertising, sell it to third parties, or use it to profile you for non-platform purposes.

Stacked Poker uses Anthropic's Claude API to generate coaching commentary and strategic explanations. When you request an analysis:

• Your parsed hand data (not your raw file) is sent to Anthropic's API
• Anthropic processes this data to generate coaching text
• We do not include your name, email, or account ID in API requests
• Anthropic's data retention and usage is governed by their own privacy policy

Anthropic is a SOC 2 Type II certified provider. Their API usage policy does not permit them to use your inputs to train their models by default.

All payments are processed by Stripe, Inc., a leading payment processor trusted by millions of businesses worldwide.

• We never see, store, or have access to your full card number, CVV, or expiry date
• Stripe handles all payment data under PCI DSS Level 1 compliance
• We store only a Stripe Customer ID to manage your subscription
• Billing history and invoices are accessible via your account settings
• Stripe may retain transaction records as required by applicable law

Stripe's privacy practices are described in the Stripe Privacy Policy.

Authentication is managed by Supabase, an open-source backend platform with enterprise-grade security.

• Passwords are hashed using bcrypt — we can never read your password
• Sessions use short-lived JWT tokens stored in secure, httpOnly cookies
• Google OAuth is available as a sign-in alternative
• All data in transit is encrypted via TLS 1.2+
• Database connections use encrypted channels

If you suspect unauthorized access to your account, please contact us immediately at privacy@stacked.ai.

We use cookies and browser local storage for the following purposes:

We do not use advertising cookies, cross-site tracking, or any third-party analytics cookies.

• Account data is retained for as long as your account is active
• Hand histories and analysis results are retained until you delete them or your account
• Upon account deletion, personal data is removed within 30 days
• Billing records may be retained for up to 7 years as required by financial regulations
• Anonymized, aggregated usage statistics may be retained indefinitely

To request early deletion of your data, email privacy@stacked.ai with the subject “Data Deletion Request.”

If you are located in the European Economic Area (EEA) or United Kingdom, you have the following rights under the GDPR and UK GDPR:

To exercise any of these rights, contact privacy@stacked.ai. We will respond within 30 days.

Our legal basis for processing personal data is: contract performance (providing the service), legitimate interests (platform security and improvement), and consent where explicitly given.

We use the following trusted third-party services to operate the platform:

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email and update the “Last updated” date at the top of this page.

Continued use of Stacked Poker after changes take effect constitutes acceptance of the updated policy. If you disagree with the changes, you may delete your account before the effective date.