Last updated: 17 September 2026
Version: 2.0
1. Who is responsible
Pub Poker, registered in Auckland, New Zealand. We are the agency responsible under the New Zealand Privacy Act 2020 for personal information we handle for our own purposes, and the controller where that term applies. Contact support@pubpoker.io about privacy or to exercise your rights.
We manage accounts, security, billing and platform features. Clubs are responsible for the information they collect to run their leagues; we also process that information on their behalf under the Club data-processing appendix to our Terms of Service. Contact your Club about its use of your information, or contact us for help.
2. Information we collect
- Account details: name and email address, plus optional phone number, nickname and profile photo. Name and email are required to create and access an account.
- Club information: membership, roles, uploaded photos and documents, game participation, results, recorded payments and prizes, standings and achievements.
- Communications: your name, message and email address on a Club contact form or the contact form on this site, and support correspondence. Club contact messages go to the Owner, with a copy to us.
- Technical records: IP address, browser information, sign-in sessions, verification records, security and audit logs, agreement versions and acceptance times, and visits to the Games, leaderboard, achievements and player-profile pages while signed in.
- Subscription records: plan, payment status and billing records. Stripe collects payment details on its own pages; we do not receive card numbers.
Information comes from you, your Club's Owner or Hosts, your use of the service and payment or email-delivery providers. A Host may create a record for you before you sign in. We send a welcome email so you can verify your account. If you did not want to be added, contact us.
Pub Poker is for people aged 18 and over. Contact us if a child's information has been added so we can delete it.
3. How and why we use it
We use personal information to provide accounts and Club features, display results, send service emails, process subscriptions, respond to enquiries, prevent abuse, investigate disputes, fix faults and meet legal obligations.
Where a legal basis is required, we rely on:
- Performance of our contract with you for accounts, requested services and subscriptions.
- Legitimate interests in operating a league platform, publishing Club standings, sending optional achievement and season emails, answering enquiries, maintaining security and resolving disputes, where those interests are not overridden by your rights.
- Legal obligations for tax records, lawful requests and required notifications.
- Consent where we specifically ask for it. You can withdraw consent without affecting earlier lawful processing.
We do not sell or rent personal information, share it for behavioural advertising, or use it to train machine-learning models. We do not make solely automated decisions with legal or similarly significant effects on you.
4. Who can see it
Club members can see fellow members' names, nicknames, profile photos, results, standings and achievements. Owners and authorised Hosts can also access contact details to administer the Club. Private Club records are not available to other Clubs.
Club pages are public and may appear in search results. Featured leaderboard players' names, nicknames, photos, ranks, wins, season points, crowns, medals and recent achievements may appear, alongside gallery photos uploaded by the Club. Email addresses, phone numbers and individual financial results are not published there. Email support@pubpoker.io to be removed from the public leaderboard; you remain visible within your Club. Contact us or the Owner to remove a gallery photo.
The public game clock shows player display names and the Host's name to anyone with its code. It does not show full last names, contact details or money amounts.
Our administrator can access records and use logged support access to investigate problems. Service providers handle hosting, storage, email, security, backups and payments. Section 5 identifies them, their roles and locations, including providers acting for their own purposes. We may disclose information where required by law or to establish or defend legal claims. We notify you of requests from authorities unless prohibited by law.
5. Service providers and overseas processing
Our main database is in Sydney, Australia. Providers also process information in the United States and other locations listed below. We use access controls, encrypted connections, protected sign-in credentials and encrypted backups. No system can guarantee absolute security. We notify affected people, Clubs and regulators of breaches where required by law.
Overseas processing is subject to applicable privacy law. Where transfer safeguards are required, these may include an adequacy decision or approved contractual safeguards. New Zealand is recognised by the European Commission as providing adequate protection; this does not automatically cover onward processing in other countries. Contact us for information about safeguards applicable to your data. The contractual limitations below remain unresolved; this policy does not represent that every provider has an equivalent processing agreement.
| Provider | Purpose and information | Location |
|---|---|---|
| Vercel Inc. | Website hosting; requests, IP addresses and application content | United States company; application in Sydney, with global delivery |
| Neon | Database, including account and Club records, uploaded photos and documents | United States company; database in Sydney, Australia |
| Upstash | IP-based rate limits and short-lived public game-clock cache | Sydney, Australia |
| Resend | Email delivery; recipient details, message content and delivery reports | United States |
| Cloudflare, Inc. | DNS, support-email forwarding, encrypted backup storage and Turnstile bot checks; mail content, encrypted files, IP addresses and browser signals as relevant | United States company; global network |
| Google LLC (Gmail) | Support correspondence and copies of Club contact messages | United States |
| GitHub, Inc. | Backup processing and encrypted backup storage; the temporary backup job handles unencrypted database data | United States |
| Sentry | Server error reporting; email addresses are stripped from reported URLs; no browser session recording | United States |
| Stripe | Subscription payments; Owner and billing details, including cards entered directly on Stripe pages | United States and other countries where Stripe operates |
Stripe also processes some information for its own payment and legal purposes; Cloudflare does so for some bot-detection processing. Support mail uses personal Gmail without a business data processing agreement. Coverage for our Cloudflare services and free GitHub account has not been confirmed. These limitations do not remove our legal obligations. The Terms' Club data-processing appendix covers sub-processor notice, objections and refunds.
6. Retention and deletion
| Information | Retention |
|---|---|
| Account details | While the account is open; unverified sign-ups with no games are deleted after 21 days |
| Club records, results and game audit records | While the Club exists; this includes game history for unverified and departed players |
| Sign-in sessions and associated IP/browser details | Sessions expire after 12 months; records are deleted 90 days after expiry |
| Verification codes and page-visit records | Codes are deleted 90 days after expiry; page visits after 90 days |
| Failed sign-in and bot-check audit details | Email, IP and browser details are erased after 90 days; outcomes and timestamps remain |
| Uploaded photos and documents | Until deleted or the Club is deleted |
| Billing and tax records | 7 years |
| Encrypted backups | Daily copies for 14 days, weekly for 70 days and monthly for 400 days |
Support correspondence is kept as needed to handle the enquiry and related disputes or legal obligations. Email suppression and welcome-email limit records remain as needed to honour delivery preferences and prevent abuse.
Deleting your account removes your email address, phone number and profile photo, ends sessions and memberships, and removes your name from public pages. Your name and historical results remain on pages visible to Club members while the Club exists. Gallery photos uploaded by a Club are separate and must be removed by the Club or through us. If you own a Club, deleting your account also deletes that Club and its live data.
Account deletion does not remove every record. Records retained for league history, security, legal obligations and disputes remain subject to applicable privacy rights. Contact us with a request to erase retained personal information; we assess it separately. Deleted live data remains in encrypted backups until those expire, for up to 400 days. Plan limits may hide older standings without deleting them.
7. Your choices and rights
You can update account details or delete your account in settings. Optional Season Wrapped and achievement emails include an unsubscribe link. Essential account, security and billing messages continue. Section 8 explains browser storage and controls.
Contact support@pubpoker.io to request access, a copy, correction or deletion of personal information, or to object to public display. We may need to verify your identity. Requests are normally free. We respond within applicable legal deadlines: generally 20 working days under New Zealand law, or one month under the GDPR, subject to lawful extensions. If we decline a request, we explain why and how you can challenge the decision. In New Zealand, you can ask for a statement of a disputed correction to be attached to the information.
Where applicable, including under EEA or UK data protection law, you can also request restriction of processing and portability, object to processing based on legitimate interests, and withdraw consent. These rights depend on the circumstances and legal exceptions. A Club's preference to keep records does not override a legal right to erasure.
You may complain to us or to a competent privacy regulator, including the New Zealand Privacy Commissioner, the Australian Information Commissioner, your EEA supervisory authority or the UK Information Commissioner's Office. You do not have to contact us first where the law allows a direct complaint.
8. Cookies and browser storage
We use first-party cookies for sign-in, security and navigation. We do not use advertising cookies, analytics cookies or tracking pixels.
| Cookie | Purpose | Duration |
|---|---|---|
| pp_session | Keeps you signed in | 12 months from sign-in |
| pp_active_club | Remembers the Club you are viewing | Browser session |
| pp_pending_verify | Protects an unfinished sign-up | 72 hours |
| pp_auth | Shows signed-in navigation on public pages | 12 months; removed on sign-out |
| pp_imp | Shows when an administrator is using support access | Until support access ends, sign-out or browser close |
Browser storage also remembers a Host's game-clock PIN, dismissal of the home-screen prompt and whether a table-ready message has been shown. These values remain until cleared by the site or your browser. The PIN is sent to our server to authorise clock controls.
Cloudflare Turnstile checks certain forms for automated abuse using your IP address and browser signals. It sets no cookie on pubpoker.io.
You can block or clear cookies and site storage in your browser. Blocking sign-in or verification cookies prevents those features from working. Clearing preferences can make prompts reappear or require a PIN again; it does not delete Club records. Where applicable law requires consent for a storage purpose, we must obtain it before use. This notice does not itself constitute consent.
9. Changes
We give at least 30 days' notice by email and in the app of changes that materially affect you. Minor corrections are published on this page. A policy update does not itself provide consent for a new use that requires it.
Pub Poker
Auckland, New Zealand
support@pubpoker.io