Privacy Policy · Blindspot Poker

1. Who we are

Blindspot Poker (blindspotpoker.com) is a free poker training site that uses play money only. It is run by Blindspot Cards ("we", "us"). For any privacy question or request, email privacy@blindspotpoker.com.

2. If you don't sign in

The live table, lessons, drills and coached games all run in your browser. We don't create a profile, and we don't store your hands or results on our servers. Your last 30 hands are kept in your own browser so you can replay them; clear them from the Your hands page or your browser settings. Our hosting provider may keep standard server logs (such as IP address, browser type and pages requested) for a short time to run and protect the site. If you accept analytics cookies, Google Analytics also records how the site is used; see section 6.

3. What we collect when you sign in

Signing in is optional. You can use "Continue with Google", a one-time sign-in link we email you, or an email and password. With Google, we receive only what you allow on Google's consent screen. We store:

Information	Why we use it
Name and profile photo (Google sign-in only)	Kept with your account. We don't show them to anyone: your table name and profile picture are the ones you choose.
Email address	To identify your account, answer requests, and send important account notices. Updates or news only if you opt in.
Account ID	A unique number that lets us recognise you next time. With Google, it comes from Google and we never see your Google password. With an email and password, Firebase stores your password only in scrambled (hashed) form; we can't read it.
Game stats	For each coached session: stakes, difficulty, number of opponents, hands played, result in chips, how often you played and raised before the flop, showdowns, and how often you matched the coach. This powers your saved stats.
Blackjack sessions	Only if you also play at our sister site, Blindspot Blackjack, which uses the same account: for each session, the table rules, rounds played, result in chips, how many moves matched the coach, and your mistakes grouped by kind of hand; any blackjack rounds you save or share; and, if you play it, your blackjack career (kept on that site's game server).
Saved hands	Hands you choose to save for replay: the cards, the actions, the coach's notes and your result.
Account dates and settings	When you joined and last visited, and your email preference.

We don't ask Google for your contacts, calendar, phone number, birthday or anything else, and we don't collect payment details. The site has no real-money features. Optional support payments are separate from your account; see Support payments.

Your profile

You can set up a profile with a name, a picture (your Google photo, a built-in picture, or one you upload), a bio, a profile link and usernames for social sites. It's private until you switch it to Public. A public profile can be seen by anyone with its link: your name, picture, bio, profile link, social usernames and the month you joined. Never your email or your stats. Uploaded pictures are shrunk to 160 × 160 in your browser. Before one can go on your profile, our server has it checked by Claude, an AI model made by Anthropic, for things that don't belong on a profile (such as nudity, violence, hate symbols or personal details). A picture that passes is stored with your profile, and our server keeps a copy of the last one it approved so it can tell it was checked; one that doesn't pass isn't kept. That's an automatic decision: if you think it got your picture wrong, email us and a person will look at it. Switch the profile back to Private, or delete it with your account, at any time.

Your profile picture also goes on your seat at multiplayer tables on both Blindspot sites, even if your profile is private: the people at tables you sit at see it, and so does anyone watching a stream overlay of those tables. To show it, we keep a copy apart from your profile that the game servers can read, and they hold it only while the table is open. Switch off Show my picture at tables in your profile and your seat shows your initial instead.

Shared hands

If you share a hand, we publish a copy that anyone with the link can view. It contains the cards, actions, coach notes and result, but not your name, email or photo; you appear as "Hero". Stop sharing any time from the Your hands page, and the link stops working.

Multiplayer tables

Multiplayer tables need you to be signed in. Table names and leaderboard names are checked against a list of blocked words (slurs, sexual or abusive words, and names that pretend to be staff) as you type them, in your browser and on our server; nothing about the check is kept. Other players at a table see the table name you type (not your Google name, email or photo), your seat, chips, actions, quick reactions, and any cards you show at showdown. Everyone at a table also gets a short random player tag so the table can tell players apart; it can't be turned back into your account.

Tables are run by our game server on Cloudflare. While a table is open, the server holds your account ID (to check it's really you and keep your seat), your table name, chips and stats at that table. It doesn't store your hands after they're played. Your browser keeps its own copy of the hands you played, showing only the cards you saw, for replays. A table and everything the server kept about it is deleted once nobody has been at it for 30 minutes (two hours for a hosted table). Public table names are listed in the lobby while the table is open, so please don't put personal information in a table name. If you're signed in, your stats from a multiplayer table are saved to your account like any other session.

If a table allows spectators, anyone with its link can watch without signing in. Guests get a random ID for that visit only, and nothing about them is stored. Spectators see the same table everyone sees: never anyone's hidden cards.

Reporting a player

If you're signed in with a confirmed email, you can report another player from a table's menu or from their profile page. A report stores your account ID and name, the reported player's account ID and name, the reason you picked, any details you add, which site it came from, the time and, from a table, the table code and hand number. So that players who have left can still be reported, the game server remembers the account IDs and table names of the last 100 people who sat at a table until the table closes. Only our staff can see reports. The reported player isn't told who reported them. Staff may use a report to remove a profile picture, make a profile private, or take other action under our terms. We keep reports for as long as we need them to look into problems and spot repeated ones.

Coaches

If you invite a coach with your private coach link, your coach sees your cards and the table as you see it, and you can send each other messages. Other players see that you have a coach, but not your messages. Messages pass through the game server to the two of you and aren't stored. You can end the coaching at any time, which disconnects the coach. If you coach someone, they see the name you coach under.

Hosted tables and broadcasts

The host of a hosted table doesn't play and sees every player's cards live, so they can commentate. The table tells you this before you sit. The host can show the game on a stream with a broadcast overlay, which shows players' table names, chips, actions, cards and win chances at least 30 seconds after they happen, and can turn cards off. The host can also remove a player from the table.

Streamer overlays

If you turn on streaming on the Streamer page, the game server stores your account ID, a secret overlay key and your overlay settings, and notes which Streamer-mode table you're sitting at so your overlay can find it. Your overlay shows your table name, chips, stats and, if you choose, your cards, on your own stream. At a table with Streamer mode on, a streaming player's overlay may also show other players' table names, chips and actions (never their hidden cards). Turn streaming off, or make a new link, at any time; a new link stops the old one from working.

If you get an OBS dock link, the game server also stores a secret dock key with your account ID. Anything with that link can play at tables and change your stream settings as you, but it can't delete data or use your career. Make a new dock link at any time to stop the old one working. The dock remembers your table name, table settings and which tab you had open in OBS's own browser storage.

Support payments

If you chip in through our Ko-fi page (linked from the Support page), Ko-fi runs the checkout and takes the payment through PayPal or Stripe. They collect your card or PayPal details and never give us your card number. From Ko-fi we receive the name you give, your email address, the amount and date, whether it's monthly, and any message you add. If you choose to make your message public, it shows on our Ko-fi page. We use these to process refunds and cancellations, answer your questions, and keep the records tax law requires. A support payment isn't linked to your Blindspot Poker account, and you don't need one to chip in. Ko-fi's own privacy policy covers what it does with your details.

Blindspot Pro

For "Pro" subscribers, billing details, names, and credit card processing tokens are collected securely via our third-party payment provider (Stripe). We do not store raw credit card numbers on our servers. Our server keeps a record of your plan (trial, monthly, yearly or complimentary), when it renews or ends, and the Stripe customer and subscription IDs, so the site knows you have Pro. It also records that you accepted the host covenant before checkout or the free trial, and when.

Technical data

IP addresses, browser types, and gameplay logs are used strictly for security monitoring and fair-play validation. (Google Analytics, if you accept it, is separate: see section 6.)

4. Why we're allowed to use it

Where the law asks for a legal basis (for example in the UK and European Economic Area):

To provide your account and saved stats: it's necessary to give you the service you asked for.
For update emails and analytics cookies: your consent, which you can withdraw at any time.
For support payments: it's necessary to process the payment you chose to make, and the law requires us to keep tax records.
To keep the site secure and working: our legitimate interest in preventing abuse and fixing problems.
For Blindspot Pro: contractual necessity, to run your account and process your monthly or annual SaaS billing.
To prevent cheating, fraud and abuse: our legitimate interest in investigating and preventing fraudulent activity, unauthorized bot usage, or illegal real-money gambling on our site.

5. Who we share it with

We don't sell or rent your email or account details, and we don't give them to anyone for their marketing. Google AdSense, which shows ads on our reading pages, collects its own data through cookies as described in section 6. We use a small number of service providers that process data for us:

Google Firebase (Google LLC) runs sign-in and stores your account and stats. See Firebase's privacy information.
Google Analytics (Google LLC), only if you accept analytics cookies. See how Google uses information from sites that use its services.
Cloudflare (Cloudflare, Inc.) runs multiplayer tables and may serve the site's pages. See Cloudflare's privacy policy.
Anthropic checks pictures you upload for your profile, only if you upload one. Under its commercial terms it doesn't use them to train its models. See Anthropic's privacy policy.
Ko-fi (Ko-fi Labs Limited), with PayPal or Stripe, processes support payments, only if you make one. See Ko-fi's privacy policy.
Stripe (Stripe, Inc. and its affiliates) processes Blindspot Pro payments, only if you subscribe. See Stripe's privacy policy.
Our website host, which serves the pages.

We may also disclose information if the law requires it, to protect people's safety, or as part of a sale or merger of the site (in which case this policy would continue to apply).

6. Analytics, cookies and advertising

Google Analytics, only if you accept

The first time you visit, we ask whether we can use analytics cookies. If you choose No thanks, Google Analytics never loads and no analytics cookies are set. If you choose Accept, Google Analytics records:

pages you view, how long you stay, and the site that sent you;
features you use, such as starting a coached game (with the table settings you picked) and signing in;
device type, browser, operating system, screen size and language;
approximate location (country and city), worked out from your IP address. Google Analytics doesn't log or store the IP address itself.

It identifies your browser with a random ID stored in the cookies _ga and _ga_…, which last up to two years. We don't send Google Analytics your name, email or account ID, so this data isn't linked to your account. We use it only in totals, such as how many people played a hand this week, to decide what to improve.

You can change your choice at any time with Cookie settings at the bottom of every page. If you withdraw consent, collection stops and we remove the analytics cookies. You can also use Google's Analytics opt-out add-on.

Career mode

If you start a career, our game server (run on Cloudflare) keeps your play-money bankroll, which table you're at, and career stats such as hands played, your peak bankroll and your biggest pot, plus any past careers you choose to keep. Other people see them only if you turn on Show my career on my public profile. If you join the career leaderboard, the name you pick there is listed with your bankroll, peak, hands, milestone count and weekly challenge score; leaving the leaderboard removes you from it straight away. Deleting your account deletes all of this.

Tournaments

If you host or register for a tournament, our game server (run on Cloudflare) keeps the event: its settings and house rules, the host's name as director, the table name each player registered with, when they registered, their chip counts during the event, finishing places, and the event log. The event log records what the director does (starting, pausing, warnings, sitting players out, disqualifications, removed registrations) with the reasons they give, and when players register or go out. It shows table names only, never account details.

For an invite-only event, the host's guest list holds the profile names or email addresses they invite, and requests to join hold the name and note you send. Only the host sees the guest list; email addresses never appear on the event page or in the log. If you're invited by email, we match it to the confirmed email address of the account you register with.

Who sees an event depends on how the host set it up. Public and link-only events, including their players, log and results, are visible to anyone with the link (public events are also listed on the Tournaments page). For invite-only events, anyone with the link sees the name, host, start time and structure, but the players, log and results are shown only to the host, the guests and the players. Who can watch the table also follows the host's choice; watchers never see anyone's hidden cards, and the director doesn't either while a hand is being played.

Sign-in

When you sign in, Firebase stores a sign-in token in your browser so you stay signed in. This is strictly necessary and is removed when you sign out. We also remember your cookie choice in your browser.

Advertising

To keep the site free, we show ads from Google AdSense on reading pages: the home page, lessons, table rules, tools and the daily hand. There are no ads at the game tables, on your account pages or on stream overlays.

Ads are chosen and served by Google, which may use cookies and similar technology to show ads, limit how often you see the same one, and measure how ads perform. Where you're in the European Economic Area, the UK or Switzerland, Google asks for your consent first through its certified consent tool, and if you don't consent shows only limited or non-personalised ads. In US states with privacy laws, such as California, the Do not sell or share my personal information link on pages with ads lets you opt out of personalised ads. Elsewhere, Google may personalise ads based on your visits to this and other sites.

We don't give Google your name, email or account details for ads. Learn how Google uses information from sites that use its services, and turn off personalised ads in Google's My Ad Center. Where Google asked for your consent, Ad privacy at the bottom of every page lets you change it.

7. How long we keep it

We keep your account and stats until you delete your account. When you delete it, we remove your profile, stats and sign-in record from our database immediately. Copies in our providers' backups and security logs are erased on their normal schedules, usually within a few weeks.

Tournament events, with their registrations, guest lists, requests, logs and results, are deleted 90 days after the event finishes or is cancelled. An event that never starts is cancelled after 30 days and deleted 90 days after that. Hand records you keep from a tournament table stay in your own browser or account, like any other hand.

Google Analytics data is kept for 14 months and then deleted automatically. Because it isn't linked to your account, deleting your account doesn't affect it; withdraw consent with Cookie settings to stop it.

Records of support payments are kept for six years after the end of the tax year they belong to, as Canadian tax law requires, then deleted. Deleting your account doesn't delete them, because they aren't linked to it.

Billing records for Blindspot Pro are kept as long as an account remains active, or as required by financial auditing laws in Ontario, whichever is longer.

8. Your choices and rights

See and download your data: use "Download my data" on your account page.
Delete your account: use "Delete my account" on the same page, or email privacy@blindspotpoker.com. This also removes your saved hands and switches off every link you shared.
Correct your details: change your profile name and picture on your account page. If you signed in with Google, the name and photo we keep from Google update when you change them there.
Stop update emails: switch them off on your account page or use the unsubscribe link in any email.
Stop analytics: choose Cookie settings at the bottom of any page, then No thanks.
Stop using Google sign-in: if you signed in with Google, you can also remove the site's access in your Google account settings.

Depending on where you live, you may also have the right to object to or restrict how we use your data, and to complain to your local data protection authority. California and other US residents: see "United States and third-party advertising" below, and the opt-out link on pages with ads. We won't treat you differently for using any of these rights.

International compliance standards

We respect your privacy and are committed to protecting the personal data of our users globally, across Canada, the United States, and the United Kingdom.

Canada (PIPEDA compliance): We process and protect all personal data in compliance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Canadian private-sector privacy principles. Users hold the right to access their stored personal data, request corrections, or request full account erasure at any time.
United Kingdom (UK GDPR): we process data under the legal basis of "Contractual Necessity" (to run your account) and "Legitimate Interest" (to prevent platform cheating), plus consent where section 4 says so. UK residents hold the right to erase, restrict, or object to data processing.
United States (state privacy laws) and third-party advertising: We partner with Google AdSense to serve advertisements on the Platform. Google AdSense utilizes cookies, web beacons, and unique device identifiers to collect pseudonymous data and serve personalized or non-personalized advertisements based on your browsing history. You may opt out of personalized advertising at any time via your browser settings, Google's Ad Settings, or the Consent Management Platform (CMP) displayed on our site. We do not otherwise sell or share raw personal identifier data (such as emails or account passwords) with third-party data brokers.

9. Age

The site is for people aged 18 and over. We don't knowingly collect information from anyone younger. If you think a child has signed up, email privacy@blindspotpoker.com and we'll delete the account.

10. Where your data is stored

Firebase, Cloudflare and Ko-fi (with PayPal or Stripe) may store and process data in the United States and other countries where they operate. They provide the safeguards the law requires for international transfers, such as standard contractual clauses.

11. Security

Your data is protected in transit with encryption, and our database rules only let a signed-in player read or change their own records. No system is perfectly secure, but we collect as little as we can and keep it locked down.

12. Changes to this policy

If we change this policy, we'll update the date at the top. If the change is significant, such as adding advertising, we'll give signed-in players notice before it takes effect, and ask for consent again where the law requires it.

13. Contact

Questions or requests: privacy@blindspotpoker.com.