Privacy Policy
Last updated: July 5, 2026
This Privacy Policy explains what personal data GTO Poker Lab (the “Service”) collects, why, how long we keep it, who we share it with, and the rights you have. It applies to the website and the app (including the Android version).
1. Data controller
Controller: TravelBeard LLC
Address: 2105 Vista Oeste NW, Suite E 2013, Albuquerque, NM 87120, United States
Contact and exercise of rights: gtopokerlab@gmail.com
Data hosting: AWS, European Union.
2. Data we collect and why
We collect only what we need to run the Service. We do not collect special categories of data (health, religion, etc.) and we do not use precise/GPS location.
| Category | Examples | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Account & identity | Name, email, Google account ID and profile photo (via Google sign-in); or, in the future, email + password (stored hashed) | Create and manage your account; sign you in | Contract | While your account is active |
| Training & usage | Hands played, answers, correct/incorrect, statistics, XP, level, streaks, review queue, settings | Provide the Service, save your progress, gamification | Contract | While your account is active |
| Push notifications | Push subscription (browser/device endpoint and keys), chosen language | Send the reminders/notices you enable (e.g., review reminders) | Consent | Until you disable notifications or uninstall |
| Analytics | Approximate location (country/city inferred from IP), device/browser type, pages and events, anonymous identifiers (Google Analytics) | Measure usage and improve the Service | Consent (analytics cookies) | Up to 14 months (Google Analytics) |
| Technical & error logs | IP address, timestamps, error/diagnostic messages and technical context | Operate and secure the Service; detect and fix bugs; prevent abuse | Legitimate interest | Up to 12 months |
| Communications | Emails you send us (e.g., support or rights requests) | Answer you and keep a record | Legitimate interest / consent | As long as needed to handle the request |
| Payments (future) | If we launch paid features: purchase and subscription status. Card data is handled by the payment provider — we never store card numbers | Process subscriptions and billing | Contract / legal obligation | As required by tax/accounting law |
3. Where the data comes from
Directly from you (when you sign in, train, contact us or enable notifications); from Google, if you sign in with Google (name, email, ID, photo); and automatically from your device (technical data, analytics) as described above.
4. AI Coach
The AI Coach analyzes your own statistics and error history within the Service to give you feedback. If AI-generated wording is enabled, a short summary of your aggregated results may be processed by Google's AI service (Gemini) solely to phrase the message; this only happens when you request an analysis, and you can use the Service without it. We do not send your identity or contact details for this purpose.
5. Who we share data with
We do not sell or rent your personal data, and we do not share it for third-party advertising. We use the following providers, who act as processors and only process data on our instructions:
- Google LLC / Google Ireland Ltd.: sign-in (Google OAuth), analytics (Google Analytics), optional AI wording (Gemini), and notification delivery on Android (Firebase Cloud Messaging).
- Amazon Web Services (AWS): hosting of the app and database (infrastructure in the European Union).
- Browser push services (e.g., Google, Mozilla, Apple/Microsoft): technical delivery of the notifications you enable.
- Payment provider (only if paid features launch, e.g., Stripe / the app store): processing of subscriptions.
We may also disclose data if required by law or to protect our rights and the security of the Service.
6. International transfers
Some providers and the controller (TravelBeard LLC) are located in the United States. Where an international transfer takes place, we rely on the safeguards required by the GDPR (European Commission Standard Contractual Clauses and/or applicable adequacy frameworks such as the EU–US Data Privacy Framework).
7. Your rights
If you are in the EEA/UK (GDPR): you may exercise, free of charge, your rights of access, rectification, erasure, restriction, portability and objection, and you may withdraw consent at any time, by writing to gtopokerlab@gmail.com. You may also complain to your supervisory authority (in Spain, the AEPD, www.aepd.es).
If you are in California/US (CCPA/CPRA): you have the right to know, delete and correct your data, and to opt out of the “sale” or “sharing” of personal information. We do not sell or share your personal information, and we will not discriminate against you for exercising your rights.
8. Deleting your account and data
You can request deletion of your account and associated data at any time by emailing gtopokerlab@gmail.com from your account address (an in-app option may also be available). We will delete or anonymize your data within a reasonable period, except data we must keep to comply with legal obligations (e.g., billing records) or to resolve disputes.
9. Minors
The Service is intended exclusively for people 18 years or older. It is not directed at minors and we do not knowingly collect their data. If we learn we have collected data from a minor, we will delete it.
10. Security
We apply reasonable technical and organizational measures (for example, encryption in transit via HTTPS, hashed passwords where applicable, and access control). No system is completely infallible, so we cannot guarantee absolute security.
11. Changes to this policy
We may update this Privacy Policy. We will publish the current version on this page with its update date and, for significant changes, we will provide reasonable notice.