Legal
Privacy
Short, because the application never tells our servers about your poker on its own.
2026-10-06
What never leaves your machine
Your hand histories, the hands themselves, the players you sat with, your results and every statistic derived from them stay on your computer, in a database file you own. They are never uploaded on their own, never pooled with other people's, and never seen by us, unless you send us the hands the software could not read, as described below.
This is not only a promise about our intentions. It is what the poker rooms' own terms require of a tool like this one, and breaking it would put your account at risk rather than ours.
What our servers do hold
The website's database contains seven things, and this is the whole of it. Waiting list: your email address, the language the page was in, where you arrived from, and the date. Licences: your email address, the name a key was issued to, which plan, the key itself, when it expires, and (for a purchase) the country the tax was worked out from, together with the two pieces of evidence it rests on, which are the country of the billing address the payment company gave us and the country your connection was in when you opened the payment page. Invitations: the code, and the address that claimed it. Activations: a random identifier your copy generates, which operating system family it runs on, which licence it belongs to, and when it last checked its key; never your computer's name, which usually contains somebody's first name. Downloads: one number per day, per version we were serving and per installer taken, with how many different people took one that day, attached to nobody, described below. Update checks: one number per day per published version, how many of those were an installation's very first check, and how many copies fetched that version's installer, all three attached to nobody and described below. Invoices: for each payment, its number, date, the country and rate the tax was charged at, the amounts and currency, and which licence it belongs to.
The country and the two pieces of evidence are there because we have to charge the VAT of the country you bought from, and be able to show what we based that on. They are recorded only when something is actually paid for: a trial and an invitation write a licence row with those fields empty, because there is no tax on nothing.
No hand, no player name, no result and no statistic is in that database. The desktop application sends an activation and, once it holds a key, the daily check described next; nothing about your poker ever reaches it.
Your licence key, and its daily check
The key carries its own signature and is verified on your machine, so the software works with no connection at all: offline, it keeps your plan until the key's date.
Since version 0.3.1, a copy that holds a key asks this website, at most once a day, whether that key has changed, more often during the last week before it expires, when a renewal is due. The request carries the random identifier described above, and nothing else. It is how a renewal or an extension reaches you on its own, without an email to find and paste.
What we learn from it: the last time a machine holding a key checked it, which tells us that machine was in use that day. Not whether you played, not what, not for how long. A copy with no key sends none of this.
Taking the download
When you take an installer, we count that as well. One number per day, per version we were serving at the time, and per installer offered (the Windows setup and the Windows installer package are two of them, and a macOS build would be a third), and that is the whole of it: not who took it, not which key opened the door, not how many times you took it. The page that offers the download is an ordinary page view; the file itself is not, and without this counter we would know how many people reached the page and nothing about how many left with the software.
It counts files handed out, not installations. A download resumed after a dropped connection counts again, and a copy taken and never opened counts once. Whether a copy is still being used afterwards is the update check described next, and the two numbers are kept apart on purpose.
Next to it, how many different people took one that day: a fingerprint of your connection's address and your browser, mixed with a random salt drawn each day and erased the next. Your address is never stored, and tomorrow the fingerprint points to nobody.
The payment page is counted the same way: one number per day, of how many different people opened it, from the same fingerprint kept apart from the download's. That number is not the country record described above, which stays one line per opening.
Checking for a new version
The application asks this website at start-up whether a newer version exists. Apart from the key check above, which only a copy holding a key makes, that request is the one thing it sends us on its own, and it carries no identifier, no account and no cookie: the address is the same for everybody, and the answer is the same bytes for everybody.
We count those requests. One number per day, per version we were publishing at the time; we do not record who asked or where from. Beside it, how many different copies asked that day, so that a copy launched five times counts once: a fingerprint of your connection's address and of the name of the software asking, mixed with a salt drawn at random each day and erased the next. Your address is never kept, and the next day the fingerprint no longer points to anyone. It is the only way we have of telling whether the application is still being used after somebody installs it.
One of those requests carries one bit more. A copy that has just been installed marks its very first check as being the first (once, and never again) so that we can tell whether a file that left became an installation at all. Nothing travels with it: no identifier, no address, no fingerprint, and what we keep is again a number per day and per version, exactly like the one above. A copy that says it and a copy that stays silent get the same answer, byte for byte.
When a copy does update, it fetches that version's installer from here, and we count those fetches: one number per day and per version, and that is the whole of it: not who fetched, not from where, not which copy. A copy already running that version never fetches one, which is why this is what tells us whether a new release is actually reaching the people who have the software. It matters on one particular day: the one where a room changes its terms and the release that keeps an account safe has to arrive.
So what we learn is that the application was launched some number of times on a given day, and how many copies said hello for the first time, never by whom, never from where, and nothing about whether or what you played. A machine that is offline sends nothing at all, and nothing in the application needs a connection to work.
Problem reports
The application can copy a diagnostic report: version numbers, how many hands are stored, the size and path of your database, your language and platform. You paste it into a message and send it yourself. Nothing is transmitted automatically, and the report contains no hand, no player and no result.
If some hands could not be read, the import screen can send those hands, and only those, to support at hello@poker-exploit.com. It shows you the exact text first, and nothing leaves until you click send. We use them to fix how that room's format is read, then delete them.
Who processes what, on our behalf
The site runs on Vercel. Its database runs on Neon. Installers are stored on Cloudflare R2. Email is sent through Resend. Visits are counted by Umami. Payment is taken by PayPal, which sees your payment details: we never do. The sale itself is made by AB9: see the conditions of sale.
How long we keep it, and how to leave
Waiting list addresses are kept until you unsubscribe, and every message carries a one-click link. Licence records are kept while the licence is valid and for as long afterwards as we may need to answer a question about it.
One thing has a length we do not choose. The country a purchase was taxed on, the two pieces of evidence behind it, and the invoice, have to be kept for ten years: that is the tax rule for a seller outside the European Union selling to somebody inside it, and it is the one thing in this document we would have to say no to deleting. Everything else we will delete on request, or tell you exactly what it is.
Changes
If this notice changes in a way that affects what we hold or who processes it, the date above changes and anybody on the list is told.