Privacy Policy

What we collect

• Account information: your email address, an auto-generated username, and, if you use email sign-in, a password handled by Supabase rather than stored by us. If you use Sign in with Apple, Apple supplies an identity token and either the email address you share or an Apple private relay address. Supabase uses that identity to sign you in. If Apple supplies your name when you first authorize the app, we may save it in your account metadata.
• Practice activity: the questions you answer, your chosen action, whether it was correct, and the resulting accuracy stats shown on your Stats page. This is what makes your practice history and accuracy tracking work.
• Billing information (Pro subscribers): your subscription status, plan and renewal or expiry date, and for a Google Play or App Store purchase the store's product and transaction reference. Card details are handled by the payment provider - Stripe on the website, Google Play in the Android app, or Apple in the iOS app - and we never see or store your card number.
• Basic site analytics (web only): aggregated page- view data via Vercel Analytics, to understand which pages get used. This is not tied to your account and isn't used for advertising.
• Product usage events: a few milestones page views can't show - finishing the signed-out demo, completing a practice session, opening the upgrade screen and starting a purchase - with details such as the practice format and number of hands, so we can see which parts of the product help people keep practicing. When you're signed in they're linked to your account and deleted with it. The signed-out demo sends them without storing any identifier on your device, and none of them are used for advertising.
• How you found us: when you create an account on the website, we record once where your first visit came from - the referring site's name (for example google.com or reddit.com, never the full address), any campaign tags on the link you followed, the page you landed on, and how many days before signing up that was. When you create an account in the app, we record once any campaign tags Google Play passed on with the install, and the app's random ID (below). It's linked to your account, deleted with it, and used only to see which places bring people who find the product useful.
• Trying the app without an account: the app keeps a random ID on your phone, made up by the app (the same one the daily puzzle uses). It goes with the few things we record while you're signed out: that a practice round started or finished, with its score, and that the app asked you to sign up. That lets us count how many people try the app, and how many of them go on to create an account. If you create one in the app, the ID is recorded with it once, as above, and that record is deleted with your account.
• Spots you share: when you share a practice hand, we store a short link code with the spot, the hand and your account, so the link keeps working and sharing the same hand again gives the same link. The page anyone with the link sees shows the hand and the solver's answer, never your name or email. If you delete your account, the link keeps working but is no longer linked to you.
• The Discord bot: if a server sets up the daily puzzle post, we store that server's and channel's Discord IDs and the Discord ID of the person who set it up, until the post is turned off and for as long as needed to stop it. Each spot the bot deals is saved as a shared spot with no owner, so its buttons and link keep working. The bot doesn't read messages and doesn't record who answered a spot or how.
• The daily Shove or Fold?: the website or app keeps a random ID on your device, made up for this, so each day's answers count once and we can see how many players come back the next day. We store each answer with that ID and, when you're signed in, your account, and use them for the "how other players answered" figures. If you delete your account, your answers stay only under the random ID. If you sign up for the daily email without an account, we keep your email address and when you confirmed or unsubscribed, and use it only to send the puzzle. Reminders in the app are scheduled on your phone; we don't receive a notification token.
• Invites: your invite code; which account each invite was used by and how it arrived (a link, the Google Play install, or a typed code); whether it qualified for a free week; and the free weeks on your account. To stop people inviting themselves, we also keep the network range a code was used from (the first three parts of an IPv4 address, never the full address) and, in the Android app, a device identifier (described below). Deleted with your account.

What we don't do

• We don't sell your data to anyone, ever.
• We don't run advertising and don't use ad-tracking cookies or SDKs.
• We don't share your data with third parties beyond the service providers necessary to run the product: Supabase (database and authentication), Apple and Google (sign-in where offered and their respective app store payments), Stripe (payment processing, web only), RevenueCat (mobile in-app purchase records), Expo (mobile code updates), and Vercel (hosting and the analytics above).

The mobile app specifically

The mobile apps use the same account and practice data as the website. Signing into the same account brings back your history and stats. If you choose Apple's private relay, that relay address may be the email associated with your account. The app checks your network connection locally to show an offline indicator; that check is not sent to us. Mobile product usage events are described above. The Android app offers Pro through Google Play. When App Store purchases are available in the iOS app, Apple handles those payments. RevenueCat reads subscription status from both stores and keeps a history of in-app purchases - including plan, purchase, renewal and cancellation dates, and store transaction references - linked to your account ID. We store the resulting subscription status and store references in our database. Neither store sends us your card number.

The app may contact Expo's EAS Update service when it opens to check for compatible code updates. Expo may receive the device operating system, a random ID stored for this app installation, and routine connection information such as an IP address. If the app had a fatal error, a later update check may also send an error summary. The app does not send your Push Fold Trainer account ID in these requests.

When you're signed in, the Android app sends us a one-way scrambled form of the device's Android ID (an identifier Android gives each app, which changes if the device is reset). The app scrambles it before sending, and we scramble it again with a secret key, so what we store can't be turned back into the ID or matched with identifiers held anywhere else. It is used only to stop the same person earning free weeks by inviting themselves from a second account, never for advertising or to follow you across apps, and it is deleted with your account. On first launch the app also reads the Google Play install referrer, which says whether it was installed from an invite link, so the invite can be applied for you.

Cookies and local storage

If you are just reading the site - the homepage, the free ranges, the guides, the calculators - we set no cookies at all. Not one. There is no advertising cookie, no tracking pixel and no third-party script on those pages, so there is nothing here to ask you to consent to and no cookie banner in your way.

• Sign-in cookies (strictly necessary): once you log in, our authentication provider Supabase sets cookies beginning sb- that hold your session so you stay signed in between pages. They exist only to keep you logged in. Signing out or deleting your account clears them; blocking them means you cannot sign in.
• Practice preferences (on your device only): the trainer remembers small settings in your browser's local storage - whether auto-advance is on, and the table size and stack depth you last practiced. This never leaves your device and is not sent to us.
• Your first visit (on your device only): the site keeps a note in local storage of how you first arrived - the referring site's name, campaign tags and landing page, with no identifier. It is sent to us only if you create an account (see "How you found us" above), and expires after 30 days.
• Analytics (no cookies): Vercel Analytics counts page views without setting a cookie and without building a profile of you. It is why the point above is true.

Why we're allowed to hold it

Under the GDPR and UK GDPR every use of your data needs a lawful basis. Ours are straightforward: your account, your practice history and your sign-in cookies are all performance of the contract between us - they are the product, and it cannot work without them. Billing records are kept because we have a legal obligation to keep tax and transaction records. Aggregate page-view analytics and product emails rest on our legitimate interest in understanding which pages are used and in telling you about the thing you signed up for - and every product email carries a one-click unsubscribe link that we honour immediately.

How long we keep it

Your account, profile and practice history are kept for as long as your account exists, because they are what your stats are made of. Deleting your account removes those records immediately, with no recovery window, so please export anything you want first. We also request deletion of the linked RevenueCat customer and its Google Play or App Store purchase history. A failed request is logged for follow-up. Billing and tax records may outlive your account: we and Stripe keep records of website payments for at least five years after the transaction, which is the minimum the Australian Taxation Office requires business records to be kept for. Google and Apple keep their own store purchase records under their respective privacy policies. Aggregate analytics is never tied to your account and is retained in aggregate form only.

Where your data is

We are based in Australia and our service providers operate globally, so your data may be processed outside your country. Supabase handles our database and authentication, Vercel hosts the website and its analytics, Stripe handles website payments, and RevenueCat handles mobile purchase records, and Expo serves mobile code updates. Apple and Google also process sign-in or store-payment data when you use their services, under their own privacy policies. Our service providers use international transfer safeguards where required; we do not sell your data.

Your choices

You can edit your username or opt out of the (not yet launched) leaderboard from your Account page at any time. You can permanently delete your account and all associated data yourself, at any time, from the Account page on the website or in the mobile app - this removes your profile, practice history, and login, and attempts to cancel a Pro subscription bought on the website. It cannot cancel a subscription bought through Google Play or the App Store. Cancel it with Google or Apple before deleting your account, or the store may continue billing you. Deleting the account also removes the login used to access your Pro subscription. If you can't sign in, email us and we'll delete the account for you - the steps are on how to delete your account. To request a copy of your data instead, email us at support@pushfoldtrainer.com.

Depending on where you live you may also have the right to ask us to correct or restrict what we hold, to object to a particular use, or to receive your data in a portable form. Ask at the same address and we'll answer within 30 days. If you think we've got it wrong, you can complain to a regulator: in Australia the Office of the Australian Information Commissioner (oaic.gov.au), in the UK the Information Commissioner's Office (ico.org.uk), and in the EEA your national data protection authority. We'd rather you told us first, but you don't have to.

Changes to this policy

If what we collect or how we use it changes in a meaningful way, we'll update this page and change the date above.

Contact

Questions about this policy or your data: support@pushfoldtrainer.com.