Privacy Policy
Last updated 9 August 2026.
PokerNight.win is operated by Contra Holdings LLC, a Utah limited liability company, which is the controller of the information described here. This policy describes what the site actually does with information, written from the code rather than from a template. It is drafted for attorney review and is not legal advice.
The short version. There are no accounts and no passwords. We set no cookies. We run one cookieless analytics script, Cloudflare Web Analytics, which counts page views and load times and cannot identify you or follow you to another site. We run no advertising, and we track nobody across the web. We have never sold or shared personal information and we do not. Everything a table holds is deleted when the table is torn down, which is about 90 seconds after the last player leaves.
What we collect, and why
Only what a game of cards needs in order to work. This is the notice of collection: the categories below are everything we collect, and the purposes below are the only purposes we collect them for.
| What | Why it exists | How long |
|---|---|---|
| The nickname you type | So other players can tell seats apart | Until the table is torn down |
| An avatar image, only if you upload one | Shown on your seat at that table | Until the table is torn down |
| Seats, stacks, bets, hand history, and the buy-in ledger | This is the game state. Without it there is no game | Until the table is torn down |
| Table chat, as a capped rolling window | So a player who reconnects sees recent messages. The host can clear it at any time | Until the table is torn down, or until the host clears it |
| A session token | Lets you reclaim your seat if your connection drops. It is a signature over a random player id, held by your browser | Until the table is torn down |
| Your IP address, in memory only | Rate limiting, so one source cannot flood the site with connections or rooms | Transient. Counted against a short rolling window and never written to storage |
| Page address, referrer, load timings, and coarse device and country information | Cloudflare Web Analytics, so we can see how many people visit, what brought them, and whether pages load quickly. It sets no cookie and keeps no identifier that would recognise you on a later visit | Held by Cloudflare in aggregate. Never joined to your nickname, your seat, or anything at a table |
In the language of California law, the only categories we collect are identifiers (a nickname you choose, a transient IP address) and internet activity, meaning your own gameplay plus the page views and load timings counted by our cookieless analytics. We collect no sensitive personal information, no financial information, no precise geolocation, no biometrics, and no information about your background or characteristics. None of this is tied to a real-world identity, because we never ask for one. We do not collect your name, email address, phone number, date of birth, payment details, or location.
Our legal bases (for people in the EEA and the UK)
- Performance of a contract: nickname, avatar, game state, chat, and the session token exist so we can provide the game you asked to play.
- Legitimate interests: the transient use of an IP address for rate limiting, so the site stays available and resists abuse. We consider this proportionate because the address is never stored and never linked to gameplay.
What we deliberately do not do
- No cookies. The site sets none at all.
- Cookieless analytics only, no advertising, no tracking pixels. The single third-party script on the page is Cloudflare Web Analytics, which records the page address, referrer, load timings, and coarse device and country information, with no cookie and no identifier that persists between visits. Nothing profiles you or follows you to other sites.
- No accounts. Nothing to register, so there is no password to leak and no profile to build.
- No selling or sharing. We do not sell or share personal information, and we have not in the preceding twelve months. We have no advertising partners and we do not engage in cross-context behavioural advertising.
- No automated decision-making or profiling that produces legal or similarly significant effects.
- No payments. No money moves through the site, so we never see a card number. See the Terms of Use.
Do Not Track and Global Privacy Control
Some browsers send a "Do Not Track" signal or a Global Privacy Control signal. There is no consistent standard for the first, and the second is an opt-out of the sale or sharing of personal information. Because we do not track you across sites and never sell or share personal information, there is nothing for either signal to switch off. Our behaviour is the same whether you send them or not, and it is already the most private setting.
What your own browser keeps
The site saves your preferences in your browser's local storage, under keys beginning poker_ and pkr-. Card back, table colours, sound settings, your nickname and avatar, your age confirmation, seat-reclaim tokens, and which panels you had collapsed. None of it is transmitted the way a cookie would be, and we set no cookies at all. Every key is listed individually in Cookies and Local Storage. Clearing your browser's site data removes all of it.
How long things last
Tables are temporary by design, and this is the core of how the site handles privacy:
- A table tears itself down about 90 seconds after the last player leaves.
- A table where nobody has played for about two hours is reclaimed as idle.
- The list of open public tables drops an entry after about two and a quarter hours.
Teardown deletes the table's storage outright. Nothing is archived, and there are no backups of table contents, so once a table is gone we cannot retrieve it even if you ask us to.
Who else is involved
The site runs on Cloudflare, which serves the pages and hosts the live tables. Cloudflare acts as our service provider and processor, including handling connections, protecting the site from attack, and running the cookieless Web Analytics described above, and it may log request metadata such as IP addresses for those purposes under its own terms. We use no other third-party service, and we do not disclose personal information to anyone else for any purpose.
We may disclose information if we are legally required to, or where necessary to protect our rights or someone's safety. In practice we hold so little, for so short a time, that there is rarely anything to give. If we are ever part of a merger or sale of the business, information may transfer as part of it, and this policy would continue to apply until replaced.
Where information is processed
We are based in the United States, and Cloudflare operates a global network, so information may be processed on servers outside your country, including in the United States. Those countries may not offer the same level of data protection as your own. Where information about people in the EEA or the UK is transferred, it is covered by the Standard Contractual Clauses and the safeguards in Cloudflare's data processing terms.
Security
Traffic is served only over HTTPS with HSTS. The deck lives on the server and is never sent to a browser, and each player's view is redacted on the server before it is sent, so another player's hidden cards are not present in your browser at all. Identity is a signed token whose key never leaves the table's own server-side instance. The site sets a strict Content Security Policy that permits exactly one third-party script origin, Cloudflare's analytics beacon, and no others. No system is perfectly secure, and we cannot guarantee absolute security, but the site is built so that a compromise has very little to take.
Children
The site is for adults and you must be 18 or older to use it, as set out in the Terms of Use. It is not directed to children, and we do not knowingly collect personal information from anyone under 13, or sell or share the personal information of anyone under 16. If you believe a child has provided information through the site, write to us and we will delete it. In practice, a table's contents are deleted automatically shortly after play ends.
Your rights
Because there is no account, most of this is immediate and in your hands:
- To delete everything: leave the table. Its contents are deleted shortly afterwards, and completely.
- To provide less: use any nickname you like and skip the avatar upload. Neither is verified.
- To clear local settings: clear this site's data in your browser.
If you are in California
You have the right to know what personal information we collect and how we use it, to request a copy of it, to have it corrected, to have it deleted, to opt out of its sale or sharing, and to limit the use of sensitive personal information. We do not sell or share personal information and we collect no sensitive personal information, so the last two have nothing to act on. We will never discriminate against you for exercising any of these rights, and because the site is free and account-free there is no service level to withhold. You may use an authorised agent, and we will ask for proof of their authority.
If you are in the EEA or the United Kingdom
You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local supervisory authority, or with the Information Commissioner's Office in the United Kingdom.
How to make a request
Write to privacy@pokernight.win. We will confirm receipt within 10 days and respond substantively within 45 days, extending once if it is genuinely necessary and telling you if so.
One honest limitation: we cannot verify that a request relates to you, because we never collected anything that identifies you. If you write to us about a table that still exists, tell us the table code and the nickname and we can act on that. If the table has ended, everything in it is already gone, and there is nothing left for us to give you, correct, or delete.
Changes to this policy
If we change this policy, the "last updated" date above will change. Material changes will be made clear on the site. We review this policy at least once a year.
Contact
Contra Holdings LLC, a Utah limited liability company. Privacy questions or requests: privacy@pokernight.win. Other contacts are listed in the Terms of Use.