Last updated: July 28, 2026
TwoFivePoker ("we", "our", or "the app") is a live poker session and hand tracking application, available as an Android app and as a web app at app.twofivepoker.com. This Privacy Policy explains how we collect, use, store, and protect your information.
TwoFivePoker is operated by an independent developer based in Estonia. The developer is the data controller responsible for your personal data. The Android app is published via an individual Google Play developer account.
You can reach us at any time at support@twofivepoker.com.
By default, all core data is stored locally on your device. You can use the core features of the Android app without creating an account.
The following information may be stored on your device:
This data stays on your device unless you sign in, or you explicitly export it. We do not access or transfer it without your action.
The Android app is designed to function fully offline. Recording sessions, tracking hands, and viewing statistics do not require an internet connection or an account.
Signing in is optional in the Android app. It is required in the web app if you want to buy a subscription, because a subscription has to be attached to an account.
We use passwordless magic-link sign-in: you enter your email address, we email you a one-time sign-in link, and opening that link signs you in. We do not use passwords, so we never store any.
When you sign in we process:
Your email address and account are stored by Supabase, our cloud service provider. The sign-in emails themselves are delivered by Resend, our email delivery provider. Both act as processors on our behalf.
Important: while you are signed in, cloud sync is active — see the next section. There is no separate sync switch. If you want to keep your data on your device only, do not sign in, or sign out.
While you are signed in, the app keeps your data synchronised with a Supabase-hosted database so it survives a lost phone and is available on your other devices and in the web app.
What is synchronised:
What is never synchronised:
Your rows are protected by row-level security: your account can read and write only its own data.
We do not sell your data, we do not share it for advertising, and we do not use it to profile you.
Location is used only when you choose to tag a session or a marked hand with where you were playing. If you grant location permission and use that feature, the venue name and the coordinates are saved with that record.
Because those coordinates are part of the session record, they are included in cloud sync while you are signed in. If you are not signed in, they stay on your device.
We do not:
Premium can be purchased in two ways, and the payment processor differs.
On the web (app.twofivepoker.com) payments are processed by Stripe, using Stripe Managed Payments — Stripe acts as the merchant of record for the sale. You must be signed in to start a checkout. We pass Stripe your email address and your account identifier so the resulting subscription can be matched back to your account. Stripe collects and processes your payment details, billing information and any tax-relevant details directly, under its own privacy policy.
In the Android app payments are processed by Google Play Billing. Google Play processes the payment independently and provides us with a purchase token, which our server checks against Google's API to confirm your subscription is valid.
In both cases we never see or store your payment card details. What we store about a subscription is:
We rely on the following processors:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Account storage, database, cloud sync, server functions | Email, account ID, synced app data, subscription status |
| Stripe | Web payments (merchant of record) | Email, account ID, payment and billing details |
| Google Play | Android app distribution and in-app payments | Purchase token, subscription status |
| Resend | Delivery of sign-in emails | Email address |
| Vercel | Hosting of the website and web app | Standard server request logs, including IP address |
Each provider processes data under its own privacy terms and, where required, under a data processing agreement with us.
We do not use third-party advertising.
We do not use third-party analytics or tracking pixels.
We do not sell personal data.
If analytics or crash reporting tools are introduced in the future, this Privacy Policy will be updated before they are enabled.
Our processors are international companies and may process or store data outside the European Economic Area, including in the United States. Where that happens, the transfer relies on the safeguards those providers offer, such as the European Commission's Standard Contractual Clauses or an equivalent adequacy mechanism.
Locally stored data remains on your device until you delete it or uninstall the app.
Synced data is retained in your account until you delete it or ask us to delete your account.
Payment and subscription records are retained while your subscription is active and afterwards for as long as accounting and tax law requires us to keep records of a sale.
You can delete all locally stored data at any time via:
Settings → Clear All Data
You can request deletion of your account and all synced data at twofivepoker.com/delete-account, or by emailing support@twofivepoker.com. Requests are processed within 7 business days.
If you have an active subscription, cancel it first — deleting your account does not by itself cancel billing. If you subscribed on the web, use the management link in your Stripe receipt email; if you subscribed in the Android app, cancel in Google Play. Records we are legally required to keep for accounting purposes are retained even after account deletion; they are not used for anything else.
If you are located in the European Union or EEA, we process data on the following bases:
You have the right to:
You also have the right to lodge a complaint with your local data protection authority. In Estonia this is the Andmekaitse Inspektsioon (aki.ee).
To exercise these rights, contact us at the email below.
TwoFivePoker is not directed at children. The app is intended for adults who play live poker, and you must be of legal age to gamble in your jurisdiction to make meaningful use of it. We do not knowingly collect data from children.
We may update this Privacy Policy from time to time. The "Last updated" date indicates the most recent revision.
Continued use of the app after changes take effect may constitute acceptance of the updated policy.
If you have questions about this Privacy Policy, contact us at: