PokerPath Privacy Policy

Last Updated: September 21, 2026 Effective Date: September 21, 2026

PokerPath is operated by PokerPath LLC, owned by James Shouey.

1. Who We Are

PokerPath (“we,” “us,” or “PokerPath”) operates the website at https://pokerpath.app and any associated subdomains (collectively, the “Service”). PokerPath is a US-based service that helps poker players discover live tournaments, save tournaments they’re interested in, plan their travel, and use related player tools.

If you have questions about this Privacy Policy or about your personal information, see Section 18 (Contact Information).

2. Scope of This Policy

This Privacy Policy applies to information we collect through the Service. It does NOT apply to:

Third-party websites we link to (each operates under its own privacy policy).
Tournament-host casinos or card rooms (governed by their own policies).
Sponsors, partners, or other operators when they appear on the Service.

PokerPath does not currently operate a native mobile app. If we publish one, this policy will be updated.

3. Information We Collect

We collect only what we need to operate the Service.

3.1 Account Information

When you create an account, we collect:

Username (you choose this; used for sign-in)
Email address (used for sign-in, password recovery, transactional emails, and — only with your consent — notifications about tournaments you’ve saved)
Password (stored as a one-way cryptographic hash — we cannot read or recover your actual password)
Display name (optional; defaults to your username)
Self-declared home state (optional; used to power region-level aggregate reporting)
Profile and preference answers you give during onboarding or in your settings (home city, player type, skill level, typical buy-in range, travel preference, season goal, tournaments per month, budget and risk settings), and your notification and marketing-email preferences
Product-usage flags we keep to run the Service (onboarding progress, whether we have shown you an upgrade prompt, your last sign-in time, and the type and time of the last email we sent you)

3.2 Google Sign-In Information

If you sign in using Google, we additionally collect a Google account identifier that links your PokerPath account to your Google sign-in. See Section 11 for the explicit scope of Google data we access.

3.3 Tournament Interest and Saved Tournaments

When you save a tournament, mark interest, or save a tour, we record the tournament identifier, the time you saved it, and the link to your PokerPath account. This is used to power your “My Tournaments” view, the interest indicator, and notifications you’ve opted into.

3.4 Player Plus Feature Data

If you subscribe to Player Plus and use the bankroll or travel-planning features, we record the data you enter into those tools (bankroll settings, travel trip details, coaching session data). This data is yours; we do not analyze it for any purpose other than running the feature you’re using.

3.5 Authentication and Session Data

When you sign in, an authentication cookie is set in your browser (expires in 48 hours, or 14 days if “Remember me” is selected), and a “last login” timestamp is recorded on your account. If you use the Service before signing in, a short-lived guest session cookie may be set so we can remember the tournament you tapped “save” on; it expires after 24 hours.

3.6 Security Log

We maintain an internal security log to detect and respond to abuse. The log records event types such as failed sign-in attempts, password reset requests, promo-code redemptions, and rate-limit threshold breaches. The log records an opaque internal identifier and event metadata; it does NOT record your full email, your password, or any payment information. To rate-limit sign-in attempts, password resets, form submissions and similar operations we use your IP address transiently; it is stored only as a keyed hash in a short-lived counter (at most one hour for a temporary block) and is not written to the security log.

3.7 Analytics and Operational Measurement

PokerPath uses two complementary first-party, privacy-preserving measurement pipelines:

Plausible Analytics is our website analytics tool. Plausible is:

Cookie-free. Plausible does not set any cookie in your browser.
No persistent identifier. Plausible does not write localStorage or fingerprint your device.
No cross-site tracking. Plausible cannot link your activity here to your activity elsewhere.
EU-hosted. Plausible operates servers in Germany. Pageview data stays in the EU.
Aggregate-only. Outputs are daily totals, popular pages, and source/referrer summaries — never individual user activity.

You may opt out of Plausible by using a privacy extension that blocks Plausible’s domain, or by setting the browser flag Plausible provides for this purpose: open your browser’s developer console on pokerpath.app and run localStorage.plausible_ignore = "true". We do not try to bypass blockers. (Plausible’s current script does not read the browser’s “Do Not Track” setting.)

Aggregate tournament-interaction metrics are an internal pipeline that powers a future partner-reporting product. The pipeline:

Stores NO user identity. The internal event table contains no `user_id`, email, name, IP address, or User-Agent string.
Stores only aggregate counts (page views, saves, calendar adds, share clicks) per tournament, per day.
Aggregate-only outputs to verified partners (when partner dashboard launches); never per-user data.

3.8 What We Do NOT Collect

No advertising tracking. We embed no advertising SDKs and allow no third-party ad networks to track via our Service.
No data sales. See Section 5 (No Sale / No Sharing).
No precise location. No GPS, no IP-derived position. The region dimension uses only your self-declared home state.
No biometric, health, or financial data beyond the future Stripe payment processing described in Section 4.
No native-app device identifiers (the Service is a website).
No contact list, address book, camera roll, microphone, or camera access.

3.9 Partner Applications

If you apply for a partner (casino or tournament-operator) account, we collect the contact name and email address you enter, the venue name, website, venue type and approximate monthly tournament volume, and we record the verification decision.

4. How We Use Your Information

We use the data we collect only for:

Operating the Service — authenticating sign-ins, rendering tournament listings, powering saved tournaments, running the features you use.
Communicating with you — transactional emails (welcome, password reset, partner application acknowledgment) and, only if you’ve opted in, notifications about saved tournaments.
Aggregate measurement — Plausible Analytics and aggregate tournament-interaction metrics, as described in Section 3.7.
Security — detecting and responding to abuse, fraud, and security incidents.
Legal compliance — responding to lawful requests, preserving evidence during incidents, fulfilling privacy-rights requests.

When PokerPath introduces paid subscriptions, payment information will be handled by Stripe (we will never see or store your card number). This policy will be updated to describe Stripe’s role at that time.

We do NOT use your information for advertising targeting, sale to third parties, behavioral profile resale, or AI model training.

5. No Sale / No Sharing

PokerPath does not sell your personal information.

PokerPath does not share your personal information with third parties for cross-context behavioral advertising.

This applies under all definitions of “sale” and “sharing” applicable to PokerPath’s users in the relevant states (including California’s CCPA / CPRA framing of cross-context behavioral advertising, and parallel definitions under other US state privacy laws).

6. How We Share Your Information (Third-Party Service Providers)

We use a small set of third-party service providers (“processors”) to run the Service. Each processor has access only to the data necessary to perform their function, under contractual confidentiality and data-protection obligations.

Processor	Function	Jurisdiction	Data Accessed
WP Engine	Website hosting (WP Engine’s network is delivered through Cloudflare — see the Cloudflare row)	United States	All stored data (database, file system)
Sentry	Error monitoring	United States	Technical error metadata; opaque user identifier; no email, no IP, no full request body, no cookies
Resend	Transactional email delivery	United States	Recipient email address and message content
Google (only if you use Google Sign-In)	Authentication	United States	We receive limited Google profile data per Section 11; we send Google no information about your activity on PokerPath
Plausible Analytics	Aggregate website analytics	European Union (Germany)	Request envelope (IP + User-Agent) processed server-side then discarded; aggregate-only output; no cookies set
Cloudflare (edge network / CDN in front of our hosting)	Traffic routing, caching, bot protection	United States	Request envelope (IP address, User-Agent, requested URL) as required to serve the page; sets the `__cf_bm` bot-protection cookie
Google Fonts	Web-font delivery	United States	Your browser requests font files from fonts.googleapis.com, which receives your IP address and User-Agent; no cookies, no account information
unpkg (CDN)	Delivery of the Lucide icon library	United States	Your browser requests a script file from unpkg.com, which receives your IP address and User-Agent; no cookies, no account information

Future Stripe integration. When PokerPath adds paid subscriptions through Stripe, Stripe will become an additional processor. Stripe handles all payment card data; we will never see or store card numbers. This policy will be updated at that time.

7. Your Privacy Rights — General

You have rights with respect to your personal information. Under applicable US state and international privacy law, these rights typically include:

Right of access — request a copy of the personal information we hold about you.
Right of correction — request that we correct information that is wrong.
Right of deletion — request that we delete your account and personal information.
Right of portability — request your data in a structured, machine-readable format.
Right to opt out of marketing/notification emails — use the unsubscribe link or your account preferences.
Right to opt out of analytics — see Section 3.7 for the two opt-out methods.

To exercise any of these rights, email privacy@pokerpath.app with your request, including the email address associated with your account so we can verify the request comes from the account owner. We will respond within 30 days, or sooner if required by applicable law.

8. California Residents — CCPA / CPRA Rights

If you live in California, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act.

Categories of personal information we collect (CCPA framing):

Identifiers (username, email address)
Customer records (account profile)
Commercial information (Player Plus subscription status, if applicable)
Internet activity (your saved tournaments on our Service)
Geolocation: none at user-identifiable resolution
Sensitive personal information: none

Sources: Directly from you; from Google if you choose Google Sign-In.

Business purposes: As described in Section 4.

Sale or sharing for cross-context behavioral advertising: None. See Section 5.

How to Exercise Your California Rights

California residents may submit access, deletion, correction, or opt-out requests by emailing privacy@pokerpath.app. We will respond within 45 days as required by CCPA/CPRA. If we deny your request, you may appeal by replying to the denial email within 30 days. Authorized agent submissions are accepted with written authorization from you; we may verify by contacting you directly.

9. Texas Residents — Texas Data Privacy and Security Act (TDPSA)

Texas residents have rights under the Texas Data Privacy and Security Act including:

The right to access the personal data we process about you.
The right to correct inaccurate personal data.
The right to delete personal data we have collected.
The right to obtain a portable copy of your personal data in a usable format.
The right to opt out of the sale of personal data, targeted advertising, and profiling for decisions with significant effects (PokerPath does not engage in any of these activities).
The right to appeal a denial of any of the above requests.

To exercise any of these rights, email privacy@pokerpath.app. We will respond within the timeframe required by TDPSA. If we deny your request, you may appeal by replying to the denial email within 30 days. If your appeal is also denied, you may contact the Texas Attorney General to file a complaint.

10. EU / UK Residents

PokerPath does not actively market to or solicit EU or UK residents and is operated as a US-only service. PokerPath’s vendors that may process EU resident data (such as Plausible) operate from EU jurisdictions or under standard data protection frameworks.

If you are nonetheless located in the European Union, the United Kingdom, or another jurisdiction with GDPR-equivalent rights, the following rights may apply to you under applicable law:

Right of access
Right to rectification
Right to erasure / “right to be forgotten”
Right to restriction of processing
Right to data portability
Right to object to processing
Right not to be subject to automated decision-making with significant effect (we do not make automated decisions of this kind)

To exercise any of these rights, email privacy@pokerpath.app. You also have the right to lodge a complaint with your country’s supervisory authority.

11. Google Sign-In — Explicit Scope

When you sign in with Google, PokerPath only accesses basic Google account information necessary for authentication: your email address, display name, and avatar. We request only the minimum scopes necessary for authentication (email and profile). PokerPath does not access your Gmail, contacts, Google Drive, calendar, or any other Google account content.

You may revoke PokerPath’s access to your Google account at any time via https://myaccount.google.com/permissions. If your PokerPath account also has a password, you can disconnect Google sign-in from your My Path page (password confirmation required); your PokerPath account and saved data are unaffected.

12. Children’s Privacy

PokerPath is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we discover we have collected personal information from a child under 13, we will delete it.

If you believe a child has provided us with personal information, please contact privacy@pokerpath.app and we will investigate and delete as required.

Independently, the Service is intended for adults only (minimum age 18) and many tournaments listed on the Service require players to be 21 or older at the venue. You are solely responsible for verifying and complying with the minimum age requirements at any venue you attend.

13. Cookies and Similar Technologies

PokerPath uses a minimal set of cookies, all of which are essential for core functionality (sign-in, session, bot protection at the network edge, and recording your cookie-consent choice):

WordPress authentication cookie (48 hours, or 14 days if “Remember me” selected)
WordPress test cookie (verifies your browser accepts cookies; required for sign-in flow)
PokerPath guest session cookie (24 hours; remembers your pre-sign-in intent)
Cookie-consent preference cookie (set by our cookie banner when you make a choice, to remember your selection so you are not asked on every visit)
Cloudflare bot-protection cookie (__cf_bm, about 30 minutes) — set by the edge network in front of our hosting to distinguish browsers from automated traffic; contains no account information
Google sign-in state cookie (pp_google_state, 10 minutes) — set only while you are being redirected to Google and back, to tie the sign-in response to your browser; cleared when the sign-in completes

Browser local storage. PokerPath stores a few conveniences in your browser’s local storage rather than on our servers: your last five tournament-filter combinations and your last-used state filter, and (if you use Table Coach) the seat layout you last entered. These stay on your device, are never transmitted to PokerPath, and can be cleared from your browser settings at any time.

We do NOT use analytics cookies, advertising cookies, social-media tracking pixels, cross-domain tracking, or any fingerprinting technology. Plausible Analytics is intentionally cookie-free.

Cookies you can disable in your browser, but if you do, sign-in will not work.

14. Data Retention

We retain your information only as long as needed for the purposes described in this policy, or as required by law.

Category	Retention Period
Active account profile and saved tournaments	Deleted when your account is deleted (a purge job completes any remaining rows within hours, and a daily sweep catches anything missed); copies may persist in backups for up to 30 days
Player Plus feature data	Deleted with your account; copies may persist in backups for up to 30 days
Authentication sessions	48 hours (or 14 days if “Remember me”)
Guest session tokens	24 hours
Security logs	Retained 30 days (rows older than 30 days are deleted automatically); longer only if tied to an active security incident or legal matter (see below)
Backups	Deleted data may persist in backups for up to 30 days
Plausible aggregate data	Retained indefinitely (non-personal aggregate)
Aggregate tournament-interaction metrics	Retained indefinitely (non-personal aggregate; contains no per-user record)

When you delete your account, we delete the data above per the schedule and ask our processors to delete any of your data they hold on our behalf.

When we fulfil an erasure request for an account that remains open, we remove your profile, preferences, saved tournaments and interest marks, but retain: (1) entitlement and promo-code records (subscription status, promo grants), (2) the timestamp and version of your Terms acceptance and age affirmation, (3) partner-verification status, and (4) security-log rows within their 30-day window. These are kept to honour what you are entitled to, to evidence consent, and to detect abuse. Deleting the account entirely removes (1)–(3) with it.

If your account or data is involved in an active security incident or legal matter, we may retain the relevant records longer than the schedule above, until the matter is resolved.

15. Security

We take reasonable measures to protect your data:

Passwords are stored as one-way cryptographic hashes. We cannot read your password.
Connections to the Service are encrypted in transit (HTTPS / TLS).
The site sends modern security headers including HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy.
We operate a Content Security Policy that helps detect and prevent script injection.
Sensitive operations are rate-limited to prevent brute-force attacks.
We do not store payment card numbers. When paid subscriptions launch, Stripe will handle all card data.
External JavaScript dependencies we load are pinned with Subresource Integrity (SRI) hashes where applicable.

No system is perfectly secure, and we do not claim ours is. We work continuously to find and fix issues and we take security incidents seriously.

16. Breach Notification

In the event of a security incident involving your personal information, we will notify you and any required regulator consistent with applicable law:

Florida residents: notification within 30 days of breach determination.
California residents: notification “without unreasonable delay” as required under California law.
Texas residents: notification within 60 days as required under TDPSA.
All other US residents: notification within the timeframe required by your state’s breach-notification law.
EU / UK residents: where applicable, we will notify the relevant supervisory authority within 72 hours of becoming aware of a breach likely to result in risk to your rights.

17. Governing Law

This Privacy Policy is governed by the laws of the State of Texas, without regard to conflict of laws principles. Any disputes arising under this Privacy Policy are subject to the jurisdiction and venue provisions of our Terms of Service.

18. Contact Information

Privacy requests (access, deletion, correction, opt-out, appeals): privacy@pokerpath.app

General contact: support@pokerpath.app

19. Responsible Gaming

PokerPath promotes responsible gaming. For PokerPath’s complete Responsible Gaming statement and resources (including the National Council on Problem Gambling helpline), see Section 18 of our Terms of Service at https://pokerpath.app/terms.

20. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

Update the “Last Updated” date at the top of this policy.
Notify signed-in users by email when changes materially affect them.
Post the updated policy on the Service before the change takes effect.

We will not make a material change with retroactive effect. New data uses apply only to data collected from the effective date of the updated policy forward.

21. Effective Date

Effective Date: September 21, 2026 Last Updated: September 21, 2026