PokerPath Privacy Policy

Last Updated: November 8, 2026 Effective Date: October 21, 2026

PokerPath is operated by PokerPath LLC, owned by James Shouey.

1. Who We Are

PokerPath (“we,” “us,” or “PokerPath”) operates the website at https://pokerpath.app and any associated subdomains (collectively, the “Service”). PokerPath is a US-based service that helps poker players discover live tournaments, save tournaments they’re interested in, plan their travel, and use related player tools.

If you have questions about this Privacy Policy or about your personal information, see Section 18 (Contact Information).

2. Scope of This Policy

This Privacy Policy applies to information we collect through the Service. It does NOT apply to:

Third-party websites we link to (each operates under its own privacy policy).
Tournament-host casinos or card rooms (governed by their own policies).
Sponsors, partners, or other operators when they appear on the Service.

PokerPath does not currently operate a native mobile app. If we publish one, this policy will be updated.

3. Information We Collect

We collect only what we need to operate the Service.

3.1 Account Information

When you create an account, we collect:

Username (you choose this; used for sign-in)
Email address (used for sign-in, password recovery and transactional emails, and for alert emails about events you’ve saved or marked — see Section 4. Alert emails are on when you create an account; you can turn any or all of them off during sign-up, in Notification Settings, or from the link in any alert email)
Password (stored as a one-way cryptographic hash — we cannot read or recover your actual password)
Display name (optional; defaults to your username)
Self-declared home state (optional; used to power region-level aggregate reporting)
Profile and preference answers you give during onboarding or in your settings (home city, player type, skill level, typical buy-in range, travel preference, season goal, tournaments per month, budget and risk settings), and your notification and email-alert settings (which alert emails you want, and how many interested players make an event “hot” for you)
Product-usage flags we keep to run the Service (onboarding progress, whether we have shown you an upgrade prompt, your last sign-in time, and the type and time of the last email we sent you)

Home city, drive ranges and rooms you play. If you add your home city, how far you’ll drive, whether you budget a hotel, and rooms you play, we use them to show events near you and to estimate trip costs. Drive times are worked out on our server from public US Census town locations. We don’t use a maps service, we don’t use your device’s location for this, and we don’t share these answers with casinos or partners. Partner reports still use only your home state, as before.

3.2 Google Sign-In Information

If you sign in using Google, we additionally collect a Google account identifier that links your PokerPath account to your Google sign-in. See Section 11 for the explicit scope of Google data we access.

3.3 Tournament Interest and Saved Tournaments

When you save a tournament, mark interest, or save a tour, we record the tournament identifier, the time you saved it, and the link to your PokerPath account. This is used to power your “My Tournaments” view, the interest indicator, and notifications you’ve opted into.

3.4 Player Plus Feature Data

If you subscribe to Player Plus and use the bankroll or travel-planning features, we record the data you enter into those tools (bankroll settings, travel trip details, coaching session data). This data is yours; we do not analyze it for any purpose other than running the feature you’re using.

Tournament results you log. If you record a result — in Bankroll Coach (“Log a result”), at the end of a Stage Coach chain, from the “How did it go?” card, or from the ICM calculator — we store the event, date, buy-ins, add-ons, cash won, your share, and any place or venue you enter, with your account, and use them to keep your bankroll up to date. Money you tell us you added to or took out of your bankroll is stored the same way, with any note you write. To ask “How did it go?” after an event you saved, we keep a short list of the events you marked “Didn’t play” or “Remind me later” (event ids and dates only, no amounts); entries older than 30 days are removed. You can turn these questions off with the “Track my results” switch in Bankroll Coach. You can edit or delete any result. All of this is in your data export and is deleted when you erase your data or delete your account.

Series fund. If you set up a series fund in Bankroll Coach, we store the amount you set aside each month, your starting amount and cap, and which of your saved or logged events you pay from it. We use them to show how much you have set aside and when you can afford a series. It is in your data export and is deleted when you erase your data or delete your account.

3.5 Authentication and Session Data

When you sign in, an authentication cookie is set in your browser (expires in 48 hours, or 14 days if “Remember me” is selected), and a “last login” timestamp is recorded on your account. If you use the Service before signing in, a short-lived guest session cookie may be set so we can remember the tournament you tapped “save” on; it expires after 24 hours.

3.6 Security Log

We maintain an internal security log to detect and respond to abuse and to keep a record of administrator sign-ins. The log records event types such as failed sign-in attempts, password reset requests, promo-code redemptions, rate-limit threshold breaches and administrator sign-ins. Each entry records the time, the IP address of the request, and event details such as an internal account number or a keyed, non-reversible tag for the account a failed sign-in was aimed at. Some entries about email delivery, sign-up or sign-in failures include a one-way hash of the email address involved, so repeated problems can be linked; the log never records an email address in readable form, your password, verification codes, or any payment information. Only PokerPath administrators can view the log. To rate-limit sign-in attempts, password resets, form submissions and similar operations we also keep your IP address as a keyed hash in a short-lived counter (at most one hour for a temporary block); expired counters are deleted within a day.

3.7 Analytics and Operational Measurement

PokerPath uses two complementary first-party, privacy-preserving measurement pipelines:

Plausible Analytics is our website analytics tool. It only loads after you agree on our cookie banner (Accept, or Statistics in your cookie preferences). Plausible is:

Cookie-free. Plausible does not set any cookie in your browser.
No persistent identifier. Plausible does not write localStorage or fingerprint your device.
No cross-site tracking. Plausible cannot link your activity here to your activity elsewhere.
EU-hosted. Plausible operates servers in Germany. Pageview data stays in the EU.
Aggregate-only. Outputs are daily totals, popular pages, and source/referrer summaries — never individual user activity.

You may opt out of Plausible by using a privacy extension that blocks Plausible’s domain, or by setting the browser flag Plausible provides for this purpose: open your browser’s developer console on pokerpath.app and run localStorage.plausible_ignore = "true". We do not try to bypass blockers. (Plausible’s current script does not read the browser’s “Do Not Track” setting.)

Aggregate tournament-interaction metrics are an internal pipeline that powers a future partner-reporting product. The pipeline:

Stores NO user identity. The internal event table contains no `user_id`, email, name, IP address, or User-Agent string.
Stores only aggregate counts (page views, saves, calendar adds, share clicks) per tournament, per day.
Aggregate-only outputs to verified partners (when partner dashboard launches); never per-user data.

Coach usage counts. When you use certain coach features — for example opening “Suggested for you” or a “Your Sweet Spot” box, tapping “This doesn’t fit my spot” in Stage Coach or Table Coach, or using Stage Coach’s re-entry panel — we add one to an anonymous count of how often that feature is used. These counts store no user identity; we use them to improve the coaches. So that no single account can inflate a count, we keep a small counter on your account of how many times you were counted in the current hour. It is replaced each hour, is included in your data export, and is deleted with your account.

3.8 What We Do NOT Collect

No advertising tracking. We embed no advertising SDKs and allow no third-party ad networks to track via our Service.
No data sales. See Section 5 (No Sale / No Sharing).
No precise location. No GPS, no IP-derived position. The region dimension uses only your self-declared home state.
No biometric or health data, and no bank, card or account numbers. Amounts you type into Bankroll Coach and the results tools are stored as described in Section 3.4.
No native-app device identifiers (the Service is a website).
No contact list, address book, camera roll, microphone, or camera access.

3.9 Partner Applications

If you apply for a partner (casino or tournament-operator) account, we collect the contact name and email address you enter, the venue name, website, venue type and approximate monthly tournament volume, and we record the verification decision.

3.10 Email Alerts and Unsubscribe Links

Reminder log. When we send you a day-before reminder, we keep a short record — an internal reference to the event and its date, the delivery status, the number of attempts, and the message reference our email provider returns — so the same reminder is never sent twice. These records are deleted automatically after 90 days.

Unsubscribe links. Each alert email carries a “Manage or stop these emails” link containing a random code, so you can change your alert settings without signing in. We store only a one-way cryptographic hash of each code (never the code itself), and only the most recent 50. Opening the link changes nothing; a setting changes only when you press a button on that page. Changing your password, or choosing “Reset my email links” in Notification Settings, makes every earlier link stop working.

“Email me a new link.” If you ask for a new link, we email one only if the address belongs to an account, and the page shows the same message either way, so it cannot be used to discover who has an account. To prevent abuse, these requests are rate-limited using your IP address and the email address you entered, each kept only as a keyed hash in a counter that expires within an hour.

3.11 PokerPath Partners

If you apply to be a PokerPath partner, we keep what you tell us (your name, the venue or series name, contact email and phone, website, the casino you named and your note) to review your application and contact you about it. Partner notes you send, once we approve them, are shown publicly on the event page under the venue or series name.

If you report a problem with a partner’s event, we tell the partner what kind of problem was reported and how many players reported it. We never tell them who reported it.

We keep a copy of the service emails we send partners for up to 90 days, to make sure they arrive.

To help partners, PokerPath administrators can open a read-only preview of a partner’s Partner Path. We keep a record of each preview (which administrator, which partner account, and when) for security.

If you send us a series schedule — typed in or as a CSV file — we read the file once to check it and keep only the series details and events you send, not the file itself. Drafts you don’t send are deleted after 14 days, and the events we publish are shown publicly on the series page under the series name.

If you add events on Partner Path — one at a time or as a weekly event — we keep the event details you enter (name, date and time, game, buy-in, guarantee and the other event fields), which weeks you picked, and who sent them, so we can review and publish them and show them back to you on Partner Path. Events we publish are shown publicly on PokerPath under your venue’s name. Your submissions are included when you download your data. If you erase your data or delete your account, we delete the records of what you sent, but events that are already published stay listed as part of the venue’s public schedule, because players may have saved or planned around them. To have a published event taken down, cancel it on Partner Path or contact us.

3.12 Interest Alerts

Interest alerts. When you mark interest in a tournament, we record that you did and when, and we use it to show an anonymous count of interested players. If interest grows in an event you saved, or in an event within your play area (the home state, drive ranges and rooms you gave us), we may tell you on PokerPath and by email. Alerts show counts only — never who is interested. You can turn off alerts for saved events and alerts for events near you separately, in Notification Settings or from any alert email; “All alert emails” turns off every alert email. We keep a record of when interest was added or removed for 30 days and a log of the alerts we create and send (which event, when, and whether it was delivered) for 90 days. Both are included when you download or erase your data. If your interest mark is the one that makes an event ‘hot’, we note that with your account for up to 400 days so the same alert is never sent twice. Erasing your data or deleting your account removes your name from it.

Partners. If you list events on PokerPath as a partner, we may tell you on Partner Path and by email — to your account address and your listed contact address — when interest in your own events grows. Partners see counts only, never the names or any detail of the players who are interested. You can turn these alerts off on Partner Path → Account or from any alert email.

3.13 Tour Stop Cards

Tour stop cards. If your profile has a home area, or you pick a state, we may show one upcoming tour stop near it. If you hide it, we remember that on your account (members) or only in this browser (visitors; clearing site data resets it). Separately, we count how often these cards are seen and tapped, without names or accounts. A member’s hidden-card record is deleted 30 days after that series ends, and is included when you download or erase your data; a browser forgets hidden cards after 180 days.

4. How We Use Your Information

We use the data we collect only for:

Operating the Service — authenticating sign-ins, rendering tournament listings, powering saved tournaments, running the features you use.
Communicating with you — transactional emails (welcome, password reset, partner application acknowledgment, and a notice if an event you saved is cancelled or postponed) and alert emails: hot-event alerts when an event you’re interested in reaches the number of interested players you chose (5, 10 or 25), and day-before reminders (when switched on; sent around 6 pm local time at the venue) for events you’ve marked Planned or Registered. You can turn alert emails off at any time (see Section 7). Account and security emails, such as password resets, are always sent.
Aggregate measurement — Plausible Analytics and aggregate tournament-interaction metrics, as described in Section 3.7.
Security — detecting and responding to abuse, fraud, and security incidents.
Legal compliance — responding to lawful requests, preserving evidence during incidents, fulfilling privacy-rights requests.

When PokerPath introduces paid subscriptions, payment information will be handled by Stripe (we will never see or store your card number). This policy will be updated to describe Stripe’s role at that time.

We do NOT use your information for advertising targeting, sale to third parties, behavioral profile resale, or AI model training.

5. No Sale / No Sharing

PokerPath does not sell your personal information.

PokerPath does not share your personal information with third parties for cross-context behavioral advertising.

This applies under all definitions of “sale” and “sharing” applicable to PokerPath’s users in the relevant states (including California’s CCPA / CPRA framing of cross-context behavioral advertising, and parallel definitions under other US state privacy laws).

6. How We Share Your Information (Third-Party Service Providers)

We use a small set of third-party service providers (“processors”) to run the Service. Each processor has access only to the data necessary to perform their function, under contractual confidentiality and data-protection obligations.

Processor	Function	Jurisdiction	Data Accessed
WP Engine	Website hosting (WP Engine’s network is delivered through Cloudflare — see the Cloudflare row)	United States	All stored data (database, file system)
Sentry	Error monitoring	United States	Technical error metadata; opaque user identifier; no email, no IP, no full request body, no cookies
Resend	Transactional email delivery	United States	Recipient email address and message content; for reminders, a one-time request key (a hash containing no personal information) so the same reminder is never delivered twice
Google (only if you use Google Sign-In)	Authentication	United States	We receive limited Google profile data per Section 11; we send Google no information about your activity on PokerPath
Plausible Analytics	Aggregate website analytics	European Union (Germany)	Request envelope (IP + User-Agent) processed server-side then discarded; aggregate-only output; no cookies set
Cloudflare (edge network / CDN in front of our hosting)	Traffic routing, caching, bot protection	United States	Request envelope (IP address, User-Agent, requested URL) as required to serve the page; sets the `__cf_bm` bot-protection cookie

Future Stripe integration. When PokerPath adds paid subscriptions through Stripe, Stripe will become an additional processor. Stripe handles all payment card data; we will never see or store card numbers. This policy will be updated at that time.

7. Your Privacy Rights — General

You have rights with respect to your personal information. Under applicable US state and international privacy law, these rights typically include:

Right of access — request a copy of the personal information we hold about you.
Right of correction — request that we correct information that is wrong.
Right of deletion — request that we delete your account and personal information.
Right of portability — request your data in a structured, machine-readable format.
Right to opt out of alert emails — use the “Manage or stop these emails” link in any alert email (no sign-in needed), the Unsubscribe button your email app shows for our alert emails (it turns off that type of alert in one step), or Notification Settings when signed in. You can stop one type of alert or all of them. Account emails such as password resets are always sent.
Right to opt out of analytics — see Section 3.7 for the two opt-out methods.

To exercise any of these rights, email privacy@pokerpath.app with your request, including the email address associated with your account so we can verify the request comes from the account owner. We will respond within 30 days, or sooner if required by applicable law.

8. California Residents — CCPA / CPRA Rights

If you live in California, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act.

Categories of personal information we collect (CCPA framing):

Identifiers (username, email address)
Customer records (account profile)
Commercial information (Player Plus subscription status, if applicable)
Internet activity (your saved tournaments on our Service)
Geolocation: none at user-identifiable resolution
Sensitive personal information: none

Sources: Directly from you; from Google if you choose Google Sign-In.

Business purposes: As described in Section 4.

Sale or sharing for cross-context behavioral advertising: None. See Section 5.

How to Exercise Your California Rights

California residents may submit access, deletion, correction, or opt-out requests by emailing privacy@pokerpath.app. We will respond within 45 days as required by CCPA/CPRA. If we deny your request, you may appeal by replying to the denial email within 30 days. Authorized agent submissions are accepted with written authorization from you; we may verify by contacting you directly.

9. Texas Residents — Texas Data Privacy and Security Act (TDPSA)

Texas residents have rights under the Texas Data Privacy and Security Act including:

The right to access the personal data we process about you.
The right to correct inaccurate personal data.
The right to delete personal data we have collected.
The right to obtain a portable copy of your personal data in a usable format.
The right to opt out of the sale of personal data, targeted advertising, and profiling for decisions with significant effects (PokerPath does not engage in any of these activities).
The right to appeal a denial of any of the above requests.

To exercise any of these rights, email privacy@pokerpath.app. We will respond within the timeframe required by TDPSA. If we deny your request, you may appeal by replying to the denial email within 30 days. If your appeal is also denied, you may contact the Texas Attorney General to file a complaint.

10. EU / UK Residents

PokerPath does not actively market to or solicit EU or UK residents and is operated as a US-only service. PokerPath’s vendors that may process EU resident data (such as Plausible) operate from EU jurisdictions or under standard data protection frameworks.

If you are nonetheless located in the European Union, the United Kingdom, or another jurisdiction with GDPR-equivalent rights, the following rights may apply to you under applicable law:

Right of access
Right to rectification
Right to erasure / “right to be forgotten”
Right to restriction of processing
Right to data portability
Right to object to processing
Right not to be subject to automated decision-making with significant effect (we do not make automated decisions of this kind)

To exercise any of these rights, email privacy@pokerpath.app. You also have the right to lodge a complaint with your country’s supervisory authority.

11. Google Sign-In — Explicit Scope

When you sign in with Google, PokerPath only accesses basic Google account information necessary for authentication: your email address, display name, and avatar. We request only the minimum scopes necessary for authentication (email and profile). PokerPath does not access your Gmail, contacts, Google Drive, calendar, or any other Google account content.

You may revoke PokerPath’s access to your Google account at any time via https://myaccount.google.com/permissions. If your PokerPath account also has a password, you can disconnect Google sign-in from your My Path page (password confirmation required); your PokerPath account and saved data are unaffected.

12. Children’s Privacy

PokerPath is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we discover we have collected personal information from a child under 13, we will delete it.

If you believe a child has provided us with personal information, please contact privacy@pokerpath.app and we will investigate and delete as required.

Independently, the Service is intended for adults only (minimum age 21 to create an account) and many tournaments listed on the Service require players to be 21 or older at the venue. You are solely responsible for verifying and complying with the minimum age requirements at any venue you attend.

13. Cookies and Similar Technologies

PokerPath uses a minimal set of cookies, all of which are essential for core functionality (sign-in, session, bot protection at the network edge, and recording your cookie-consent choice):

WordPress authentication cookie (48 hours, or 14 days if “Remember me” selected)
WordPress test cookie (verifies your browser accepts cookies; required for sign-in flow)
PokerPath guest session cookie (24 hours; remembers your pre-sign-in intent)
Cookie-consent preference cookie (set by our cookie banner when you make a choice, to remember your selection so you are not asked on every visit)
Cloudflare bot-protection cookie (__cf_bm, about 30 minutes) — set by the edge network in front of our hosting to distinguish browsers from automated traffic; contains no account information
Google sign-in state cookie (wordpress_pp_google_state, 10 minutes) — set only while you are being redirected to Google and back, to tie the sign-in response to your browser; cleared when the sign-in completes

Browser local storage. PokerPath stores a few conveniences in your browser’s local storage rather than on our servers: your last five tournament-filter combinations and your last-used state filter, the state you picked for “near you”, whether you’ve seen the Sweet Spot introduction, tour stop cards you hid (forgotten after 180 days), and, if you use them, the seat layout you last entered in Table Coach and the payouts you entered in Stage Coach’s ICM tool (plus, for that browser session only, an ICM amount you chose to send to Bankroll Coach). These stay on your device, are never transmitted to PokerPath, and can be cleared from your browser settings at any time.

We do NOT use analytics cookies, advertising cookies, social-media tracking pixels, cross-domain tracking, or any fingerprinting technology. Plausible Analytics is intentionally cookie-free.

Cookies you can disable in your browser, but if you do, sign-in will not work.

14. Data Retention

We retain your information only as long as needed for the purposes described in this policy, or as required by law.

Category	Retention Period
Active account profile and saved tournaments	Deleted when your account is deleted (a purge job completes any remaining rows within hours, and a daily sweep catches anything missed); copies may persist in backups for up to 30 days
Player Plus feature data	Deleted with your account; copies may persist in backups for up to 30 days
Authentication sessions	48 hours (or 14 days if “Remember me”)
Guest session tokens	24 hours
Security logs	Deleted by a daily job once they are more than 30 days old. If we need entries for an active security incident or legal matter, we copy the relevant entries before they are deleted; the log itself is not paused. Host backups may hold copies as described below.
Backups	Deleted data may persist in backups for up to 30 days
Plausible aggregate data	Retained indefinitely (non-personal aggregate)
Aggregate tournament-interaction metrics	Retained indefinitely (non-personal aggregate; contains no per-user record)
Reminder log (which reminder was sent, when, and its delivery status)	90 days, then deleted automatically; also deleted with your account
Unsubscribe-link hashes	Until replaced by newer ones (the most recent 50 are kept), until you change your password or choose “Reset my email links”, or until your account is deleted
Problem reports you send about an event	Linked to your account until 12 months after the report is resolved, then the link to you is removed

When you delete your account, we delete the data above per the schedule and ask our processors to delete any of your data they hold on our behalf.

When we fulfil an erasure request for an account that remains open, we remove your profile, preferences (including your email-alert settings), saved tournaments and interest marks, your reminder log and your unsubscribe-link hashes, but retain: (1) entitlement and promo-code records (subscription status, promo grants), (2) the timestamp and version of your Terms acceptance and age affirmation, (3) partner-verification status, and (4) security-log rows within their 30-day window. These are kept to honour what you are entitled to, to evidence consent, and to detect abuse. Deleting the account entirely removes (1)–(3) with it.

If your account or data is involved in an active security incident or legal matter, we may retain the relevant records longer than the schedule above, until the matter is resolved.

15. Security

We take reasonable measures to protect your data:

Passwords are stored as one-way cryptographic hashes. We cannot read your password.
Connections to the Service are encrypted in transit (HTTPS / TLS).
The site sends modern security headers including HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy.
We operate a Content Security Policy that helps detect and prevent script injection.
Sensitive operations are rate-limited to prevent brute-force attacks.
We do not store payment card numbers. When paid subscriptions launch, Stripe will handle all card data.
External JavaScript dependencies we load are pinned with Subresource Integrity (SRI) hashes where applicable.

No system is perfectly secure, and we do not claim ours is. We work continuously to find and fix issues and we take security incidents seriously.

16. Breach Notification

In the event of a security incident involving your personal information, we will notify you and any required regulator consistent with applicable law:

Florida residents: notification within 30 days of breach determination.
California residents: notification “without unreasonable delay” as required under California law.
Texas residents: notification within 60 days as required by Texas law (Business & Commerce Code §521.053).
All other US residents: notification within the timeframe required by your state’s breach-notification law.
EU / UK residents: where applicable, we will notify the relevant supervisory authority within 72 hours of becoming aware of a breach likely to result in risk to your rights.

17. Governing Law

This Privacy Policy is governed by the laws of the State of Texas, without regard to conflict of laws principles. Any disputes arising under this Privacy Policy are subject to the jurisdiction and venue provisions of our Terms of Service.

18. Contact Information

Privacy requests (access, deletion, correction, opt-out, appeals): privacy@pokerpath.app

General contact: support@pokerpath.app

19. Responsible Gaming

PokerPath promotes responsible gaming. For PokerPath’s complete Responsible Gaming statement and resources (including the National Council on Problem Gambling helpline), see Section 18 of our Terms of Service at https://pokerpath.app/terms.

20. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

Update the “Last Updated” date at the top of this policy.
Notify signed-in users by email when changes materially affect them.
Post the updated policy on the Service before the change takes effect.

We will not make a material change with retroactive effect. New data uses apply only to data collected from the effective date of the updated policy forward.

21. Effective Date

Effective Date: October 21, 2026 Last Updated: November 8, 2026