Privacy Policy
This policy explains what personal data Peka Software AS ("we", "us") processes when you use the GTO Poker Trainer: Postflop app for iOS and Android ("the App"), why we process it, who receives it, how long we keep it and what choices you have.
In short
- No account, name, e-mail address or phone number is needed to use the App.
- No ads, no advertising ID, no tracking across other companies' apps or websites, and we never sell personal data.
- Your training history lives on your device and is not copied to our servers. A random anonymous ID (Google Firebase) is created the first time the App needs our servers, for example for Nash, a bug report or deleting your data.
- Usage analytics and crash reports help us improve the App. In the EEA, the UK and Switzerland they are only switched on if you accept. You can change this at any time in Settings > Data and privacy.
- Nash, the AI assistant, sends the question you type (and the hand you are looking at) to our server and to our AI provider, but only after you agree and confirm you are 18 or older.
- You can delete your data in the App: Settings > Data and privacy > Delete my data. See Delete my data.
- Who is responsible
- What we process and why
- What we do not do
- Legal bases
- Consent and your choices
- Who receives data
- International transfers
- How long we keep data
- Your rights
- Children
- Security
- Region notes (EEA, Korea, USA)
- Changes
- Contact and complaints
1. Who is responsible
Peka Software AS (organisation number 830 888 802), Fredrik Meltzers gate 13B, 5007 Bergen, Norway, is the data controller. For privacy questions and requests write to support@pekasoftware.com. We have not appointed a data protection officer.
2. What we process and why
2.1 Training data on your device
Your answers, statistics, streaks, ratings, settings and reminder choices are stored on your device and are not copied to our servers. Uninstalling the App or using Delete my data removes them. Backups of your device made by Apple or Google may contain this data; you and the platform control those. Export my data (Settings > Data and privacy) creates a copy as a file that you can save or share.
2.2 Anonymous ID and installation ID
The first time the App needs one of our servers (for example for Nash, a bug report or Delete my data) it creates an anonymous user ID with Firebase Authentication. It is a random identifier. The App does not ask for your name, e-mail address, phone number or any sign-in. We use the ID to apply fair-use limits, to keep the record of your Nash agreement and settings, to link the reports you send to you, to find your data when you ask us to delete it, and to protect our servers from abuse. Version 2.0 does not store a backup of your training history on our servers; if we ever add an optional backup we will describe it here before it is switched on.
The App also creates a random installation ID that is kept on your device. It is sent to our servers with bug reports and deletion requests and is attached to crash reports, and it decides which version of an experiment you get (see 2.7). Firebase App Check confirms that requests come from a genuine copy of the App (Apple App Attest or DeviceCheck on iOS, Play Integrity on Android); this involves attestation tokens exchanged with Apple or Google.
2.3 Purchases
Subscriptions and the lifetime purchase are processed by Apple or Google. We never receive your card number or store account details. We use RevenueCat, Inc. as our service provider to validate purchases and to manage access to Pro. RevenueCat receives an anonymous app user ID, purchase and subscription information (product, price, store, dates, status), your country (derived from your IP address) and technical details such as app and operating-system version.
2.4 Apple Ads attribution (iOS only)
If you installed the App after tapping one of our Apple Ads, the iOS AdServices framework lets RevenueCat retrieve campaign-level information (campaign, ad group, keyword) from Apple so that we can measure our own advertising. This does not use the advertising identifier (IDFA), does not require the App Tracking Transparency prompt and is not used to follow you across other companies' apps or websites.
2.5 Usage analytics (Google Analytics for Firebase)
We measure how the App is used, for example which screens and onboarding steps are viewed, how many hands are played, whether answers were correct and how large the EV loss was, when the paywall is shown and what you choose, and changes to settings. Each event comes with device model, operating system and app version, language, your approximate region (derived from the IP address by Google) and a random Firebase app-instance ID. Events never contain free text, names or e-mail addresses. Google signals, ad personalisation and advertising IDs are switched off.
In the EEA, the UK and Switzerland analytics is only switched on after you accept. Elsewhere it is on by default. You can change your choice at any time in Settings > Data and privacy. We decide whether to ask from the region of your device and the country of your app-store account: if either is in the EEA, the UK or Switzerland, or if we cannot tell, the App asks before it collects anything.
2.6 Crash reports (Firebase Crashlytics)
If the App crashes or fails, Crashlytics receives a technical report (stack trace, device and operating-system information, app version, language, your Pro status, short redacted app log lines and the random installation ID). The same consent rule as in 2.5 applies.
2.7 Remote configuration and experiments
Firebase Remote Config delivers settings such as feature switches and which version of a screen (for example the purchase screen) you see. It uses a Firebase installation ID and your language, country, operating system and app version. Which variant of a screen you see in an experiment is decided on your device from the random installation ID (see 2.2). The variant is only added to analytics events and crash reports if those are switched on for you.
2.8 Nash, the AI assistant
Nash is an optional AI assistant in the App. It is an artificial-intelligence system, not a person, and its answers can be wrong.
- Guided topics (fixed questions such as "Explain this spot") are produced on your device from the App's own solver data. Nothing is sent to an AI provider.
- Ask Nash (typing your own question) needs your agreement the first time and is available to people who confirm they are 18 or older. A screen tells you that Nash is an AI, names our AI provider and what is sent, and asks you to tap Agree and to confirm "I am 18 or older". If you choose Not now, the guided topics keep working.
When you ask Nash a question, the App sends the text of your question and the last few messages of the conversation, the hand or spot you are looking at (cards, board, positions, stacks, actions and solver results), your app language, the app version, the platform, the name of the screen you are on and, only when the question is about your progress, a summary of your statistics to our server (Google Cloud Functions). Our server receives your anonymous ID with every request and checks the record of your Nash agreement (AI notice, 18+ confirmation, version and time). It then applies safety and topic filters and forwards the question and context, without your ID, to our AI provider, currently Anthropic PBC (Claude models, United States), which returns the answer.
We do not send your name, e-mail address, anonymous ID, device identifiers or IP address to Anthropic. We do not store the text of your questions or of Nash's answers on our servers (unless you switch on Help improve Nash, described below); the conversation is kept on your device, if you leave Save chat history on this device on, until you clear it or delete your data. We only store technical records that contain no text: a counter of how many questions you asked today and, for each answer, its time, language, outcome, size and safety-filter flags (kept for 30 days), to apply fair-use limits, prevent abuse and fix problems. Under our commercial terms Anthropic does not use this content to train its models and deletes API inputs and outputs within 30 days. If content is flagged as violating Anthropic's usage policy it may be kept longer (up to two years). If you tap Report this answer, we store which answer you reported, the category you chose, your optional note and the technical record of that answer for 12 months. The text of the question and answer (the last few messages) is only attached if you tick the box to include the conversation. Please do not put personal or sensitive information into questions. You can withdraw your agreement or switch Nash off completely at any time in Settings > Nash.
Help improve Nash (optional, off by default). If you switch this on in Settings > Nash, each new question and Nash's answer is stored together with your anonymous ID so that we can check the quality of the answers and improve Nash. It is deleted automatically after 90 days. Switching the option off stops storage and deletes what is already stored; Delete my data removes it as well.
2.9 Bug reports and feature requests
Settings > About lets you send a bug report or a feature request. We process what you type, an optional e-mail address if you want a reply, optional screenshots (up to three), technical context (app version, operating-system version, device model, language), short redacted app log lines and your anonymous ID (plus the random installation and purchase IDs). The e-mail address and screenshots are stored in a restricted support record. A sanitised copy of the description (links removed, profanity masked), the non-sensitive technical context and the redacted log lines is created as an issue in our private development tracker on GitHub. Your e-mail address, screenshots and IDs are never put into that issue. You can also start a report from Nash; Nash only drafts it and nothing is sent until you confirm. If you are offline, the report is saved on your device and sent when you are online again. Please do not include passwords, payment details or other sensitive information.
2.10 Reminders
Reminders (for example a daily-practice or streak reminder) are local notifications created by the App on your device. No push token is collected and no notification data leaves your device. You choose which reminders you want and can turn them off in the App or in your system settings. We do not use notifications for advertising.
2.11 E-mail to support
If you write to us we process your e-mail address and your message to answer you. Our mailbox is hosted by Google Workspace.
2.12 Links to our other apps
The App may suggest other apps from us or from companies related to us (for example GTO Gecko or GTO Preflop). Tapping a suggestion opens the App Store or Google Play. We do not send your ID or your data to those listings or to those companies.
2.13 This website
These pages set no cookies and load no third-party scripts, fonts or trackers. Our web host (Netlify) keeps standard server logs, including IP addresses, for security.
2.14 Earlier versions of the App
Versions before 2.0 used the AppsFlyer and Meta (Facebook) SDKs, an App Tracking Transparency prompt and a log of your answered hands in our database under your RevenueCat ID. Version 2.0 removes those SDKs. Data collected by earlier versions may still exist with those providers and in our database. Version 2.0 may read that database copy once, only to bring your earlier history into the App on your device; it does not change it. We will delete the database records no later than 12 months after version 2.0 is released, and we will submit deletion requests to AppsFlyer and Meta if you ask us to. See Delete my data.
3. What we do not do
- We do not show ads and do not use the advertising identifier (IDFA / Google advertising ID).
- We do not track you across other companies' apps or websites and we do not sell or rent personal data.
- We do not collect your name, e-mail address (except if you type it in a report or write to us), precise location, contacts or photo library. A screenshot is only attached if you choose to.
- We do not use your data to build advertising profiles.
- The App offers no real-money gambling.
4. Legal bases (GDPR)
| Purpose | Legal basis |
|---|---|
| Running the App, Nash limits and records, purchases and access to Pro | Performance of our contract with you (Art. 6(1)(b)) |
| Security, abuse prevention, App Check, rate limits, feature switches (Remote Config), fixing bugs, support | Our legitimate interests in a secure and working service (Art. 6(1)(f)) |
| Analytics and crash reports in the EEA, UK and Switzerland | Your consent (Art. 6(1)(a); Norwegian Electronic Communications Act section 3-15 / ePrivacy Art. 5(3)) |
| Analytics and crash reports elsewhere; measuring our own Apple Ads campaigns | Our legitimate interests in improving the App and measuring our advertising (Art. 6(1)(f)); you can switch analytics off in Settings |
| Nash (Ask Nash) and the optional Help improve Nash | Your explicit consent (Art. 6(1)(a)) |
| Keeping records we are legally required to keep (for example accounting) | Legal obligation (Art. 6(1)(c)) |
5. Consent and your choices
- Analytics and crash reports: Settings > Data and privacy. In the EEA, the UK and Switzerland they stay off until you accept. Declining never reduces the functionality of the App.
- Nash: you decide whether to use Ask Nash and whether to switch on Help improve Nash. Withdraw or switch Nash off in Settings > Nash. Withdrawal does not affect earlier processing.
- Reminders: in the App and in your system settings.
- Delete my data: Settings > Data and privacy > Delete my data.
6. Who receives data
We do not sell personal data. We use service providers that process data on our behalf and are bound by data-processing terms:
| Provider | What for | Location |
|---|---|---|
| Google (Firebase and Google Cloud: Authentication, App Check, Cloud Firestore, Cloud Storage, Cloud Functions, Remote Config, Google Analytics, Crashlytics) | Anonymous ID, backend (Nash limits and records, reports, screenshots, deletion), analytics, crash reports, configuration, app attestation | United States and other Google locations (our database is in the US multi-region nam5) |
| RevenueCat, Inc. | Purchase validation, access to Pro, Apple Ads attribution | United States |
| Anthropic PBC | Generating Nash answers (only Ask Nash, see 2.8) | United States |
| GitHub, Inc. (Microsoft) | Private development tracker for sanitised bug reports and feature requests | United States |
| Google Workspace | Our support mailbox | Google locations |
| Netlify, Inc. | Hosting of this website | United States / global |
Apple and Google are independent controllers for your store account, payments, subscriptions and refunds; their own privacy policies apply. We may disclose data if the law requires it or to protect our rights, and in a merger or sale of the business under the same protections.
7. International transfers
Our providers process data outside Norway and the EEA, mainly in the United States. We rely on adequacy decisions (such as the EU-US Data Privacy Framework, which also applies to the EEA states) or on the European Commission's Standard Contractual Clauses, and on the providers' data-processing terms. You can ask us for a copy of the safeguards.
8. How long we keep data
| Data | Retention |
|---|---|
| Training data on your device | Until you reset it, delete your data or uninstall the App |
| Anonymous ID and the records linked to it | Until you use Delete my data or ask us to delete them |
| Purchase and access records (RevenueCat) | While needed to provide and support your purchase; deleted on request. Records we must keep by law (for example accounting) are kept as long as the law requires |
| Analytics (Google Analytics) | 14 months; exports to our analytics warehouse up to 24 months; after that deleted or kept only in aggregated form |
| Crash reports | 90 days |
| Backend logs (Google Cloud) | 30 days. Abuse-protection counters (one-way hashes of your ID and IP address) are kept for a few days |
| Nash questions and answers | Not stored by us, unless you switch on Help improve Nash: then up to 90 days, deleted automatically. Anthropic deletes API inputs and outputs within 30 days (longer, up to two years, only if flagged as a usage-policy violation) |
| Nash fair-use counter and per-answer technical records (no text) | Counter: up to 40 days after your last question. Per-answer record: 30 days |
| Record of your Nash agreement (AI notice, 18+ confirmation) and Nash settings | Until you withdraw it or delete your data |
| Reported Nash answers (Report this answer) | 12 months |
| Bug reports, e-mail address and screenshots | Up to 12 months after the related GitHub issue is closed, and at most 24 months after you sent the report (3 months if no issue was created), or until you ask us to delete them |
| Sanitised GitHub issue | As long as needed for development; deleted (or, if GitHub does not allow that, blanked and closed) when you use Delete my data or ask us |
| E-mails to support | Up to 24 months after the last message |
| Deletion marker after Delete my data (one-way hash of the deleted ID and the Support ID) | 35 days |
| Data from earlier versions | See 2.14 |
9. Your rights
Depending on where you live you may have the right to access your data, have it corrected or deleted, restrict or object to processing, receive a copy in a portable format and withdraw consent. You can also complain to your data-protection authority; in Norway this is the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).
Use the in-App controls where possible (Settings > Data and privacy lets you export a copy of the data stored on your device, Export my data, and delete your data, Delete my data). Otherwise e-mail support@pekasoftware.com. Because the App has no accounts, we can only find data that is linked to your anonymous ID. We may therefore ask you for the Support ID shown in Settings > Data and privacy (or the User ID shown on the Profile page of version 1.x). We answer within one month.
10. Children
The App is a poker-strategy training tool for general audiences and has a low content rating, but it is not directed at children under 13 and it contains no advertising, social features or user-to-user messaging. We do not knowingly collect personal data from children under 13. Where consent is needed and you are below the age of digital consent in your country (13 in Norway, up to 16 in some EU countries), please ask a parent or guardian to agree. Free-text questions to Nash are only for people who confirm they are 18 or older. If you believe a child has given us personal data, contact us and we will delete it.
11. Security
We use encrypted connections (TLS), anonymous authentication, App Check, access rules that only allow each device to reach its own records, rate limits and least-privilege access for our team. No system is completely secure.
12. Region notes
12.1 EEA, United Kingdom and Switzerland
The legal bases are in section 4 and your rights in section 9. Analytics and crash reporting are consent-based as described in 2.5, 2.6 and 5.
12.2 South Korea (Personal Information Protection Act)
| Item | Details |
|---|---|
| Personal information processed | Anonymous user ID, installation ID, device and app information, usage events, purchase records, crash data, approximate region; the questions you ask Nash and the hand shown (only when you use Ask Nash); optionally e-mail address and screenshots you send in a report |
| Purposes | As described in section 2 |
| Retention and destruction | As described in section 8. When a retention period ends or you delete your data, we delete the data from our systems and ask our providers to delete theirs, so that it cannot be restored. |
| Entrusted processing and overseas transfer | Google LLC (Firebase, Google Cloud, Google Analytics), RevenueCat, Inc., Anthropic PBC and GitHub, Inc. in the United States. Items and purposes for each recipient: see the table in section 6 and section 2. Time and method: when you use the feature, over encrypted networks. Retention: as in section 8. Contact of each recipient: see its privacy policy (Google, RevenueCat, Anthropic, GitHub). You can request a copy of the safeguards. |
| Right to refuse | You can refuse analytics, Nash and bug reports; the rest of the App keeps working. Without the purchase records kept by RevenueCat the App cannot validate or restore your purchases. |
| Your rights and how to use them | You may ask for access, correction, deletion, suspension of processing and withdrawal of consent at any time, in the App (Settings > Data and privacy) or by e-mail to the privacy contact below. For requests from Korea we tell you the result within 10 days of receiving the request (or why we could not act on it). |
| Privacy contact (person in charge of privacy) | Petter Karstad, support@pekasoftware.com |
| Remedies | You can also contact the Personal Information Infringement Report Center of KISA (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office (spo.go.kr, 1301) or the National Police Agency (ecrm.police.go.kr, 182). |
The App is not directed at children under 14 and does not knowingly collect personal information from them.
12.3 United States and other regions
We do not sell personal information and do not share it for cross-context behavioural advertising. Residents of some US states and other regions have rights to know, delete and correct; use the contact in section 14.
13. Changes to this policy
We update this policy when the App, our providers or the law change. The date at the top shows the current version. For material changes we will inform you in the App or by another suitable means, and ask for consent again where the law requires it.
14. Contact and complaints
Peka Software AS, Fredrik Meltzers gate 13B, 5007 Bergen, Norway · support@pekasoftware.com.
See also: Terms of Use · Delete my data · Support.