PokerToast · study tools for mixed-game poker

PokerToast Privacy Policy

Effective date: October 17, 2026

Latest change (October 17, 2026): your ghost, a bot that plays like you that friends can play from a link (section "Coach plan" below); notes from the (i) bubbles, hands you share as a puzzle, the tour's sample guest, and two browser-storage items.

PokerToast (pokertoast.com) is a study tool for mixed-game poker players: a hand calculator, practice tables against bots, solver advice, hand reviews and daily puzzles. There is no real-money play. This policy explains, in plain words, what information we collect, why, who else handles it, how long we keep it, and what you can ask us to do with it.

1. Who we are

PokerToast is run by its owner, a sole proprietor in Wisconsin, United States, doing business as PokerToast (PokerToast is not a company), PO Box 772, Cumberland, WI 54829. In this policy "we" and "us" means the owner of PokerToast. For EU and UK data protection law, the owner is the "controller" of your personal data. The owner's full legal name is given on request: ask through the contact form or by email.

Contact for anything in this policy: use the contact form at https://www.pokertoast.com/contact (or email contact@pokertoast.com).

2. What we collect and why

When you create an account

• Email address. Your login name, and where we send your sign-up and password-reset links and, if you subscribe, the emails about your subscription (a confirmation of the plan, price and how to cancel; reminders before a yearly renewal, once a year on monthly plans, and before the Founding discount ends). We do not send marketing email.
• Username you choose. Other players can see it (see section 4).
• Password, stored only as a one-way hash (bcrypt). We can't see your password.
• Login records: the time of each login and a random session token. A login lasts at most 30 days.
• Your agreement to the Terms: the time you ticked "I agree to the Terms of Service and Privacy Policy" (at sign-up and, if you subscribe, on the payment page) and which version of the Terms it was. No birth date is collected: the "18 or older" tick is not stored, only that the account was created with it.

If someone types your email address into the sign-up form, an unused account record is created and a link is sent to that address. Nothing happens unless the link is used. If you got such an email by mistake, ignore it or ask us to delete the record.

If you use "Continue with Google"

• Google sends us your Google account's email address, whether Google has confirmed that address, your Google account number (an ID Google gives each account). We don't ask Google for your name or picture.
• We use them only to log you in: to find your PokerToast account by that email, link it to your Google account, or create a new account. We keep only the Google account number, with your account; your email is stored as your account email, as for any account.
• We never get your Google password, contacts, emails or files, or any other Google data, and we don't keep Google's sign-in tokens. Google knows that you signed in to PokerToast; Google's own privacy policy covers that.
• To unlink Google from your account, ask us (section 9) and we delete the Google account number (if your account has no password yet, set one first with "Forgot password" so you can still log in). Deleting your account also deletes it.

If you choose to add them

• A profile picture. It is resized in your browser before upload, which removes hidden photo details such as location. If you take a photo or choose a picture for your avatar, your camera is used only when you tap Take a photo; the picture is cropped and its background removed on your own device, and only the finished avatar is uploaded: your original photo is never sent to us or to anyone else. Profile pictures are stored as public image files with random names: someone who has the link could view yours.
• Your country and (in the US) state, if you add yourself to the player map. Only totals per country or state are shown to others.
• How you found PokerToast. If you tell us how you found PokerToast, we keep your answer with your account to learn which ways of finding us work; it is deleted with your account.

When you use the tools

• Hands you play in the Bot Lab: the cards, the actions, the results, and the game settings. We use them to show you your hand history, solver reviews, your skill score and your playing-style profile. We also use hands and choices made on the site, without your name or email, to improve our bots, solvers and lessons and to publish overall statistics (for example "players fold too often on 4th street"). We never sell them.
• Bot Lab sessions (when you're logged in): the name you give each session, its game, how many hands you played and your result, and where the table stood (stacks, the bots and their styles) so you can resume it, plus your setting for keeping your hand history. You can rename or delete a session at any time; deleting it also deletes its hands unless you choose to keep them.
• A hand you share as a puzzle (the Leak Report's "Make a share link"): we keep that one decision's spot (the cards you could see, the betting so far, the options and the solver's numbers) with your account, and anyone with the link can see it, without your name; the solver's answer stays folded until a visitor taps it. It is deleted with your account; to remove one sooner, ask us (section 9).
• Daily Spot answers (when you're logged in): your answer, whether the solver agrees, and how much it cost. These count for your streak and the public leaderboard.
• Saved lists and settings you create in the calculator.
• Survey answers and suggestions you choose to send (the player survey and the "Suggest an improvement" box) are kept with the date, the page, your email only if you type it, and your user number when the page can tell you're logged in, to decide what to build and what to charge; your IP address is only counted in memory for an hour to stop spam, never stored with them, and they are deleted with your account or when you ask. If you send the survey, you get a thank-you code: we keep only a scrambled (hashed) copy of it, linked to your answers, and, once you use it, to your account.
• Notes from the (i) bubbles. A small (i) next to a button explains the feature and lets you send us a short note ("Tell us what you think"). If you send one, we keep what you wrote (up to 1,000 characters), which page and which (i) it came from, and the time. Your email address is optional; if you give it, we use it only to reply about that note, never for marketing. We don't attach your account, your internet address or a cookie to a note (your internet address is only counted in memory for an hour to stop spam). Please don't put private information in a note. We use notes to fix problems and improve the site, and we may describe a change we made because of notes without naming anyone. Because notes aren't linked to your account, deleting your account doesn't delete them: to have a note deleted, use the contact form and tell us roughly what you wrote and when.
• The one-time question "How would you feel if you could no longer use PokerToast?" (logged-in players, asked at most once, always optional). If you answer, we keep your answer, the short text you add if any, your plan at the time, a rough band for how long you've had your account (for example "30 to 60 days") and the day, stored apart from your account: no name, email or user number. With few players these details could still point to you, and so could anything you type in the text box, so please leave personal details out of it. On your account we keep only a note that the question was shown, answered or turned off, so we don't ask again; that note is deleted with your account. We use the answers only to decide what to build.
• If you play the Daily Spot without logging in, your browser keeps a random code so you can't answer twice; your answer is kept only in our server's memory, for a day or two.

When you contact us

• Messages you send us with the contact form or by email: your email address (so we can reply), your name if you give it, the topic, your message and the date, your user number when the page can tell you're logged in, and a scrambled (hashed) form of your IP address that can't be turned back into the address, used only to spot repeated spam. We use them only to answer you and to fix or improve what you tell us about. Messages sent with the form are also emailed to our inbox.

When you subscribe (see also the Terms of Service)

• Payments are handled by Stripe. You type your card and billing details (including your billing address, which Stripe also uses to work out sales tax) into Stripe's page, not ours; we never see or store card numbers.
• Stripe tells us your plan, monthly or yearly, status, renewal date, whether you've cancelled, and whether you have the founding-member price. We store those, plus Stripe's reference numbers for you and your subscription.

Coach plan

• If a coach invites you, we store the invite (what the coach typed: your email or username) and, once you accept, the link between you. While you are in a coach's group, that coach can see your username, your saved Bot Lab hands, their reviews and your skill summary. You can leave a coach at any time; the coach then loses that access.
• Coach Ghost programme (once we open it; we'll announce it): if you join through a coach's link, that coach sees your username and whether you subscribed, never your email, card details or what you paid. If your coach shares their ghost with students, you see its link; when you play it you play as a guest, and your coach is not told it was you (unless you type your name before playing, which the ghost's owner sees, as with any friend).
• Your ghost (a bot that plays like you; this part applies once the feature is switched on): if you make one, we build it on our server from your own saved Bot Lab decisions (a "style bot" you set up yourself is built only from the two choices you make: how tight and how aggressive), and the bot itself never leaves our server. Anyone with its link can play it as a guest, without an account. They see who won and their own play compared with the solver, never your statistics, style or mistakes. For each game played against it we keep the name the player typed (if any), the hands of that game and its result; you see that name, the result and their play compared with the solver. Deleting your ghost, or your account, stops the link and deletes the ghost and those games.

Gifts and referrals (this part applies once gift subscriptions, referrals and "bring a friend" are offered; we'll announce them)

• When you buy a gift: the plan and length, the To and From names and the message you type (shown on the card and in the gift emails), the recipient's email address and delivery day if you want the gift emailed, and your email address (your account's, or, if you buy without an account, the one you type on Stripe's payment page). From Stripe we also keep the payment's reference numbers, a fingerprint of the paying card (Stripe's identifier for the card, not its number), your Stripe customer reference and Stripe's fraud-risk rating of the payment, to stop misuse of gift emails and of invite rewards.
• If someone sends you a gift by email: we use your address only to send that one email, on the day the buyer chose. We don't add it to any list and won't email you again unless you redeem the gift. You can ask us at contact@pokertoast.com to delete your address, or never to email it again (for that we keep only a scrambled (hashed) copy of it).
• When you redeem a gift: which account redeemed it, when, and the dates the gift runs.
• Invite links (referrals and "bring a friend"): your invite code; for each player who joins through it, who invited whom and when, a scrambled (keyed hash) copy of the internet address the link was used from (never the address itself), and, once they pay, their payment's reference numbers and card fingerprint, to check the rules in the Terms (for example, not yourself and not the same card). Whoever invited you never sees your email or payment details.
• Gift emails are sent through Resend (section 5).

Technical and security information

• IP address. We use it to stop abuse: to limit password guessing, password-email floods and heavy automated use of the free tools. For logins and password emails we keep the address (and the email typed) for about a day (they are cleared out regularly, so occasionally a little longer). For the other limits it is kept in memory only, for up to a day. Our web server's access log also records each visit's IP address, time, page, browser type and referring page; we keep it for 14 days to fix problems and investigate abuse. Once a day we also use that log to count, in total only, how many visits each page gets, where visits came from (for example a search engine, an AI assistant or a forum) and which pages and tools visitors use next. For this count your IP address is only scrambled in our server's memory, with a key that is thrown away after each count. We keep only the daily totals: they contain no IP address, browser details or anything else about a single visitor, and are not linked to any account.
• Error logs that help us fix bugs.

Guest play. "Play now" (or the Guest button) makes a guest account for your device only: no email or password. Your browser keeps a random key (local storage) that lets it back into that guest; we keep only a scrambled (hashed) copy of the key, the guest's hands and activity, when it was last used, and your internet address for about a day to limit how many guests one connection can start. Nobody else can see a guest's hands. A guest not used for 30 days is deleted with everything in it. To keep your hands, press "Save my progress" and add your email address: when you choose a password from the emailed link, the guest becomes your free account. The 2-minute tour makes a separate sample guest just for the tour (with the same tick box as Play now): nothing done in it counts in the Daily Spot, streaks or our player numbers, it can't be saved to an account, and it is deleted after one day without use, with everything in it.

We do not collect: your real name (unless you give it to Stripe for billing, or type it as a To / From name on a gift card), phone number, precise location, contacts, or any information from social networks (with "Continue with Google", only what is listed above).

3. Our reasons (legal bases)

For visitors in the EU, UK and similar places, we rely on:

• Contract: to run your account, your subscription, the tools you use and the coach features you choose.
• Legitimate interests: to keep the site secure and stop abuse (IP limits, logs), to fix bugs, and to improve the tools. We keep this use small and don't use it to profile you for advertising.
• Legal obligation: to keep payment and tax records.
• Consent: for optional things like your profile picture and the player map, which you can remove at any time.

4. What other people can see

• Your username appears on public lists (such as the Daily Spot leaderboard) only if you switch on "Show my name on public lists" in your profile; until then you are shown as "A player". You can switch it off at any time. Coaches see the username of students in their group (see section 2). Your email is never shown.
• Your profile picture, if you upload one (see section 2).
• A hand you share as a puzzle from the Leak Report: anyone with the link sees that one spot, never your name.
• Coaches see what's described in section 2 for students in their group.
• Gifts (once offered): the person you give a gift to sees the To / From names and the message you typed. If you invite friends, you see only how many joined and whether a reward was given, not who they are.

5. Who else handles your data (service providers)

We use these companies to run PokerToast. They may only use your data to provide their service to us (Stripe also uses it, as its own controller, to prevent fraud and meet its legal duties):

We do not sell your personal information, and we do not share it for targeted advertising.

6. Cookies and browser storage

We use a small number of cookies, all needed for the site to work:

• Login cookie (pt_session): keeps you logged in, also when you reload the page. Your browser's scripts can't read it; it holds your user number and a random token, lasts at most 30 days, and is cleared when you log out.
• Google sign-in cookie (PTGOOGLE): only while you use "Continue with Google". It ties Google's answer to your browser (random codes only) and is deleted when the sign-in finishes or you close the browser.
• Staff cookies (isAdmin, adminUrl): only for the site's own admin account; 1 day.
• Your browser's local storage keeps your preferences (hint and display settings, a calculator draft, whether you've seen the tour and whether its narration is muted, your Start-here list progress, the Daily Spot code and history, and the private guest key). It stays on your device; only the Daily Spot code and the private guest key are sent to us.

We use no analytics or tracking cookies. Because we only use necessary cookies, there's no cookie banner.

7. How long we keep it

8. Security

Passwords are hashed with bcrypt. The site uses HTTPS. Logins and password emails are rate-limited. The database is not reachable from the internet. Backups are encrypted with a key that is not stored on the server. Only the owner (and the tools he authorises) can reach the server. No system is perfect; if a breach affects your data, we will tell you and the authorities as the law requires.

9. Your choices and rights

Whoever and wherever you are, you can ask us to:

• see the personal data we hold about you and get a copy (in a common format such as JSON or CSV);
• correct it (you can change your username, picture and country yourself);
• delete your account and its data (we keep only what the law makes us keep, such as payment records, and a record that a founding-member place was used, so the 100 places count correctly);
• unlink Google sign-in from your account (we delete the Google account number);
• stop a use based on legitimate interests or withdraw consent (for example, remove your picture).

Use the contact form at https://www.pokertoast.com/contact (choose "Privacy request") or email contact@pokertoast.com, from the address on your account. We usually reply within 3 business days, and always within 30 days, and may ask you to confirm the request from that address. There is no charge. Deleting your account does not cancel a Stripe subscription by itself: cancel it first in "Manage subscription" (we'll remind you). If you have no account (for example you received a gift by email, or bought one without an account), write from the address concerned. Deleting an account that bought a gift nobody has redeemed yet keeps only the one waiting gift email to its recipient (without your names or message) until it is sent, so the gift still arrives.

EU / UK: these are your GDPR rights (access, rectification, erasure, restriction, portability, objection). You can also complain to your local data protection authority.

California (CCPA/CPRA) and other US states with privacy laws: you have the right to know, access, correct and delete your personal information, and not to be treated differently for using these rights. We do not sell personal information or use it for cross-context behavioural advertising. We don't use sensitive personal information except your password (to log you in). An authorised agent may make a request for you with your written permission. Categories we collected in the last 12 months: identifiers (email, username, IP address, the Google account number if you use "Continue with Google"; once gifts are offered, the names and email addresses a gift buyer types), commercial information (subscription plan and status; gifts and referral rewards once offered), internet activity (use of our tools, server logs), and, if you add it, your picture and country/state.

10. Children

PokerToast is for adults: you must be 18 or older to use it. We don't knowingly collect data from anyone under 18. If you believe a child has created an account, email us and we will delete it.

11. International transfers

Our server and service providers are mainly in the United States. If you use PokerToast from outside the US, your data is transferred there. Where EU/UK law requires it, we rely on our providers' Standard Contractual Clauses or their EU-US Data Privacy Framework certification.

12. Changes to this policy

If we change this policy, we'll update the date at the top. If the change is significant (for example, a new kind of data or a new use), we'll tell logged-in players on the site or by email before it takes effect. Earlier versions are available on request.

13. Contact

PokerToast (a sole proprietorship in Wisconsin, United States), PO Box 772, Cumberland, WI 54829. Use the contact form at https://www.pokertoast.com/contact (or email contact@pokertoast.com). The owner's full legal name is given on request: ask through the contact form or by email.

See also: Terms of Service.