Privacy policy
Last updated 18 October 2026
GTO Reps is a poker training app. This page says what we collect when you use it, why, who else handles it, and how to get a copy or have it deleted.
Without an account
You can drill without signing up. Your answers, settings and session history then stay in your browser’s storage on your device and are not sent to us. The exceptions are error reports, feedback you choose to send, and visit statistics, all described below, which are sent whether or not you are signed in.
What we collect when you have an account
Email address
To sign you in, and to send the emails an account needs: confirming sign-up, resetting a password, confirming a new address.
Kept until you delete your account
Password
To sign you in. It is stored only as a one-way hash, so nobody, including us, can read it.
Kept until you delete your account
Drill answers
For each answer: the spot, your hand, the action you chose, how it was graded and when. They keep your progress the same on every device and decide when a hand comes back for review.
Kept until you reset them or delete your account
Practice sessions
When you drilled, how many hands, how they went, and a device name such as “iPhone Safari”, so your history can show which device a session was on.
Kept until you reset them or delete your account
Settings
Your trainer settings, so they follow you to your other devices.
Kept until you delete your account
Progress resets
A note of each reset you make, so a reset on one device also applies on the others.
Kept until you delete your account
Error reports
When the app hits an error: the error message, where in the app it happened, the app version, and your browser and operating system. We use them to find and fix bugs. They are linked to your account if you are signed in.
Kept for 30 days
Connection logs
Our providers record requests to their servers, including your IP address, for security and to keep the service running. We do not use them to track you.
Kept for a few days, as set by each provider
Feedback you send
When you send feedback from the app, we receive your message, the screenshot if you add one, and the email address you give for a reply; if you are signed in, your account’s address is used instead. The message also carries the page you were on, the game, your screen size, the app version and your browser. We use it to answer you and to improve the app. So that one sender cannot flood the form, we also keep a one-way hash of your IP address with it for a day, then erase it. The message is stored in our database, linked to your account if you are signed in, and emailed to our support inbox. It is kept for 12 months, or until you delete your account if that comes sooner.
Visit statistics
We count visits with Cloudflare Web Analytics, whether or not you have an account. A small script reports which page was opened, the site that linked to it, how fast it loaded, the kind of browser and device, and the country. It sets no cookies, stores nothing on your device, and does not follow you from one visit to the next or to other sites. We see totals only, and they are not linked to your account.
We also run our own visit counter, hosted on Cloudflare. It records which pages are opened, the site or campaign link that brought you, which buttons and links are tapped (their label and the address they lead to, never anything you type), how long a page stays open, your screen size and language, the kind of browser and device, and your approximate location (country, region and city, worked out from the connection). Your IP address is used only to make a code that changes every day and cannot be turned back into the address; the address itself is not stored. Like the counter above, it sets no cookies, stores nothing on your device, cannot recognise you on another day, and is not linked to your account.
We also count hands played. Each time you answer a hand, the app adds one to a daily total kept for each game, noting only whether it was the drill or the sample hand on the home page, and whether someone was signed in. The total holds nothing that identifies you or your device, and the app keeps nothing on your device for it.
Why we are allowed to
Your account data and training history are processed to provide the service you signed up for (GDPR Article 6(1)(b)). Error reports, feedback you send, connection logs and visit statistics are processed in our legitimate interest in keeping the app working and secure, improving it, and knowing how it is used (Article 6(1)(f)). You can object to that processing by writing to us.
On your device
The app keeps your progress, settings and sign-in session in your browser’s local storage, and caches its own files so it works offline. This is needed for the app to work at all, so it does not ask for consent. There are no advertising or tracking cookies, the visit statistics above keep nothing on your device, and nothing is shared with advertisers. The cookie policy lists each item.
Who else handles your data
These providers process data on our behalf, under contracts that bind them to our instructions:
- Supabase runs our database and sign-in. Your data is stored in the EU (Paris).
- Resend delivers the emails an account needs, such as confirming sign-up or resetting a password, and passes the feedback you send to our support inbox. It receives your email address and the text of those emails.
- Google hosts our support inbox (Gmail), where your emails to us and the feedback you send arrive.
- Cloudflare serves the app to your browser from its global network, counts visits for us, and hosts our own visit counter, as described above.
Some of these providers are based in the United States or may process data there. Those transfers are covered by the EU-US Data Privacy Framework or by the European Commission’s standard contractual clauses. We do not sell your data.
Your rights
Most of these are buttons in Settings, under Your account:
- Get a copy of everything stored about your account, as a file you can keep or take elsewhere: Download my data.
- Correct your email address: Change email.
- Delete your account and everything linked to it, immediately: Delete account.
You can also ask us to restrict or stop processing your data, or object to it, by writing to support@gtoreps.com. We answer within a month. If you think we have handled your data wrongly, you can complain to the data protection authority in the EU country where you live or work.
Deleting your account removes it from our database at once. Copies can remain in our database provider’s backups until those backups expire.
Security
Everything travels over encrypted connections. Each account can read and change only its own rows in the database, and passwords are never stored in readable form.
Age
The app is about poker, so it is meant for adults: you must be 18 or over to create an account.
Changes
If we change this policy, the date at the top changes.
Contact
Write to support@gtoreps.com about anything on this page.