Privacy, in plain words.

Analytics

Page views are counted with GoatCounter, a privacy-focused analytics service. It does not set cookies. For each page you open, your browser sends GoatCounter the page path (never the rest of the address) and title, the site that linked you here and your screen size. Like any web request, that also carries your IP address and browser details. Two extra GoatCounter events count when a visitor starts the free sample of the Trainer and when that sample runs out. What we look at are totals, such as how many people viewed a page and where they came from, not a record of any one visitor. GoatCounter’s own documentation explains what it keeps.

We also count a handful of steps through the site ourselves, to see where people drop off: landing on the site, answering the sample puzzle on the home page, starting and finishing the Daily, and opening checkout. Each event records only its name, the page path (never the rest of the address) and at most one small detail: whether the sample answer was right, or your Daily score out of five. These events carry no cookie, no account or anonymous ID, no IP address, no browser details and no referrer, and our server rejects anything beyond those fields. The start of a free trial is counted the same anonymous way, on our server, when Stripe confirms it.

If your browser sends a Do Not Track or Global Privacy Control signal, none of this happens: the GoatCounter script is never loaded, so your browser doesn’t contact GoatCounter at all, and the first-party events above are not sent either.

Cookies

The site sets two cookies of its own. Both are first-party, sent only over a secure connection, and marked so that scripts on the page cannot read them. There are no advertising or tracking cookies.

• pp_anon: a random ID that lets you play without an account, keeping your rating, Daily results, streak, race results and display name together. It is set the first time your browser talks to our server and lasts one year.
• pp_session: set only when you sign in. It holds a random token that keeps you signed in, and we store only a scrambled (hashed) copy of it. It lasts 30 days, or until you sign out.

Your browser’s local storage also holds a few settings and conveniences on your device, such as puzzle filters, which lessons you’ve read and whether you’ve seen an intro. Clearing this site’s data in your browser removes them.

Signing in

Signing in is optional. You can use GitHub or Google, and we ask each for your basic profile and email address. From that we keep your email address (and whether the provider has verified it), your name or username, a link to your profile picture and the provider’s ID for your account. We never see your GitHub or Google password.

Each sign-in also stores a session record: when it started, when it expires and your browser’s user-agent string. When you first sign in, the ratings, Daily results, streak and display name from your anonymous play move onto your account.

Payments

Subscriptions are handled by Stripe. You pay on Stripe’s own checkout page, so your card details go to Stripe and never reach us. When you start checkout we create a Stripe customer with your account email (if we have one) and your account ID.

On our side we keep only what’s needed to unlock the Trainer: your Stripe customer and subscription IDs, the subscription status, the trial end and renewal dates, and whether it is set to cancel.

What we store about your play

Whether you’re signed in or playing anonymously, our database keeps the following, linked to your account or to your anonymous ID:

• your rating in each puzzle category;
• each Trainer puzzle you answer: which puzzle, whether you got it right, your rating at the time and when, so you don’t see repeats and can review your mistakes;
• your Daily results: your answer to each puzzle, whether it was right and the score;
• your solve streak: current, best, the last day you solved and any streak freeze;
• your race results: display name, score, best combo, correct answers and attempts;
• the display name you choose for races;
• any puzzle feedback you send: a thumbs up or down and your comment, with the puzzle it was about.

Race results and the leaderboard are public. They show your race display name (or “Anonymous” if you haven’t chosen one) and your score, never your email address.

Hosting

The site runs on Cloudflare, so every request passes through Cloudflare’s network, which sees your IP address as any web host would. We use it, through Cloudflare’s rate limiter, to stop any single address flooding the site. We don’t write it to our database.

How long we keep it

• A sign-in session lasts 30 days. Signing out deletes it straight away, and a daily clean-up deletes sessions that have expired.
• The pp_anon cookie lasts one year.
• The count of free Trainer sample puzzles you’ve used expires 30 days after you last used one.
• The short-lived record of a sign-in in progress expires after 10 minutes.
• A live race room is cleared 10 minutes after the race ends. Its results are saved as described above.

Your account and play data are kept until you delete them, which you can do yourself when signed in: open your profile and choose “Delete my account”. That removes your account, every sign-in session, your ratings, Daily results, streak, Trainer history, race name and any feedback you sent, then signs you out. Your past race results stay, because other players’ results include them, but they show as “Anonymous”. If you have a subscription that is still running, cancel it in the billing portal first.

Some of that (your Trainer history, race name and race results, and anything you played while signed out) is tied to your browser’s anonymous ID rather than to your account, so deleting covers what the browser you delete from holds. To have another browser’s removed, email us. Stripe and GoatCounter keep their own records under their own policies.

Contact

Questions about any of this, or want your data removed? Email feedback@pokerchallenges.com. A real person reads every message.