Beta Privacy Notice

1. Who is responsible, and how to reach us

The controller of your personal data is MPoker ("we", "us", "our"). MPoker is a pre-release project: the operating entity is in the process of being incorporated, so no legal form, registered address or company registration number applies yet. When incorporation completes we will reissue this notice under a new version identifier naming the entity, its legal form and its registered address.

You can contact us about privacy, about account recovery, and to exercise any of the rights in section 9, at support@mpoker.io. That address is monitored by a person; there is no automated mailbox behind it. The product itself sends email only for account security (section 3):

• a code to an address you have just entered, so that you can confirm it;
• security notices to the address confirmed on your account, or, after you change it, to the previous address;
• if you enter an address that is already confirmed on another account, a one-time warning to that address. The warning tells its reader that the address is already confirmed on an MPoker account and that nothing was changed. The app itself does not tell you whether an address you entered is already in use.

We have not appointed a data protection officer. This is a free, invitation-only beta limited to ten testers, with no large-scale processing and no special-category data.

2. What this notice covers

It covers the MPoker closed beta: the MPoker Android app, the MPoker servers behind it, and the MPoker website at https://mpoker.io. The beta is invitation-only, free of charge, capped at 10 self-registered testers, and uses play money only. There are no deposits, withdrawals, purchases, cash or other prizes, and no conversion of chips or any other in-product value into money or anything else of value.

3. What we collect

We collect very little. Apart from the optional email address described under "Account security data" below, there is no field anywhere in the app, on our servers, or on our website for an email address, a telephone number, a postal address, your real name, your date of birth, your country, or an identity document, and we do not ask for any of them.

Account data

• your chosen username;
• your password, stored only as an Argon2id hash (19 MiB memory cost, time cost 2, parallelism 1), never in readable form; a new password must be at least 12 characters;
• an account identifier we generate;
• your account status and, if an operator disabled, locked or reactivated the account, the reason and time;
• your chosen avatar, selected from a fixed set of images we supply;
• the record that you confirmed the minimum age, and which versions of the Terms and of this notice you accepted, with timestamps.

Sign-in and session data

• a keyed hash of your active sign-in token — never the token itself — with its creation, last-seen and expiry times, and whether and why it was revoked;
• the IP address your device connected from, and the user-agent string and app version it reported, recorded on each session. This is the only place we store an IP address in our own database;
• failed sign-in attempts against your account within a rolling 15 minutes, and any resulting lock.

Account security data (only if you use these optional features)

• an email address you add in Account security. It becomes linked to your account only after you type in an 8-digit code we email to it. A confirmed address belongs to one account only. While a code is pending we keep the address you entered with a keyed hash of the code, never the code itself. A code works once, for 15 minutes, with at most 5 attempts;
• a record of each account email we send: its purpose (for example "verification code" or "password changed"), the time, whether our email provider accepted it, and a keyed digest of the recipient address. It never holds the address itself or the message content. We use it to enforce sending limits;
• if you turn on two-factor sign-in:
  • the secret key your authenticator app shares with us, stored only encrypted (AES-256-GCM);
  • the time step of the last code we accepted, so a code cannot be used twice;
  • your ten recovery codes, each stored only as a keyed hash;
  • short-lived sign-in challenges, stored as keyed hashes;
• failed security checks: wrong current passwords or second-factor codes during a security change, and wrong second-factor codes at sign-in;
• audit records of security changes to your account: email added or changed, password changed, reset or recovered, two-factor sign-in turned on or off, recovery codes replaced or used, and an operator's two-factor reset, with who acted, when and the reason an operator typed in.

Gameplay data, created by our server rather than by you

• completed hands you took part in: hand and table identifiers, table name, time, game variant and stakes, your seat and position, your starting and finishing play-money stack, every action you took, the public board, the pots, who won what, and the rake attributed to you;
• the cards that became public during the hand — the cards you showed at showdown, and the cards revealed when an all-in hand was run out. Cards you folded or mucked without ever revealing them are not written to our database at all;
• your play-money chip movements, your seated sessions at cash tables, top-up and waiting-list entries, and any tournament entries, eliminations, placements and payouts.

Club and community data

• your club memberships and roles, and any alias a club operator sets for you;
• if you create or manage a club: club and table names, descriptions, invitation messages and messages of the day that you write;
• agent and super-agent relationships, and the rakeback and commission figures derived from your play;
• administrative and audit records of actions taken on your account or in your club, including reasons an operator types in.

Chat

• messages you send at a table are held in server memory only. They are truncated to 200 characters, only the last 50 per table are kept, they are discarded after 10 minutes of table inactivity, and they are cleared when the table closes. Table chat is never written to our database.

Data on your own device

• your sign-in session, held encrypted in the Android keystore-backed secure store;
• local app preferences (bet-sizing buttons, card-back colour, table background, animation and display settings) and markers for club messages you have already seen.

This stays on your device. Android backup and device-to-device transfer are switched off for the app, so the operating system does not copy it off your device.

Technical logs

• our servers write operational logs, and our web server writes access logs that contain IP addresses, in the ordinary way. Hole cards, passwords and session tokens are never written to those logs.

We do not collect advertising identifiers, device fingerprints, install identifiers, push tokens, location data, or contacts. The app contains no analytics SDK, no crash-reporting SDK and no advertising SDK. The website sets no cookies, uses no local or session storage, runs no analytics, and loads no third-party scripts or fonts — the fonts it uses are served from mpoker.io itself. The app bundles its own typefaces inside the installed package and fetches no font at runtime.

What you must give us. A username and a password are required to create an account; without them you cannot register or play. An email address and two-factor sign-in are optional. Without an email address you cannot reset a forgotten password yourself, and recovery goes through us (section 1). Everything else in this section is generated by us or produced by your use of the service.

4. Why we process it, and on what legal basis

The bases below are the operator's position for this bounded beta and remain subject to counsel review before any expansion.

"Legitimate interest" means a genuine operational need of ours — keeping accounts secure, keeping the game honest — weighed against your rights before we rely on it. You can object to processing on that basis; see section 9.

We do not use your data for advertising, do not profile you, and do not sell it.

5. How your password, session and second factor are protected

Your password is never stored in readable form. It is hashed with Argon2id, a memory-hard algorithm, and we require at least 12 characters.

When you sign in, the server issues a random token to your device and stores only a keyed hash of it, so the token you hold cannot be read back out of our database. On the phone the token is kept encrypted in the platform secure store and is deleted when you sign out, when the server rejects it, and when the session becomes invalid.

A session ends automatically after 30 days without use and, in any event, 180 days after you signed in. After that you sign in again.

Two-factor sign-in (optional). If you turn it on, signing in also needs a 6-digit code from your authenticator app, or one of your recovery codes. Until that second step succeeds, no session exists. The key your app shares with us is stored only encrypted, under a server key held apart from our database and its backups. Each code can be used once. Each recovery code works once, and we show them only when they are created. If you lose both your app and your recovery codes, an operator can remove two-factor sign-in only after verifying you (section 9). If you have a confirmed address, we also email you a notice. A sending limit (section 12) can hold a notice back; our operators are then alerted.

Emailed codes. Codes we email to you are 8 digits, work once, expire after 15 minutes and allow at most 5 attempts. We store only a keyed hash of each code. A password reset by emailed code signs out every device and never re-enables a disabled account.

6. Who can see what

• Other players see your username, your avatar, your seat, your play-money stack, your actions at the table, any cards of yours that become public, and your chat messages.
• You can see the hands you played in and your own chip transactions.
• Club owners and managers can see their club's hands, members, chip movements and club reports.
• Agents and super-agents can see a restricted, event-time-bounded scope of the hands and figures of the players assigned under them inside the same club.
• Nobody can see cards of yours that never became public; they are not stored.
• Our operators can see account, gameplay, club and audit records in order to run the beta and investigate problems, and can act on an account. Operator actions are recorded.

7. Who else your data reaches

We do not sell your data and we do not share it for anyone else's marketing. Data reaches only:

1. Our hosting provider. The game server, the database and the web server run on infrastructure we rent from Layer7.net, a hosting provider incorporated in Germany, on machines inside the European Economic Area. No transfer of your data outside the EEA is involved in hosting.
2. Mailjet (only once account email is switched on). Account-security emails are sent through Mailjet, a service of Sinch Email (Mailjet SAS, France, part of the Sinch group). Sinch processes these messages for us under its Data Processing Agreement.
   • What it receives: for each message, the recipient address, the subject and the message text. The text is either a one-time code or a security notice; it contains no username and no link.
   • No tracking: open and click tracking are switched off. We never use it for newsletters or marketing.
   • Where: Mailjet states that it stores personal data only in EU data centres, run by Google Cloud in Germany and Belgium.
   • Sinch's own purposes: to fight spam and fraud and to keep its network secure, Sinch also handles message data as an independent controller, under its own privacy notice (https://www.mailjet.com/legal/privacy-policy/). That notice describes, for example:
     • address validation using one-way encrypted addresses, kept for 30 days;
     • records of detected spam or fraud, kept until the matter is resolved.
   • How long Mailjet keeps it:
     • Contacts: Mailjet automatically saves each recipient address as a contact in our Mailjet account. It stays there for as long as the account exists, unless we remove it. We remove your address from Mailjet when you ask (section 9).
     • Statistics: sending statistics are kept for 90 days on our Mailjet plan.
     • If we close the account: Sinch's agreement with us requires it to delete the personal data it processes for us within 90 days, unless we ask for it back or a law or contract requires Sinch to keep it. Sinch's own independent-controller records follow its own notice.
   • Outside the EEA: Sinch's agreement allows transfers to other Sinch group companies and to its sub-processors. For Mailjet, its list includes support and ticketing providers in the United States and the Asia-Pacific region.
     • Its US email company provides Mailjet support. Sinch states that its group companies listed for support see customer data only when the customer shares it in a support request.
     • Sinch makes no such statement for its third-party support tools.
     • Safeguards: EU Standard Contractual Clauses and, for Sinch's US email company, the EU-US Data Privacy Framework.
     • We do not put players' data into support requests to Mailjet.
3. Telegram. Our operational alerting delivers sanitised incident messages to a private operator channel on Telegram. Those messages are stripped of tokens, passwords, cards and raw payloads, never include codes or email addresses, and contain no text you wrote. They can contain internal identifiers such as an account, club or table identifier. Telegram operates outside the EEA. The formal transfer assessment for it is part of the legal review deferred under the beta scope; if that review does not support the transfer, we will switch operator alerting to a channel we host ourselves.
4. Authorities, advisers and successors, where we are legally required to disclose, where we need professional advice, or in connection with a transfer of the business.

Our operational monitoring also involves a second machine that we operate, used only to check whether the service is reachable. It receives a timestamp and a health status and no player data of any kind, so it processes nothing about you.

8. How long we keep it

This is the honest position, and it is deliberately not dressed up:

• Table chat is discarded automatically after 10 minutes of table inactivity, and in any case when the table closes.
• Failed sign-in records fall out of the rolling window after 15 minutes; an account lock lasts 15 minutes.
• Sign-in sessions stop working when they expire or are revoked. Expired session rows, including the IP address recorded on them, are not deleted automatically.
• Account security data. The clean-up below runs as part of later activity on the same feature, so it can take longer while the feature is idle:
  • Emailed codes: the keyed hash of a code is erased when our server records the code as used, replaced, expired or exhausted. An expired code is recorded as expired during later email activity, not at the moment it expires.
  • The address you entered for confirmation stays in that code's record. The record, address included, becomes eligible for deletion more than one day after that recorded end. It is then deleted by the clean-up that runs during later email activity. Each clean-up handles a limited batch, so deletion can take longer.
  • Records of emails sent become eligible for deletion after 40 days and are deleted in batches when later emails are sent.
  • Failed security-check records fall out after 15 minutes. At sign-in, wrong second-factor codes fall out after 24 hours.
  • Two-factor sign-in challenges become eligible for deletion one day after they expire and are deleted during later sign-in activity.
  • Your confirmed email address stays until you replace it, or until we remove it at your request.
  • Your two-factor key and recovery codes are deleted when you turn two-factor sign-in off, or when an operator removes it.
  • Audit records of security changes are kept like other audit records.
• Everything else — your account, your play-money game records, your club records and our audit records — is kept for as long as the beta runs. The platform has no automatic deletion, purge or archiving process, and several audit records are deliberately immutable so that chip integrity can be proved. If you ask us to remove your data we act manually; see section 9.
• Server and web-server access logs are kept according to our hosting configuration.
• We will delete beta data that is no longer needed when the beta ends.

Automated retention and purge are follow-up work. No retention period is stated here, because a stated period would be a commitment the platform cannot yet enforce. Periods will be set and implemented before any expansion, open registration or monetization.

Loss of data. The beta runs on a single server, and there is no off-server backup or point-in-time recovery in place during this bounded beta. If that server is lost, your account and your play-money history are lost with it and cannot be restored. We may also reset play-money data at any time. Do not treat anything in the beta as durable.

9. Your rights

Under the GDPR you can ask us to confirm what we hold and give you a copy (Art. 15), correct inaccurate data (Art. 16), erase data (Art. 17), restrict processing (Art. 18), give you a portable copy of what you provided (Art. 20), and you can object to processing based on our legitimate interests (Art. 21).

What we can honestly do today, which you should know before you register:

• We can disable your account, revoke your sessions and set a new password.
• We can tell you what we hold about you and give you a copy, assembled manually.
• We cannot yet fully erase an account that has played hands. Play records, chip movements and audit entries are linked to your account identifier, and several of those records are technically immutable so that the integrity of the shared game can be proved. We would disable the account and remove what can be removed. An erasure or pseudonymisation routine is follow-up work; this notice states the limitation instead of promising something the platform cannot do.
• If you have a confirmed email address, we may use it to confirm a request is really from you. Otherwise we verify the request through the account itself.
• Removing two-factor sign-in for you. An operator does this only when the evidence together establishes that the request comes from you. Otherwise the operator refuses or escalates. The evidence is:
  • contact on the channel you were invited through;
  • sign-ins with your password at moments the operator chooses, checked on our server;
  • two facts about your account that no other user can see.

  A sign-in seen on the server, or knowing account facts, is never enough on its own. If you have also forgotten your password, the password is first reset (by emailed code, or by an operator after an identity check). A sign-in check then replaces the password step, or, after an operator reset, the operator who invited you must confirm it is you.

  These cases get extra checks:

  • your account has staff or club-management rights;
  • both your password and second factor are being recovered;
  • your account had an unexplained security change in the previous 7 days;
  • fewer than two private facts are available.

  A second operator then confirms the request. While MPoker is run by one person, there is no second operator. Instead, the operator contacts you again on your invitation channel at least 24 hours later. Where the facts or the password check are missing, the operator must also recognise you personally on a voice or video call. If that is not possible, the operator refuses.

  The removal is recorded. If you have a confirmed address, we email you a notice; section 12 explains when a sending limit can hold one back.

• Your email address: you can replace it in the app. Ask us to remove it and we will do so manually, including from our Mailjet contacts.

Write to the address in section 1. We aim to respond within one month.

10. Complaints

If you believe we have handled your data unlawfully you can complain to a data protection supervisory authority — in the EU or EEA, the authority of the country where you live or work, or the authority of the country in which the controller named in section 1 is established.

11. Storage on your device

The website stores nothing on your device beyond your browser's ordinary page cache: no cookies, no local or session storage, no third-party scripts.

The app stores your encrypted sign-in session and your local preferences on your own device. That storage exists so the app can do what you asked it to do; it is not used to track you across sites or services. Android backup and device-to-device transfer are switched off for the app.

12. Automated decisions

We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you, and we do not profile you.

These automated controls act on your account:

• after 10 failed sign-in attempts within 15 minutes your account is locked for 15 minutes. Wrong two-factor codes at sign-in count towards this;
• a two-factor sign-in attempt ends after 5 wrong codes or 5 minutes;
• after 20 wrong two-factor codes in 24 hours, two-factor sign-in is paused for a while;
• after 10 wrong passwords or codes in 15 minutes during security changes, those changes are paused;
• emailed codes and security notices are subject to sending limits. Codes and warnings that other people can trigger have their own limit, so they cannot use up the limit for notices about your own account. Every email also counts towards an overall daily and monthly limit. If a security notice is held back, our operators are alerted;
• abuse controls may temporarily slow or refuse requests.

Every decision to disable, restrict or remove an account is made by a human operator.

13. Children

The beta is not intended for children. You must confirm at registration that you are at least 18. We do not knowingly collect data from anyone younger. If we learn that we have, we will close the account and delete what we can. We do not verify age beyond your confirmation.

14. Security

• passwords are stored only as Argon2id hashes;
• session tokens exist on the server only as keyed hashes, and on your device only in encrypted platform storage;
• the production app talks to our servers over HTTPS and WSS only, with cleartext traffic disabled at the operating-system level;
• the server is authoritative for all game state and validates every action;
• sign-in attempts are rate-limited and repeated failures lock the account temporarily;
• requests and messages are size-limited and rate-limited;
• optional two-factor sign-in: authenticator keys are stored encrypted and each code is accepted once; recovery codes and emailed codes are stored only as keyed hashes;
• account emails are sent without open or click tracking and contain no links;
• operator alerts are stripped of tokens, passwords and cards before they leave the server, and never include emailed or two-factor codes or email addresses;
• chip movements are written transactionally and checked against a conservation invariant.

No system is perfectly secure and this is pre-release software. Use a unique password. If we become aware of a personal-data breach affecting you we will assess it and, where the GDPR requires, notify the supervisory authority within 72 hours and tell you through the same channel we used to invite you. A formal documented breach process is follow-up work.

15. Changes to this notice

Each published version of this notice carries its own permanent version identifier. The identifier of the version you accepted at registration is recorded and is not afterwards altered. If we make a material change during the beta we will ask you to accept the new version, or we will end your access. We will not silently rewrite a version you already accepted.

Version identifier: mpoker-beta-privacy-1.1 Canonical URL: https://mpoker.io/legal/beta-privacy-1.1 Effective: on publication at the canonical URL above. Controller: see section 1.