Deep Stack by TK logo Deep Stack by TK
Legal

Privacy Policy

Effective: November 10, 2026 · Applies to www.dstk.net and app.dstk.net

In plain English

You give us an email address (or sign in with Google) and we store the poker hands, notes, quizzes and comments you create. If you sign in with Google, we receive only your Google name, email address and profile picture — nothing else from your Google account, and we never see your Google password. We use Supabase to store data and Vercel to serve the app. We do not sell your personal information, we do not share it with advertisers, and we do not run advertising tracking today. When we add advertising, this policy and the cookie notice on the site will say so first.

1. Who we are

Deep Stack by TK (“DSTK”, “we” and “us”) is the operator of the marketing site at www.dstk.net and of the poker hand recording, replay, quiz, club and broadcast application at app.dstk.net (together, the “Service”). This policy explains what personal information we collect through the Service, why, how it is used and protected, and the rights you have. For questions, requests or complaints, contact us at info@dstk.net.

2. Information we collect

  • Account information. The Service offers two sign-in methods: (a) a passwordless email link — we receive and store your email address, and never collect passwords for this method; or (b) Google Sign-In, described in section 3 below.
  • Content you create. Poker hands and drafts you record or import, coaching notes, quiz questions and answers, comments, club posts, your display name, profile settings, club memberships and friend connections.
  • Imported hand histories. When you paste or upload a hand-history file (PokerStars, GGPoker, ACR/Winning Poker Network, 888poker/WSOP.com formats), the file is parsed in your browser to extract the hand data. The original file itself is not uploaded to or stored on our servers; only the structured hand is saved to your account.
  • Feedback and beta emails. If you use the feedback form or join the beta list, we receive the email address, the self-described poker role you optionally pick, and the content of your message.
  • Technical data. Like nearly every website, our hosting provider (Vercel) processes request logs that include IP addresses and user agents for security and availability.
  • AI chat (if you use it). If you send text to an AI-assisted chat feature, the text you submit is sent to the AI provider that powers the response. If you configure the feature with your own Google Gemini API key, that request is made to Google under your key and is governed by Google's terms and privacy policy.

3. Google user data (Google Sign-In)

When you choose “Sign in with Google”, the Service requests only the default Google OAuth scopes openid, email and profile. Through these scopes we receive exactly three pieces of your Google account information:

  • your email address (to identify your account and send service emails),
  • your name (used as the default display name for your in-app profile), and
  • your profile picture (shown as your in-app avatar).

We do not request access to any other Google service or data: no Gmail, no Google Drive, no Calendar, no Contacts, no photos, no location, and no access to your Google password (Google handles the authentication; we never see it).

How this Google data is used

  • To create and authenticate your Service account and keep you signed in (session tokens issued by Supabase Auth).
  • To display your name and avatar on your profile, hands, comments and club activities.
  • To contact you about service and security matters.

Your Google user data is stored by Supabase, Inc. (our authentication provider) on our behalf, protected by the security measures in section 10. We do not sell it, rent it, share it with advertisers or data brokers, use it for targeted or interest-based advertising, or use it to train AI models. We do not transfer it to any third party except the processors listed in section 6, and we do not allow humans to read it except to the extent needed to fix a problem you report, comply with law, or keep the Service secure.

Retention: we keep your Google-derived name, email address and profile picture for as long as your account exists, and delete them when your account is deleted (section 7). You can revoke the Service's access to your Google account at any time through Google's security page at myaccount.google.com/permissions; revoking access does not delete your account — you can still sign in with an email link.

The Service's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use information

  • To provide the Service: store and sync your hands, quizzes, notes, clubs and friends across your devices.
  • To share content exactly as you choose: private, friends-only, club, or public by link.
  • To run the beta program and answer feedback.
  • To keep the Service secure, prevent abuse and comply with law.

We do not sell your personal information, and we do not use it for cross-context behavioral advertising. See section 8 for what changes if advertising is added.

5. Cookies and local storage

We use browser storage (cookies and/or local storage) only to keep you signed in and remember your preferences. We do not use analytics or advertising cookies today. If we ever serve third-party ads, visitors in the EEA and UK will be shown a consent notice and asked before any non-essential cookie is set, and this section will be updated first.

6. Who we share data with (processors)

  • Supabase, Inc. — database, authentication (including Google Sign-In session tokens and the Google-derived name, email and picture) and file storage. Your account and content live in Supabase (hosted on AWS in the United States). Database row-level security rules restrict who can read what.
  • Vercel, Inc. — hosting and content delivery, including request logs.
  • Google LLC — Google Sign-In (if you use it) and Google's Gemini API (only if you supply your own API key for AI features).
  • Email delivery providers — sign-in emails and beta welcome emails.

We may also disclose information when required by law or to protect rights and safety. DSTK is not affiliated with any poker operator or card room; we never share your data with them.

7. Data retention and deletion

You can delete individual hands, quizzes and comments yourself inside the app at any time; those deletions are permanent and immediate.

Deleting your account. Email info@dstk.net from your account's email address with the subject “Delete my account”. We verify the request, then delete within 30 days: your profile (nickname, avatar), all hands, drafts, notes, quizzes, quiz attempts, comments, club memberships and friend connections. Deleting your account does not automatically revoke the app's access on your Google account — you can also do that at myaccount.google.com/permissions. We keep no account data after deletion except backups (which expire on the backup schedule) and the minimum records we must retain for legal, tax or security reasons.

8. Advertising and your opt-out rights

We do not sell personal information or “share” it for cross-context behavioral advertising as those terms are used in California privacy law. If we add advertising, ad networks may use cookies or device identifiers to personalize ads, which may constitute “sharing”; before that happens we will update this policy, add a consent notice for EEA/UK visitors, and provide a “Do Not Sell or Share My Personal Information” link in the site footer.

9. Your rights

United States. Depending on your state (including California under the CCPA/CPRA), you may have the right to know what personal information we collect, access and delete it, correct it, take a portable copy, opt out of sale or sharing, and be free from discrimination for exercising these rights. You may use an authorized agent where state law allows.

EEA, UK and Switzerland. Under the GDPR/UK GDPR you may have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interests, to withdraw consent where processing is based on consent, and to lodge a complaint with your supervisory authority.

To exercise any right, email info@dstk.net. We verify requests by matching the account email. We respond within the timelines required by the applicable law.

10. Children

The Service is not directed at children. You must be at least 18 years old to hold an account. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA/UK). If you believe a child has given us personal information, contact us and we will delete it.

11. Security and international transfers

Data is transmitted over TLS and protected by database access rules (row-level security). No method of transmission or storage is perfectly secure. We are based in the United States and our processors (Supabase, Vercel) operate there, so your information will be processed in the US. Where required, transfers from the EEA/UK are covered by the processors' standard contractual clauses.

12. Changes to this policy

We will post any changes on this page with a new effective date. If a change materially affects how we use data you have already given us, we will notify you in the app or by email before it takes effect.