Privacy Policy
Last updated: 6 September 2026
This policy explains how TwoFifths Design Ltd processes personal data when you play Game Face, a play-money, 18+ live-video Texas Hold’em game. It is written to meet UK GDPR Article 13. Chips in the app have no monetary value, cannot be cashed out, and cannot be redeemed for anything outside the app.
1. Who is responsible for your data
The data controller is:
TwoFifths Design Ltd
Company number: SC575802
Registered office: 3 Queen Street, Edinburgh, Scotland, EH2 1JE
Registered in: Scotland
Contact: hello@twofifthsdesign.com
We have not appointed a separate Data Protection Officer; the contact above handles all privacy queries and data-subject requests.
2. What we collect, why, and our lawful basis
| Data | Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Anonymous player ID (device-generated) | Identify your session and wallet without a real-world identity | Contract — necessary to provide the game |
| Display name, emoji avatar, optional profile photo | Show your seat at the table | Contract / consent (photo is optional and user-supplied) |
| Gameplay data — chip balance, hands played, results, stats, achievements, hand histories | Run the game, leaderboards, replay screen | Contract |
| Live camera stream (optional) | Show your face to other players and spectators at your table in real time | Consent — your camera stays off until you choose “Go live”, and you are asked again every time you sit down |
| Live microphone stream | Let other players and spectators at your table hear you in real time | Consent — given by joining a table with video enabled. Unlike the camera, audio starts on: mute it any time from the table controls, or switch video off entirely in Settings to join no table with either |
| Apple / Google / Facebook account identifier, or phone number (optional sign-in) | Restore your chips and profile across devices | Consent |
| Reports, blocks, and moderation records | Player safety and community standards | Legitimate interests — keeping the service safe; legal obligation for certain online-safety duties |
| Purchase records (from v1.1, when in-app purchases are switched on) | Grant purchased chips, prevent fraud/replay, refund handling | Contract; legal obligation (accounting/tax) |
| Crash and performance data (Sentry), product-usage analytics (PostHog) — planned | Fix bugs, understand feature use | Legitimate interests |
We do not run advertising SDKs and do not use tracking or analytics brokers that build cross-app profiles of you.
3. Live video, and spectators
Live video and audio at a table are optional and are transmitted in real time only, via LiveKit — they are never recorded or stored by us. Other seated players see and hear your stream while you are at the table, and spectators watching that table also see the same live, unrecorded feed.
Camera and microphone behave differently, and we would rather be plain about it than flattering. Your camera is off until you choose to go live, and you are asked afresh every time you sit down. Your microphone is not: joining a table with video enabled publishes audio, and you mute it from the table controls. If you would rather join with neither, turn Video off in Settings — that stops both before you sit down.
4. Processors and who we share data with
We use the following processors, each bound by a data-processing agreement, strictly to run the service on our behalf:
- Fly.io — hosts our game server (London, UK/EU region).
- LiveKit — relays live camera/microphone streams (EU/London region); does not record or store media.
- Apple, Google, Meta (Facebook) — verify your identity if you choose to sign in with one of them, and process any in-app purchase you make through their store.
- Twilio — when phone sign-in is enabled, delivers the one-time SMS code (phone sign-in is currently off).
- Sentry — crash reporting (planned, EU cloud region).
- PostHog — product analytics (planned, EU cloud region).
We never sell your data, and we do not share it with anyone for their own marketing purposes.
5. International transfers
We host game data and route live video in the EU/UK (London). Where a processor above transfers data outside the UK (for example a US-based provider's support infrastructure), the transfer is made under the UK International Data Transfer Addendum (IDTA) or the EU Standard Contractual Clauses as incorporated into that processor's agreement with us, so your data stays protected to UK GDPR standard wherever it is processed.
6. Data retention
| Data | Retention |
|---|---|
| Account data (profile, wallet, stats, history) | Until you delete your account |
| Safety reports | 12 months from filing |
| Hidden avatars pending/after moderation review | 30 days |
| Purchase ledger (transaction records, from v1.1) | 24 months |
| Deleted account IDs (deny list, so a deleted account can never be re-created) | Kept indefinitely — it is the record that makes the deletion permanent |
7. Deletion — what actually happens
You can permanently delete your account at any time in-app (Settings → Delete account). This immediately and irreversibly erases: your wallet and chip balance, hand history, stats, friends/referral links, profile, and any avatar photo file.
Any session you still have signed in stops working immediately, and your player ID can never be issued or re-created again — not by us, and not by anything that still happens to mention it.
What is kept, and why: your deleted player ID goes on a permanent deny list. That list holds the ID and the date, nothing else, and it exists for one reason: it is what makes the deletion stick. Without it, anything that still referenced your ID — a leaderboard from the day before, say — would quietly bring the account back. Reports you filed against other players are retained as moderation evidence (see the retention table). And if you made a purchase, the transaction record stays in our purchase ledger for 24 months, as required for accounting, tax, and fraud/chargeback handling — that record is your transaction id, SKU and timestamp, not your card details, which we never see.
8. Your rights
Under UK GDPR you have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data erased (see above — you can self-serve this in-app); restrict or object to certain processing; receive your data in a portable format; and withdraw consent at any time where processing is based on consent (for example, turning off camera/microphone, or unlinking a sign-in provider).
To exercise any of these rights, email hello@twofifthsdesign.com with your player ID (Settings). We respond within one calendar month.
If you are not satisfied with our response, you can complain to the UK data protection regulator, the Information Commissioner’s Office, at ico.org.uk.
9. Children
Game Face is an 18+ service. We do not knowingly create accounts for, or collect data from, anyone under 18. The app shows a neutral age screen before play (it does not coach a particular answer), and any account we learn belongs to someone under 18 is deleted. If you believe a child has provided us data, contact us and we will remove it.
10. Cookies
This website (gamefacepoker.com) uses no cookies beyond what is strictly necessary for the page to function — there is no analytics or advertising cookie on this site. The app itself does not use browser cookies at all.
11. What we don’t do
- No advertising SDKs, no ad trackers, no analytics brokers, no sale of data.
- No real-money gambling, no cash prizes.
12. Changes to this policy
We may update this policy as the service changes; material changes will be noted in-app or on this page, with the “Last updated” date above kept current.
Change log: 6 September 2026 — corrected the camera/microphone entry, which described the microphone as off by default when in fact audio starts on when you join a table; corrected the deleted-account deny list, which is permanent rather than purged after 30 days. 3 September 2026 — rewritten to UK GDPR Article 13 format, added processor list, international-transfer safeguards, and the full retention schedule.
Contact
TwoFifths Design Ltd — hello@twofifthsdesign.com
TwoFifths Design Ltd. Company number SC575802. Registered office: 3 Queen Street, Edinburgh, Scotland, EH2 1JE. Registered in Scotland.