Poker Call

Privacy Policy

Last updated: 23 October 2026

This policy explains how TwoFifths Design Ltd (trading as Poker Call) processes personal data when you play Poker Call, a play-money, 18+ live-video Texas Hold’em game. It is written to meet UK GDPR Article 13. Chips in the app have no monetary value, cannot be cashed out, and cannot be redeemed for anything outside the app.

1. Who is responsible for your data

The data controller is:

TwoFifths Design Ltd, trading as Poker Call
Registered in Scotland, company number SC575802
Registered office: 3 Queen Street, Edinburgh EH2 1JE, United Kingdom
Registered with the Information Commissioner’s Office, registration ZC264015
Contact: hello@pokercall.live

We have not appointed a separate Data Protection Officer; the contact above handles all privacy queries and data-subject requests.

1a. Our EU/EEA representative (GDPR Article 27)

TwoFifths Design Ltd (trading as Poker Call) is based in the United Kingdom. For people in the European Union and the European Economic Area (EU/EEA), we have appointed DataRep (Data Protection Representative Limited, trading as DataRep) as our Data Protection Representative under Article 27 of the EU GDPR. DataRep acts for TwoFifths Design Ltd (trading as Poker Call) only.

If you are in the EU/EEA and want to use your data protection rights, ask a question about how we use your personal data, or raise a concern with us, you can contact us directly at hello@pokercall.live, or contact DataRep, who will pass your request to us:

• email datarequest@datarep.com, quoting “Poker Call” in the subject line;
• use DataRep’s online form at www.datarep.com/data-request; or
• write to DataRep at the address for your country below.

When you write, address your letter to “DataRep”, not to “Poker Call”. Letters addressed to us at these addresses may not reach DataRep. DataRep may ask you to prove who you are before it passes a request on, so that your data is not given to anyone else. You can also complain to the data protection authority in the country where you live or work.

For anything else about the app (a question about playing, your account, purchases or a report), please email hello@pokercall.live. DataRep cannot help with those and cannot answer questions about the game.

DataRep’s addresses in the EU/EEA, each to be addressed to “DataRep”:

• Austria: DataRep, City Tower, Brückenkopfgasse 1/6. Stock, Graz, 8020, Austria
• Belgium: DataRep, Rue des Colonies 11, Brussels, 1000, Belgium
• Bulgaria: DataRep, 25 Vitosha blvd. Fl. 2, office 4, 1000, Sofia, Bulgaria
• Croatia: DataRep, Ground & 9th Floor, Hoto Tower, Savska cesta 32, Zagreb, 10000, Croatia
• Cyprus: DataRep, Victory House, 205 Archbishop Makarios Avenue, Limassol, 3030, Cyprus
• Czech Republic: DataRep, Platan Office, 28. Října 205/45, Floor 3&4, Ostrava, 70200, Czech Republic
• Denmark: DataRep, Lautruphøj 1-3, Ballerup, 2750, Denmark
• Estonia: DataRep, 2nd Floor, Tornimae 5, Tallinn, 10145, Estonia
• Finland: DataRep, Luna House, 5.krs, Mannerheimintie 12 B, Helsinki, 00100, Finland
• France: DataRep, 72 rue de Lessard, Rouen, 76100, France
• Germany: DataRep, 3rd and 4th floor, Altmarkt 10 B/D, Dresden, 01067, Germany
• Greece: DataRep, Ippodamias Sq. 8, 4th floor, Piraeus, Attica, Greece
• Hungary: DataRep, 1054 Honved street, 8 1/2, Budapest, Hungary
• Iceland: DataRep, Laugavegur 13, 101 Reykjavik, Iceland
• Ireland: DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland
• Italy: DataRep, Viale Giorgio Ribotta 11, Piano 1, Rome, Lazio, 00144, Italy
• Latvia: DataRep, 4th & 5th floors, 14 Terbatas Street, Riga, LV-1011, Latvia
• Liechtenstein: DataRep, City Tower, Brückenkopfgasse 1/6. Stock, Graz, 8020, Austria
• Lithuania: DataRep, 44A Gedimino Avenue, 01110 Vilnius, Lithuania
• Luxembourg: DataRep, BPM 335368, Banzelt 4 A, 6921, Roodt-sur-Syre, Luxembourg
• Malta: DataRep, Tower Business Centre, 2nd floor, Tower Street, Swatar, BKR4013, Malta
• Netherlands: DataRep, De Nieuwe Erven 3 Unit – 15162, 5431 NV Cuijk, Netherlands
• Norway: DataRep, C.J. Hambros Plass 2c, Oslo, 0164, Norway
• Poland: DataRep, Budynek Fronton ul Kamienna 21, Krakow, 31-403, Poland
• Portugal: DataRep, Torre de Monsanto, Rua Afonso Praça 30, 7th floor, Algès, Lisbon, 1495-061, Portugal
• Romania: DataRep, 15 Piaţa Charles de Gaulle, nr. 1-T, Bucureşti, Sectorul 1, 011857, Romania
• Slovakia: DataRep, Apollo Business Centre II, Block E / 9th floor, 4D Prievozska, Bratislava, 821 09, Slovakia
• Slovenia: DataRep, Trg. Republike 3, Floor 3, Ljubljana, 1000, Slovenia
• Spain: DataRep, Calle de Manzanares 4, Madrid, 28005, Spain
• Sweden: DataRep, S:t Johannesgatan 2, 4th floor, Malmo, SE - 211 46, Sweden

2. What we collect, why, and our lawful basis

Analytics are not used for advertising and are never combined with data from other apps or websites: no advertising ID, no IP address (PostHog discards it on arrival), no location, no session recordings and no automatic capture of everything you tap. We do not run advertising SDKs and do not use tracking or analytics brokers that build cross-app profiles of you.

Notifications. If you allow notifications, the app schedules a few reminders on your phone itself (a Poker Night you asked to be reminded of and, only if you switch Offers on, a new House Special; and the free-spin and streak reminders, if your phone has no push token with us). The rest (a free spin ready, your streak, fresh missions, House Pass rewards still unclaimed near the end of a season, a welcome-back note if you have been away a few days, your nightly table (Tea & Tells or Prime Time, whichever is nearer your evening) opening if you asked to be reminded, your Crew Chest, results, friends (including a friend sitting down at a table with a seat free) and invites, and a chip offer if you switched Offers on) are sent from our server. For those, our server holds an anonymous push token for your install, and each message passes through Expo’s push service and then Apple’s or Google’s push service to reach your phone; they receive the token and the text of the message, nothing else. Every kind has its own switch in Settings → Notifications, and Offers is off unless you switch it on. Signing out removes the token from our server, and so does deleting your account; you can also turn notifications off entirely in your phone’s own settings.

Fair-play checks. To keep tables fair, we check whether two accounts that seem to belong to the same person sit at the same table. We use the device and notification token an account signs in from, and for pairs we flag we record a scrambled (hashed) version of the internet address, gifts between the accounts and hands they play against each other. We keep these records for 180 days, then delete them, and we delete them with your account if you delete it.

Profile photo checks. Profile photos are checked before they appear. Checks are made by automated tools, including an AI service acting on our behalf, and by a human moderator. Photos that break the house rules are not published.

• Who sees a new photo. Until it is approved, only you (on your own phone, marked “Waiting for approval”), the checking tools and our moderator. Once approved, other players see it where your profile appears, such as your seat at a table.
• The tools. An automated image-moderation service hosted in the United Kingdom looks for content the house rules forbid (such as nudity, weapons, drugs, gore or hate symbols) and returns labels with a confidence score. An AI assistant service, working only on our instructions, looks at the photo against the house rules and suggests approve or decline. They receive the photo (the AI service also sees the player name it belongs to), never your email address or phone number. Neither is used to recognise who is in a photo, and neither uses your photo to train its models.
• A person decides anything sensitive. The AI service never approves a photo that seems to show a child or any sexual content: those go to our human moderator, the owner of Poker Call, who makes the final call. Automated tools never warn, suspend or ban anyone. If you think a photo of yours was declined in error, email us and a person will look at it again.
• Why, and our lawful basis. To keep a public table safe for the adults who sit at it and to keep illegal and harmful images off the app. Legitimate interests (keeping a public table safe), and legal obligation (our duties under the UK Online Safety Act 2023).
• How long. A photo waiting for a check is kept until it is checked, never more than 30 days. A declined photo is deleted at once, unless it may be evidence of serious harm (for example, a child at risk or abuse imagery): then it is moved to a locked evidence hold, never shown to anyone except the police, the National Crime Agency or a court, and deleted when they tell us it is no longer needed. Suspected child abuse imagery is reported to the National Crime Agency. The image-moderation service keeps nothing after a check; the AI service keeps what we send it only for a limited time under its own terms.

3. Live video, and spectators

Live video and audio at a table are optional and are transmitted in real time only, through our own LiveKit media relays: they are never recorded or stored by us. Only the other players seated at your table see and hear your stream while you are there; people watching from the rail see avatars, not cameras.

Who can be on camera. Every table is a hand of poker with the players seated at it: nobody is ever paired with a stranger to chat. At every table, private tables you join by code included, only an account signed in with Apple or Google can turn on a camera or a microphone; guests still sit, play and watch.

Camera and microphone. Your camera is off until you choose to go live: when you sit, once another player is at the table, two switches, Camera and Mic, start on your last answer and the table gets exactly what you choose (or set the camera once in Settings and skip the question). At a public table your microphone starts muted every time you sit: switch it on as you sit, or one tap on the table controls to talk. At a private table it follows your last choice. You can also hide everyone else’s camera (Settings → “Show other players’ video”), or turn Video off in Settings to join with neither.

Marketing clips. We never record ordinary tables. The only recordings of players we ever use are clips filmed for our own marketing at private tables of adults who were told beforehand and each agreed in writing; anyone in one can withdraw by emailing us, and we then take down the clips they appear in from our own accounts and store listings.

4. Processors and who we share data with

We use the following processors, each bound by a data-processing agreement, strictly to run the service on our behalf:

• IONOS: hosts our game server and your account data in the United Kingdom, and the servers that relay live camera and microphone streams: one in the United Kingdom and one in the United States (see section 5). The relays run our own copy of the LiveKit software and do not record or store media. IONOS also hosts our support mailbox, which receives a copy of each safety report (the reason, both players’ names and IDs, the table and any note) so a person sees it promptly, and every email you send us.
• Google (Google Groups): runs the address pokercall-help@googlegroups.com that Google’s sign-in screen shows as our support contact. Mail sent to it passes through Google to our IONOS mailbox.
• Fly.io (London) with LiveKit Cloud (EU, Frankfurt): a standby copy of the game server and video relay, used only if the main servers are down.
• Apple and Google: verify your identity if you choose to sign in with one of them, process any in-app purchase you make through their store, and deliver push notifications to your phone (Apple Push Notification service, Google Firebase Cloud Messaging).
• Expo (650 Industries, Inc., United States): relays our server’s push notifications to Apple and Google; receives your device push token and the text of each message. Expo also delivers the app’s fixes: each time the app opens it asks Expo’s update service whether a newer version of the app’s code is ready, sending your IP address, the phone’s platform, the app version, the update channel and a random installation ID that is not linked to your account, and downloads the fix if there is one.
• Sentry: crash reporting (EU cloud region). Receives error reports with your player ID and device model; never your name, email or phone number.
• PostHog: product analytics (EU cloud region), from both the app and our server. Receives the gameplay, screen and purchase events listed in section 2 with your player ID (a random ID, never your name, email or phone number); IP addresses are discarded on arrival; no session recordings; not used for advertising or tracking.
• Backblaze (Backblaze B2, EU Central region): stores an off-site copy of our nightly backup of the game data. It is encrypted on our server before it leaves, with a key Backblaze never holds, so Backblaze cannot read it. IONOS also keeps an encrypted copy of the whole UK server for up to 90 days, so we can rebuild it after a failure.
• Netlify (Netlify, Inc., United States): hosts this website, pokercall.live, and stores the email addresses typed into its test-invite and launch form (and, if you fill it in, the name of the friend who invited you, which we use only to thank and reward them) until we send the launch email.
• Mailchimp (Intuit Inc., United States): sends our test-update and launch emails to people who signed up on this website. It receives your email address and records whether an email was opened or a link clicked, and every email has a one-click unsubscribe link.

Profile photo checks also use an automated image-moderation service hosted in the United Kingdom, under its provider’s data-processing terms, and an AI assistant service acting on our instructions: what each receives is under “Profile photo checks” in section 2.

We never sell your data, and we do not share it with anyone for their own marketing purposes.

5. International transfers

We host game data in the United Kingdom. Live video for a table is relayed in the United Kingdom, except that a table first opened by a player whose phone is set to an American time zone is relayed through our server in the United States, so players there are not routed across the Atlantic; if you sit at such a table, your live stream passes through that server in real time and is never stored there. Push notifications and the app’s update checks pass through Expo in the United States, and this website and its launch-notification form are hosted by Netlify in the United States. The AI assistant service that helps check profile photos is provided from the United States; the automated image-moderation service runs in the United Kingdom. Where a processor above transfers data outside the UK (for example a US-based provider's support infrastructure), the transfer is made under the UK International Data Transfer Addendum (IDTA) or the EU Standard Contractual Clauses as incorporated into that processor's agreement with us, so your data stays protected to UK GDPR standard wherever it is processed.

6. Data retention

7. Deletion: what actually happens

You can permanently delete your account at any time in-app (Settings → Delete account), or without the app from pokercall.live/delete-account. This immediately and irreversibly erases: your wallet and chip balance, hand history, stats, friends/referral links, profile, and any avatar photo file. Hands you played stay in your opponents’ own histories, but your seat in them loses your player ID and name and reads “Deleted player”.

If you signed in with Apple, deleting your account also asks Apple to revoke the sign-in link between Poker Call and your Apple ID. The only thing we hold for this is the token Apple issued when you signed in; it is used for that request and then discarded (if Apple cannot be reached, we keep retrying until it is done).

If you pay for The Club, the subscription is billed by Apple or Google and keeps renewing until you cancel it in your App Store or Google Play subscriptions. Deleting your account does not cancel it, so cancel it first; the app says so, with a Manage subscription button, before it deletes.

Any session you still have signed in stops working immediately, and your player ID can never be issued or re-created again, not by us, and not by anything that still happens to mention it.

What is kept, and why: your deleted player ID goes on a permanent deny list. That list holds the ID and the date, nothing else, and it exists for one reason: it is what makes the deletion stick. Without it, anything that still referenced your ID (a leaderboard from the day before, say) would quietly bring the account back. Reports you filed against other players are retained as moderation evidence (see the retention table). If a break, spend cap, refund hold or ban was running on your account, your phone keeps that one control (against a scrambled app ID, not your name) so a new account on it cannot skip it. This phone, and any Apple or Google sign-in the account used, also keeps a note for 90 days that its welcome chips were paid and what the wallet held, so an account made again on it starts with that wallet (never more than the 600,000 welcome), no second first-purchase bonus, no second invite reward, and the same rescue clock and the same day’s free claims the deleted account had; the note is a number and a date, nothing that names you, and is for fraud prevention. And if you made a purchase, the transaction record stays in our purchase ledger for 24 months, as required for accounting, tax, and fraud/chargeback handling: that record is your transaction id, SKU and timestamp, not your card details, which we never see. After 24 months it is deleted, leaving only a one-way fingerprint of the transaction id that stops the same receipt being redeemed twice.

Backups: our encrypted nightly backups taken before you deleted the account still hold a copy of it until they roll off: at most 91 days (see the retention table). We never restore a deleted account from them: if we ever have to restore a backup, the deletion list is kept from the newest copy, so every account deleted since stays deleted.

8. Your rights

Under UK GDPR you have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data erased (see above: you can self-serve this in-app); restrict or object to certain processing (for example, our product analytics); receive your data in a portable format; and withdraw consent at any time where processing is based on consent (for example, turning off camera/microphone, unlinking a sign-in provider, or, in the EU/EEA, switching off “Share usage analytics”).

Some safety measures are applied automatically, before a person looks: a profile photo hidden after five reports from players who shared a table with you, and your camera and microphone paused (and, the second time in 30 days, your account suspended for 24 hours) after three reports of nudity, threats or harassment from different established or Apple/Google-linked players who were dealt into a hand with you (one per phone and per connection; spectators and brand-new guest accounts go to a moderator but do not count). A moderator always reviews them, usually within 24 hours, and you can ask for that review, and give your side, by emailing hello@pokercall.live.

To exercise any of these rights, email hello@pokercall.live with your player ID (Settings). We respond within one calendar month.

Complaints about how we use your data. If you think we have got something wrong with your personal data, you can complain to us first: email hello@pokercall.live with the subject “Data protection complaint”, your player ID (Settings) if you have one, and what happened. We acknowledge every complaint within 30 days (usually within two working days), look into it, and tell you the outcome without undue delay. We keep a record of every complaint and what we did about it.

If you are not satisfied with our response, you can complain to the UK data protection regulator, the Information Commissioner’s Office, at ico.org.uk.

If you live in the European Economic Area or Switzerland, you have the same rights under the EU GDPR (or the Swiss data protection law), on the same terms and through the same email address, and you can also complain to the data protection authority in the country where you live or work. People in the EU/EEA can also reach us through our EU/EEA representative, DataRep (see section 1a).

If you live in a US state with a consumer privacy law (for example California, Colorado, Connecticut, Virginia, Utah or Texas), you can ask to know what personal information we hold about you and how we use it, and ask us to correct it, delete it or give you a copy. We will not treat you differently for asking. We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not use it for profiling that produces legal or similarly significant effects. To make a request, or to appeal our answer to one, email hello@pokercall.live; someone you authorise may ask on your behalf. We answer within the time your state’s law allows (45 days in most states).

9. Children

Poker Call is an 18+ service. We do not knowingly create accounts for, or collect data from, anyone under 18. The app shows a neutral age screen before play (it does not coach a particular answer). Any player can report someone who may be under 18; a person acts on that report the same day, taking the account off the tables while we check, and any account we learn belongs to someone under 18 is deleted. If you believe a child has provided us data, contact us and we will remove it.

10. Cookies

This website (pokercall.live) uses no cookies beyond what is strictly necessary for the page to function: there is no analytics or advertising cookie on this site. The app itself does not use browser cookies at all.

11. What we don’t do

• No advertising SDKs, no ad trackers, no analytics brokers, no sale of data.
• No real-money gambling, no cash prizes.

12. Changes to this policy

We may update this policy as the service changes; material changes will be noted in-app or on this page, with the “Last updated” date above kept current.

Change log: 23 October 2026: named DataRep as our EU/EEA Data Protection Representative under GDPR Article 27 and said how to reach them (section 1a). 17 October 2026: profile photos are now checked by automated tools, including an AI service acting on our behalf, as well as by a human moderator; added who sees a new photo, the two services and what they receive, why and on what lawful basis, how long a declined or held photo is kept, and that a person makes the final call on anything sensitive (section 2, “Profile photo checks”; sections 4 and 5). 13 October 2026: added fair-play checks on accounts that seem to belong to the same person (what we use, the hashed internet address kept for flagged pairs, and 180-day retention). 12 October 2026: added the in-app “Report a bug” form (what it sends, including the optional email address for a reply) and how long a report is kept (24 months, or until you delete your account). 11 October 2026: if you leave your email on the website, we may now also send the occasional email about test updates while the test runs; reply STOP to any of them and they stop. 9 October 2026: the privacy notice now says what we hold about testers and group members and for how long. 9 October 2026: the website form now also sends you an invite to the free test while it runs (as well as the one launch-day email); the address is still deleted after launch. 6 October 2026: when you sit, the camera question is now two switches, Camera and Mic, asked at every sitting with your last answer already set (it used to be asked once and then remembered); a public table’s microphone still starts muted, and you can switch it on as you sit. 5 October 2026 (later): the nightly table reminder now covers two tables, Tea & Tells (8pm UK) and Prime Time (1am UK); it is still one reminder a night, for the one nearer your evening, worked out from the time zone your phone already sends us. 5 October 2026: signing in with Apple or Google on a phone that holds a guest account now links that sign-in to the guest (the chips, name and seat stay) instead of making a second account; if the sign-in already has an account, the app asks which one to keep. A guest who signs out keeps the guest's key on the phone until the next account is chosen there, for the same reason. 4 October 2026 (fixes over the air): the app now checks Expo’s update service when it opens and downloads fixes to its own code from there; what that check sends is under Expo in section 4. 4 October 2026 (later): the launch-day wallet reset keeps the phone mark of a phone whose beta account is still open, so a second account made there on launch day starts without the welcome. 4 October 2026: a new account on a phone that made one in the last 90 days (after signing out, or reinstalling on Android) starts without the welcome chips; the phone mark that remembers this (a scrambled phone id, never the raw one) is in the purposes and retention tables. A second person on a shared phone can ask support for their own welcome. On Android the app is left out of phone backups, so the sign-in key never leaves the phone. 3 October 2026: on an iPhone the key that signs the phone in is also kept in the Keychain, so a reinstall brings back the same account; the 90-day welcome note kept after an account is deleted (what it holds and why) is in the retention table, and it is deleted at 90 days whether or not that phone or sign-in comes back. 2 October 2026: listed the 8pm Table reminder (sent only if you ask for it) among the server’s notifications; on a phone set up for the EU or EEA, product analytics are now off until you say yes to a one-time question (consent is the lawful basis there); added our registered address; emails you send us and how long we keep them; Google Groups as the route for our support address; IONOS’s encrypted whole-server backup; the two automatic moderation steps; the under-18 report; and the one-year legal hold on evidence of child sexual abuse reported to the National Crime Agency. Also on 2 October: said how marketing clips are made (only with the written consent of everyone in them). Earlier the same day: added the “Share usage analytics” switch in Settings, which stops product analytics from the app and the server for your player ID. Also said what a support email holds, including the player ID, app version and phone model the app’s “Email us or report a bug” button fills in, and how long our server logs are kept (up to 14 days). 1 October 2026: added the launch-notification email form on this website: what it collects, why, that Netlify hosts it in the United States, and that the addresses are deleted once the launch email is sent; said what happens to purchase records after 24 months (deleted, leaving only a one-way fingerprint that stops a receipt being redeemed twice). 30 September 2026: listed exactly what our product analytics (PostHog) receive, why, how long it is kept and how to object; said that purchases are off in the closed beta test build and on from version 1.0; said that live video and audio are processed ephemerally; set out who can be on camera: at public tables only accounts signed in with Apple or Google can turn on a camera or microphone, the microphone starts muted there, and you can hide other players’ video; corrected the spectator line (the rail sees avatars, not cameras) and the camera question (asked once another player sits down, then remembered); named IONOS as our host, with our own video relays in the UK and the US and Fly.io / LiveKit Cloud as the standby; added Expo, Apple and Google as the push-notification path, the Google profile photo (offered to you, and checked by a moderator before anyone else sees it), and the device push token; said plainly that Facebook and phone sign-in are not offered in this version; corrected the notifications paragraph (a new House Special is only announced if you switch Offers on, and signing out, not a switch, removes the push token; listed the welcome-back note among the server's reminders). 6 September 2026: corrected the camera/microphone entry, which described the microphone as off by default when in fact audio starts on when you join a table; corrected the deleted-account deny list, which is permanent rather than purged after 30 days. 3 September 2026: rewritten to UK GDPR Article 13 format, added processor list, international-transfer safeguards, and the full retention schedule.

Contact

TwoFifths Design Ltd, trading as Poker Call: hello@pokercall.live