Privacy Policy

Effective 17 October 2026.

This policy says what personal data QUANT.POKER collects, why, who receives it, how long it is kept, and what you can do about it. The service is run by TAI HWAN HAH, an individual in the Republic of Korea, who is the controller of your data and its privacy officer. Write to [email protected].

1. In short

• To join you need only a username and a password. If you sign in with Google, the service takes only your email address and the ID Google gives your account.
• No name, phone number, payment details or location are asked for. The service sells nothing and shows no ads.
• The AI models receive the hands and your play, never your username, your account, your email or your IP address.
• No advertising or tracking cookies. Visits are counted without cookies.

2. What is collected

• Username, when you join: your account, shown on the Leaderboard and in replays.
• Password, when you join: for signing in. Stored only as an Argon2 hash, never in readable form.
• Email address and Google account ID, only if you sign in with Google: for signing in with Google, and as your way back in if you lose your password. Nothing else is taken from your Google account: not your name, picture, contacts or anything else.
• Invite code, if you joined with one: to know how players found the service.
• Your play, when you play: every match, its cards and chips, each action and when it was taken, the AI’s decisions and what it weighed, its read of you, ratings, tickets, Readings, the hands you mark and the replays you share.
• Session, while you are signed in: a random token in a cookie keeps you signed in. The server keeps only a hash of it.
• IP address, with each request: to limit sign-ups and sign-in attempts from one network. Held only in the server’s memory, never written to storage.
• Error reports, when a page fails: the error, the page, its language, your browser’s name and version and your operating system, with your username if you are signed in, to find and fix faults.

3. Why, and on what basis

• To run your account and the game you asked for: this is needed to provide the service (contract).
• To keep the service safe and working, through the limits on sign-ups and sign-ins, error reports and backups (legitimate interests).
• To study how the AI models play and publish de-identified statistics, which is what the service is for (legitimate interests).

A model’s read of you is part of the game and has no effect outside it. No decision with legal or similarly significant effect on you is made by automated means.

4. Who receives it

The operator does not sell or rent personal data and gives it to no one for their own purposes. These services handle it on the operator’s behalf:

• Vultr (The Constant Company, LLC), server in Singapore: all of the service’s data, to host the server.
• Cloudflare, Inc., United States and its global network: every request, with its IP address, to deliver and protect the site; the database backups (R2); messages to [email protected] (Email Routing), which are forwarded to the operator’s mailbox; and visit counts (Web Analytics).
• Google LLC, United States: your email address and Google account ID, only if you sign in with Google; and the messages you send to [email protected], which the operator receives in Gmail.
• The AI model providers, United States: Google LLC (Gemini), OpenAI, L.L.C. (GPT), Anthropic, PBC (Claude) and TypeSafe AI (Jev). Each receives the hands and the play of matches against its model, without your username or any other identifier, so that the model can decide. They handle it under their API terms.

Personal data may also be disclosed where the law requires it.

Your data leaves your country when you use the service: over encrypted connections, to the server in Singapore and the services above. They protect it under their standard data processing terms. You can refuse by not using the service, or by not signing in with Google; without those transfers the service cannot work.

5. What is public

• Your username, rating and number of hands on the open model’s Leaderboard, once you have finished a match against it.
• A replay you share, to anyone with its link, until you stop sharing it.
• Statistics and example hands the operator publishes, which never name you or let anyone tell that the hands are yours, unless you agree.

6. How long it is kept

• Your account (username, password hash, email address, Google account ID, invite code) and your play: until your account is deleted.
• Sessions: 30 days, or until you log out.
• IP addresses: in memory only, dropped within two hours, and gone when the server restarts.
• Error reports: 30 days in the server’s log.
• Backups: a continuous copy for 7 days, daily copies for 30 days, monthly copies for 12 months. They are used only to restore the service.

When your account is deleted, your username, password hash, email address, Google account ID, invite code and sessions are erased; you leave the Leaderboard, and your shared replays stop opening. The hands stay, with nothing linking them to you, in the models’ statistics. Erased data disappears from the backups as they expire; if a backup is ever restored, deletions made after it are carried out again.

7. Cookies and storage on your device

• qp_session, a cookie that keeps you signed in, for 30 days. It is strictly necessary.
• Local storage in your browser keeps your settings (language, sound, deck colours, the opponent you chose last) and what you have already seen. It stays on your device and is never sent.
• Cloudflare may set strictly necessary cookies to protect the site.
• Visits are counted with Cloudflare Web Analytics, which sets no cookies, uses no storage on your device, and does not identify you or follow you across sites.

Nothing else is stored on your device, so the service asks no consent for cookies. If you block cookies, you cannot stay signed in.

8. Your rights

You may ask to see your data and get a copy of it, to correct it, to delete it, to restrict or object to its use, and to withdraw any consent you gave. Write to [email protected]: from the email address linked to your account, or with your username. The operator may ask you to show that the account is yours. You get an answer within 10 days, free of charge.

You may also complain to the data protection authority where you live or work.

9. Security

Every connection is encrypted (HTTPS). Passwords are stored as Argon2 hashes, and session tokens only as hashes. The database is on one server and its backups in private storage, both reached only by the operator. If a breach puts your data at risk, you and the authorities will be told as the law requires.

10. Children

The service is not for anyone under 18. If you learn that someone under 18 has an account, write to [email protected], and it will be deleted.

11. Help in the Republic of Korea

To report a privacy violation or ask for advice or mediation:

• Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr, call 118
• Personal Information Dispute Mediation Committee: kopico.go.kr, call 1833-6972
• Supreme Prosecutors’ Office, cybercrime: spo.go.kr, call 1301
• Korean National Police Agency, cyber bureau: ecrm.police.go.kr, call 182

12. Changes to this policy

A change is posted on this page at least 7 days before it applies, or 30 days before if it is to your disadvantage, and important changes are announced on the service.

13. Languages

This policy is written in English and translated into the service’s other languages. If a translation differs from the English, the English applies.

14. Contact

TAI HWAN HAH, privacy officer · [email protected]