Privacy policy

Who looks after your data

Pokerzin is the controller of the data. For any request or question about privacy, including your rights under the LGPD and the GDPR, write to felipematheusdev@gmail.com.

What we keep

From your account

• Email, so you can sign in, choose a new password if you forget yours and so we can contact you about the account.
• Nickname, the name shown at the table and in the ranking.
• Password, stored only in scrambled form (argon2id): nobody, not even us, can read your password.
• Sign-up date, last sign-in date and when you confirmed your email.

From the game

• Chip balance, chosen character and frame, unlocked items and claimed rewards.
• Statistics: hands played and won, biggest pot and best hand.
• Level, PR and league for each season, the result of every hand that counted for the ranking and your daily mission progress.
• The table you are sitting at and the chips you brought to it.
• The history of every hand at the online tables: everyone's cards, the board, the pots and who won. It is used to investigate cheating (colluding accounts, for example) and complaints.

From the session and security

• Session: when you sign in, the browser receives a random code in a cookie. The server keeps only a scrambled version of that code, with the creation date, the last access and the browser name (the "user agent").
• Presence: while the hub is open, the site notes the last time it saw your account, so we know how many people are playing right now. It stays only in the server's memory, for a few minutes, and disappears when it restarts.
• Email links: to confirm your email or choose a new password, we send a link with a random code. The server keeps only a scrambled version of that code, which works for 48 hours (confirmation) or 1 hour (new password) and is deleted when you use the link or when it expires.
• Attempt limits: to stop people guessing passwords, we count sign-in, sign-up and new password attempts per IP address and per email. Both are stored only in scrambled form (HMAC), in a way that can't be read back.
• Access logs: the server records each access to the site (IP address, page requested, date and time, and browser). These logs are used for security and to find bugs, and are deleted after 14 days.
• Error logs: when something breaks on the site or in your browser, we keep what went wrong and on which page, so we can fix it. We don't keep who was playing, and emails, passwords and access codes are removed from the log before it is saved.

What we don't ask for

Real name, ID numbers, phone, address, location or payment details. There are no purchases in Pokerzin: chips can't be bought or cashed out.

What we use it for and on what basis

• Running the game (your account, balance, tables, level, ranking and rewards): it's what you ask for when you sign up (performance of a contract: LGPD art. 7, V; GDPR art. 6(1)(b)).
• Protecting accounts and the game (attempt limits, session, access logs, fighting cheating): legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)).
• Complying with the law, when an authority asks on a legal basis (LGPD art. 7, II; GDPR art. 6(1)(c)).

We don't sell your data, we don't use it for advertising and we don't profile you.

What other players see

Anyone with a Pokerzin account can see your nickname, character, frame, level, league, PR and ranking position, your statistics and the month you joined. Players in the chips Top 50 appear with their balance. Your email is never shown to another player. Only Pokerzin's administrator sees account data (including the email), in an internal panel, to look after the game and answer your requests.

Who we share it with

The site and the database run on a server rented from Hostinger, in Brazil, which only stores and processes the data for us. Pokerzin's emails (confirming your email and choosing a new password) are sent through Resend, which receives only your address and the message, to deliver it. Resend is a United States company, so this data may be processed outside Brazil. We don't use analytics, advertising or social media tools. The site's fonts, images and emojis are served by Pokerzin itself, without going through other companies.

If you are outside Brazil, your data is transferred to and stored in Brazil. For people in the EU, EEA or UK, we rely on this transfer being necessary to provide the service you asked for (GDPR art. 49(1)(b)).

If this changes, this page changes first, and we announce it on the site.

Cookies

We use a single cookie, the session cookie (pz_session), which keeps you signed in. It is necessary for the game to work, doesn't track anything outside Pokerzin and lasts 30 days, renewed with each use. When you sign out, it is deleted.

The site also remembers your language in a cookie (NEXT_LOCALE), so the next visit opens in the language you chose. The cookie notice stores in your browser (localStorage) that you have already seen it, so it doesn't show again. We don't use third-party cookies.

How long we keep it

• Account and game data are kept while the account exists.
• You can delete the account at any time, in the hub, under Account. Everything is erased immediately: email, nickname, password, balance, statistics, ranking and sessions.
• We make one database backup per day and keep the last 14. So a deleted account disappears from the backups within 14 days.
• Access logs: 14 days.
• Error logs: 30 days after the last time the error happened.
• Hand history: 90 days.

How we protect it

The site only works over an encrypted connection (HTTPS). Passwords and session codes are stored scrambled, the database is not open to the internet and sign-in attempts are limited. No system is perfect: if an incident could affect you, we will tell you and the competent data protection authority, as the LGPD and the GDPR require.

Your rights

Under the LGPD (art. 18) and, where it applies, the GDPR (arts. 15 to 22), you can ask for:

• confirmation that we process your data and a copy of it;
• correction of wrong data (you can change the nickname yourself under Account);
• deletion of the data (the button under Account erases everything immediately);
• portability, information about who we share it with, restriction of a use and objection to a use.

Write to felipematheusdev@gmail.com from your account's email. We reply within 15 days. If you are not satisfied, you can complain to the ANPD in Brazil (gov.br/anpd) or to the data protection authority of the country where you live.

Minimum age

Pokerzin is only for people aged 18 or older (see the Terms of use). If we learn of an account belonging to someone younger, it is deleted.

Changes to this policy

The date at the top shows the last change. If something important changes, such as what we keep or who we share it with, we announce it on the site before it takes effect.