Privacy Policy

1. What we collect

BluffKing is operated by BLUFF KING PTE. LTD. (UEN 202627618H), a company incorporated in Singapore.

We collect the minimum data needed to run the service:

Account info: display name, email, hashed password.
Game and training data: sessions, room membership, hand history, action logs, drill attempts, stats, and coach messages.
First-party usage telemetry: page views, funnel events, client errors, performance timing, user agent, and an anonymous browser id. Telemetry is not used to store hand contents.
Profile media: an optional avatar image you upload. Because it is shown to other players at your table, it is shared with other users in multi-player rooms.
In-room chat: free-form messages you send at a table are transmitted to the other players in that room and held only in memory for the session (not stored), except where you include it in a report you submit, which we retain for abuse review.
Purchases and membership: store product and plan identifiers, purchase token or transaction/order identifier, subscription and entitlement status, renewal/expiry/refund/revocation events, and related verification or fraud-prevention records. We do not receive your payment-card or bank-account credentials.
Connection & technical metadata: your IP address, device and browser type (User-Agent), and request timestamps, logged automatically when your client connects. We use it only to operate, secure, and protect the service (see Security & abuse prevention below), never for advertising.

2. Where it lives

The current app paths use server-authoritative game state. Account, session, hand-history, drill, coach, billing-order, and membership-entitlement records are stored server-side so you can reconnect, review hands, continue training, and restore or verify purchases.

Live table and review payloads are redacted per viewer: you receive your own hole cards and only opponent cards that the game rules allow to be shown.

3. Store and payment providers

Google Play, Apple, Stripe, and any other payment provider that a product surface explicitly offers collect payment details directly under their own terms and privacy policies. BluffKing receives only the product, purchase/order/transaction identifier, status and lifecycle data needed to verify the purchase, activate membership, prevent fraud, provide support, and meet accounting or legal duties.

We send provider-issued purchase identifiers back to the matching provider for verification. We do not use purchase history for advertising or sell it to anyone.

4. AI Coach provider

When a Max user submits Coach Chat, BluffKing sends Anthropic's commercial API the current question, up to eight recent messages in the same context, the player's own hole cards, the public board, street/position/pot/to-call/stack, and the local Solver summary. We do not automatically add names, email, user ID, hand UUID, timestamps, opponent hole cards, or the full action log. The interface warns you not to type private information into the question itself.

Anthropic currently states that commercial API inputs and outputs are not used for model training by default and are normally deleted within 30 days, subject to safety-enforcement or legal exceptions. Its current policies are at privacy.anthropic.com/en/articles/7996868-is-my-data-used-for-model-training and privacy.anthropic.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data. If the AI provider is disabled or unavailable, BluffKing uses the local Solver fallback and sends no request to Anthropic.

5. Security & abuse prevention

Our server access logs include your IP address, the request time, the host and path, referrer, response status and timing, and your browser's User-Agent. Rolled log files are deleted after 30 days; the current active log is retained until it rotates by size.

We use your source IP address to rate-limit automated or abusive traffic and to flag potential collusion — for example, distinct accounts concurrently connected and seated at the same table from the same source IP address — so the practice games stay fair.

A collusion signal kept for staff review records the accounts and table involved and may include a keyed one-way HMAC of the IP; it never contains the raw IP address, and if the HMAC key is not configured the HMAC field is omitted while the shared-source relationship between the accounts remains. These records have no automatic expiry and remain until staff manually delete them.

This is legitimate-interest processing to protect players and the service. We do not use it to track you across other websites or for advertising.

6. What we don't do

We do not sell, rent, or trade your data. We do not let advertisers track you across the web. We do not run third-party analytics scripts inside the application. We do not receive or store raw payment-card or bank-account credentials. We do not share hand histories except for the specific, player-submitted AI Coach payload described above; we never send opponents' private cards to the provider.

7. Cookies

Authentication uses a first-party `session` cookie. No tracking cookies. No third-party cookies. H5 uses local storage for non-secret pointers and preferences, and the marketing site uses a first-party anonymous telemetry id; see the Cookie Policy tab for the full list.

8. Your rights

You can request in-app account deletion from the mobile app's Me (Account) or About page via Delete account. This permanently deletes your account and associated service data.

You can also request account deletion outside the app by emailing loong@bluffking.ai from your account email with the subject "BluffKing account deletion". We delete eligible account data within 30 days, unless retention is required for security, fraud prevention, or legal compliance.

Under GDPR, CCPA, and similar laws, you may have rights to access, rectify, port, and erase your data. Email loong@bluffking.ai to exercise them.

9. Children

We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, email loong@bluffking.ai.

10. Changes

If we change this policy in a way that affects you, we will email registered users at least 30 days before the change takes effect.

11. Contact

Privacy questions: loong@bluffking.ai. Data Protection Officer: loong@bluffking.ai.