Privacy Policy
What we collect, why, for how long, and what you can require of us. Written to be read: if a passage seems unclear to you, write to us — it means it's poorly worded.
This translation is provided for information only: the French version of this document alone is authoritative.
Last updated: October 19, 2026.
Who processes your data
SunStar Decision, 19 avenue d'Italie, 75013 Paris, is the data controller for your account and club data. Contact: contact@mypokercaptain.com
What we collect
Your account: e-mail address, name, and a password we never store in plain text — only a cryptographic hash of it is kept. If you sign in with Google, we receive your address, your name and your profile photo, nothing else.
Your club: its name, its city, its members and their role, its partners and their logos.
Your players and tournaments: names and nicknames, license numbers, contact details if you enter them, registrations, stacks, eliminations, payouts, standings.
Your subscription: the plan, its status and its renewal date. No banking data ever passes through our servers — the card number is entered with Stripe, on a page that isn't ours, and we never see any of it.
Technical logs: IP address, date and time of connections, errors encountered. They're used for security and troubleshooting, nothing else.
Why, and on what basis
To run the service and manage your subscription: performance of the contract between us.
To keep invoices: a legal obligation, ten years, which we cannot bypass even at your request.
To secure accounts and prevent fraud: our legitimate interest, and yours.
Showing advertising on some pages of the website: our legitimate interest, which funds the free plan. Personalising it, or setting cookies for that purpose: your consent, which you can refuse or withdraw at any time. The application itself does no targeted advertising and no profiling, and we resell no data.
Your club's players
Your players' records are entered by you, not by us. For this data, the club is the data controller and we are its processor: we host and process it solely on your instructions.
This is your responsibility: only record what's useful to you, inform your players that their details are being recorded, and respond to anyone who asks for their record to be deleted. The application gives you the tools to do it.
If you choose to embed a championship’s standings in your club’s website, they become readable by anyone who visits that site. Players appear under their nickname or, failing that, their first name and last-name initial, with their rank, points and number of tournaments played — never their full name or contact details. Nothing is online until you decide so, and you can remove it whenever you want. It is up to you to inform your players.
For how long
Your account and club data lives as long as the account exists, then three years after our last exchange.
Invoices and accounting records: ten years, a legal obligation.
Connection logs: one year.
When an account is deleted, the data is erased from our databases within thirty days. Automatic database backups are then removed according to our host's retention cycle.
Your consent choice and advertising cookies: thirteen months at most.
Who else has access
Six providers, each for a specific purpose: Neon (database, European Union), Railway (hosting, servers in the Netherlands), Resend (sending e-mails), Stripe Payments Europe (subscription payments, Ireland), Plausible Analytics (audience measurement for the website, European Union), and Google: for sign-in if you choose a Google account, and for advertising on some pages of the website (Google AdSense, Google Ireland Limited), and for the Help videos in the app (YouTube, in privacy-enhanced mode), whose player only loads when you start a video.
None of them is allowed to use your data for its own purposes, with one exception: for advertising, Google and the partners you accept in the consent banner process the data collected by their cookies for their own purposes, under their own rules (policies.google.com/technologies/partner-sites). Resend and Google transfer data to the United States: Resend under the European Commission's standard contractual clauses, Google under the EU–US Data Privacy Framework.
We do not sell or rent data to anyone.
Cookies, audience measurement and advertising
A session cookie, which keeps you signed in, and a local storage space that retains your plan and the current tournament so the application works without a network. Both are strictly necessary for the service.
No audience measurement, no advertising trackers and no social networks in the application.
The website, mypokercaptain.com, counts its visits with Plausible Analytics, without cookies or persistent identifiers. A visitor is recognised for one day only, by a hash of their IP address and browser computed with a key that Plausible destroys every day; neither the IP address nor the browser is stored. All that comes out is anonymous statistics (pages viewed, where visitors come from, clicks towards the application), hosted in the European Union and for our use only.
To avoid being counted, turn on your browser's Global Privacy Control or Do Not Track signal: the site then sends nothing more to Plausible. This anonymous measurement, for our own use only, does not require your consent.
On the tools, guides and FAQ pages of the website, ads are served by Google AdSense. Google and its partners may read or set cookies and identifiers there to display ads, measure their audience, fight fraud and, if you agree, tailor them to your interests.
On your first visit to one of these pages, a banner asks for your choice: “Consent”, “Do not consent” or “Manage options”, purpose by purpose and partner by partner. Refusing is as easy as accepting and doesn't keep you from any page. Without your agreement, no advertising cookie is set and ads are not personalised. You can change your mind at any time with the “Manage cookies” link at the bottom of these pages.
Your rights
You can request access to your data, its correction, its deletion, its portability, or object to processing. Write to contact@mypokercaptain.com: we reply within one month.
If our response doesn't satisfy you, you can refer the matter to the CNIL (Commission nationale de l'informatique et des libertés — the French data protection authority), 3 place de Fontenoy, 75007 Paris, cnil.fr.
Security
Exchanges are encrypted end-to-end via HTTPS. Passwords are hashed. Activation codes are hashed too and expire after fifteen minutes. Access to the databases is restricted and logged.
No system is unbreakable. In the event of a breach posing a risk to your rights, we will inform you and the CNIL, within the timeframes set out by the regulation.
Changes
Any change to this policy will be announced by e-mail to account holders before it takes effect.