Privacy notice

1. Who is responsible

MN River Invest GmbH is the operator of PokerDesk and the controller responsible for personal data processed through pokerdesk.io where applicable.

Privacy questions and requests: privacy@pokerdesk.io.

2. What data PokerDesk processes

Browsing and planning on your device

PokerDesk can store tournament selections, entry counts, travel preferences, draft planning details, and a language you choose in your browser. This lets the site restore your choices on that device. Browser-local information is not an account record and is not uploaded merely because you use the planner.

Accounts and saved plans

If you use an account, PokerDesk processes the account identifier, email address, display name, an optional profile-image URL where present, password hash where password login is used, verification status, an optional marketing-email preference and its timestamp, session records, and account timestamps. Information you deliberately save to the account may include plan names and notes, festival or stop details, selected events and entries, origin airport, broad hotel-budget and cabin preferences, and travel notes. Passwords are stored as one-way hashes rather than readable passwords.

An account and external sign-in are optional; public planning remains usable without them. If you choose an account, the required email or provider identifier and authentication fields are necessary to create, identify, and secure it. PokerDesk cannot provide that account function without those required fields.

Account-saved series plans synchronize your selected entries and schedule-review choices across signed-in devices. We retain a snapshot of the series dates, venue, selected sessions and published buy-ins so you can view your own past-series plan history even when a public schedule is no longer available. These private plans do not establish that you attended an event or record your results. Existing device-only plans are imported only when you choose to save them to your account; subsequent edits to an account plan are saved automatically. A separate account-bound copy may be kept in your browser to protect unsynchronized edits. You can clear it using your browser's site-data controls.

Saved festivals and in-site reminders

When you mark a festival Interested while signed in, PokerDesk stores its identifier, when you saved it, and which of its in-site reminders you have read in your private account preferences. This lets you reopen My festivals and see reminders across signed-in devices. It does not register you for a festival, add tournament entries to your plan, or subscribe you to email or marketing messages. No browser push permission is requested. The private preview's browser-only choices are not imported.

You can remove a saved festival in My festivals; its saved interest and reminder-read state are then removed. These preferences are included in account-data requests and are removed with account deletion, subject to the recovery-backup treatment below. They are operational account data, not a new visitor-tracking or analytics record.

Google sign-in

When Google sign-in is available and you choose it, PokerDesk receives a stable Google account identifier, email address, email-verification status, and display name. These details identify and secure your PokerDesk account. For sign-in, PokerDesk does not receive your Google password, request access to Gmail or Google Drive, or retain Google access or identity tokens after sign-in. A matching email address alone does not link Google to an existing PokerDesk account.

Google processes the sign-in under the Google Privacy Policy. Signing in alone does not upload existing device-only tournament plans. Plans you have chosen to save to your account can be restored and synchronized after sign-in. To delete the PokerDesk account, follow the data deletion instructions.

Optional Google Sheets export

When this option is available, a signed-in PokerDesk user can deliberately request a new Google Sheet populated with the selected tournament entries, published schedule and buy-in information, and editable action-sheet calculations. Google asks for separate per-file permission (drive.file); sign-in alone does not grant it or export a plan. You choose the Google account that receives the new Sheet. Export permission does not create, switch or link your PokerDesk account, and is not marketing consent.

PokerDesk uses that permission only to create the requested file. It does not read your pre-existing files, make the Sheet public or synchronize it in the background. Provider tokens are used transiently to complete the request and are not stored or logged; PokerDesk does not request offline access or retain a refresh token. A one-use export request, its selected session identifiers and its session binding are held in server memory for up to ten minutes. The new Sheet is a separate copy held by Google under its privacy terms and remains there until you delete it. You can remove the authorization in your Google account connections; removing permission or deleting your PokerDesk account does not delete the Sheet.

Facebook and other external sign-in

When an external sign-in option is available and you choose it, the provider first processes the sign-in under its own privacy terms. For Facebook sign-in, PokerDesk may receive a stable Facebook user identifier, name, and email address if Facebook supplies it. PokerDesk uses that information to create or identify the account you requested. It does not silently attach a provider identity to an existing PokerDesk account merely because the email address matches, and it does not retain the provider access token after sign-in. Facebook processes the sign-in under the Meta Privacy Policy.

Messages and privacy requests

If you email PokerDesk, it processes your address, message, delivery information, and related correspondence so it can answer, route, and document the request. Do not send passwords, social-login access tokens, payment-card details, passports, or other unnecessary sensitive information.

Optional Twitch streams and chat

On the Watch page, Twitch video and chat connect only when you choose to load them. Twitch then receives connection information such as your IP address and may use its own cookies or signed-in account. PokerDesk does not receive your Twitch password or store your chat messages. You can unload Twitch on that page; this removes the embeds but does not clear cookies already set by Twitch. Opening a Twitch link takes you to Twitch directly. See the Twitch privacy notice.

Security and reliable operation

Limited request, error, health, authentication, and security records may be generated to deliver the service, diagnose failures, prevent abuse, and protect accounts. These records are operational logs, not advertising profiles, and are kept bounded and purpose-limited.

3. Why PokerDesk processes data

• To provide accounts, authentication, saved plans, and requested service-related support (GDPR Article 6(1)(b), where processing is needed for the requested service).
• To secure, maintain, troubleshoot, and improve the reliability of PokerDesk, prevent abuse, and establish or defend legal claims (Article 6(1)(f), legitimate interests).
• To comply with legal duties, respond to applicable privacy-rights requests, and answer valid authority requests (Article 6(1)(c)).
• To process optional analytics or marketing only after valid consent where consent is required (Article 6(1)(a)).

Where PokerDesk relies on legitimate interests, it limits the data and balances those interests against users' rights. You may object as described below.

4. Cookies and browser storage

You can remove local information through your browser's site-data controls. Doing so may remove a plan that has not been saved to an account, but the public schedule remains usable.

5. Analytics

PokerDesk keeps anonymous aggregate counts of eligible server-rendered public page views, grouped only by UTC day and canonical public page. The counter stores integer totals, not individual events, and does not store IP addresses, cookies, account identifiers, query strings, exact request times or saved plans. A limited user-agent check transiently excludes recognized bots and separates marked quality-assurance requests; the user agent itself is not retained. No analytics cookie or browser storage is used by this page-view counter. The counts are not unique visitors or confirmed humans: repeated requests, unrecognized bots, cancelled requests or later rendering failures can count, while cached/client-only navigation and failed best-effort writes can be missed.

A separate country counter briefly uses the connection IP address supplied by our server proxy to look up an approximate country in a local database. The address is not sent to a geolocation service, retained by the counter, or linked to an account or plan. Only UTC day, country (or Unknown) and integer totals are stored, with marked tests separate. No city or precise location is collected. VPNs, proxies and database limitations can affect the country reported; it is not nationality or necessarily your physical location. Country reporting starts when this counter is activated and cannot reconstruct earlier traffic. IP Geolocation by DB-IP, using its Country Lite database under CC BY 4.0.

Separate daily aggregates count public-page requests claiming recognized AI bot identities, grouped by fixed bot and documented purpose, and document landings carrying a recognized AI-service referrer. Referrer URLs are inspected transiently only to select a fixed service category; the URL, path, query and any prompt are never retained. No referral follows you to another page or is linked to an account or plan. Bot claims and referrer headers can be forged or omitted; these counts do not prove human visitors, recommendations or bookings. Marked tests are separate. No IP address or raw user agent is retained and bot identity is not network-verified.

Daily aggregates are retained for 90 days in the active counter, with expired days removed on the next successful write to the corresponding counter (an AI bot or referred landing for the AI counter). Restricted continuity backups can contain older aggregate counts and are not used for ordinary reporting. Traffic from before collection started cannot be reconstructed. Account records and operational logs are not used as traffic measurement.

Separately, you can allow optional daily visitor counting. A first-party cookie remembers your choice for 180 days. Only after permission, a second cookie stores today's UTC date so normal repeat browsing and concurrent tabs count once that day. It is not a unique identifier and is not linked to page histories, countries, accounts or plans. The server keeps only daily integer totals, with tests separate. Rejecting or ignoring the choice does not restrict PokerDesk. You can withdraw through “Cookie settings” in the footer; this stops new attempts and removes the daily marker. An already-sent request can finish its anonymous count, but no response can restore a cleared cookie and no linkable event record exists.

Daily visitor figures estimate consenting browsers, not all visitors, devices or people. Cookies, JavaScript and cross-tab locking must work; blocked requests and uncertain delivery can reduce coverage because the daily attempt is not retried. Clearing cookies, private browsing, separate browsers or withdrawing and allowing again can count separately. Each new UTC day is independent; totals across days are browser-days, not unique people across a week or month. Browser clocks do not determine the counting day. No earlier unique-visitor history is reconstructed.

The legacy person-level product and marketing tracker remains disabled. PokerDesk does not issue analytics visitor identifiers, build advertising profiles, fingerprint devices, track people across unrelated sites, or collect precise location for analytics.

Allowing daily counting does not authorize product-usage or marketing measurement. Irreversibly anonymized aggregate statistics in restricted continuity backups may remain longer than the active reporting window.

Optional product-usage counts

A separate, optional choice allows aggregate counts of new local plans, new nonempty account plans (not updates), successfully created Google Sheets, copied plan or series links, and completed native shares, and clicks on hotel and partner-offer links. The choice lasts up to 180 days and is off unless you allow it. Declining does not restrict planning, sharing, accounts or exports. Change or withdraw it through “Cookie settings” in the footer, independently of visit counting.

The cookie banner offers Accept all, Reject optional, and Settings. Accept all permits both daily visitor counting and product analytics; Reject optional declines both without restricting the site. Settings lets you choose each separately. Existing permission for daily counting is not automatically extended to product analytics. Closing settings without saving does not grant permission. Earlier permission covering only plans, exports and shares is not extended to commercial clicks: we ask for a renewed product-analytics choice. Existing rejection remains effective.

A planning request contains only the fixed action and public series ID. A hotel or partner click request contains only its published hotel or offer key and a fixed placement category (series, destination, offer or pricing button), never its URL. The server groups counts by UTC day/month, public series and its published destination binding, not your location. It retains integer totals, not individual events, account identifiers, selected entries, buy-ins, share URLs, sheet contents, IP addresses or request headers for this measurement. Commercial counts group only by published hotel/offer, placement and a registered hotel destination, not a visitor's trip or location. Marked tests are separate. Daily product aggregates last 90 days; monthly aggregates last 36 months, with expired buckets removed on the next successful write. Reporting cannot reconstruct usage before collection began.

A bounded browser-only marker avoids counting ordinary edits, reloads or concurrent tabs as another local plan start. Existing plans are not counted when loaded or when permission is granted. Account-plan and Sheet counts require confirmed successful operations and current permission; they do not inspect private account history for analytics. Native share completion does not prove recipient delivery. These separate metrics are not summed into unique people or plans, attendance, bookings or revenue. Link clicks are attempts to open an offer, not proof of arrival, a booking, a purchase or earned commission. Repeated activations can count again; opening a link through a browser context menu may not be measured. No historical clicks are reconstructed.

Counts cover consenting, supported activity only. Blocked storage, unavailable locks, failed best-effort writes and uncertain delivery can miss activity; attempts are not automatically retried. Clearing storage, allowing again or using another browser can duplicate counts. Withdrawal stops new and queued browser attempts and clears only the measurement marker, not saved plans. An already-dispatched anonymous count may finish; no individual event record exists to identify or remove from those aggregate totals. Product permission is not permission for marketing, advertising profiles or tracking across unrelated sites.

6. Service providers, external sites, and transfers

Personal data is available only to MN River Invest GmbH and service providers that need it to host, secure, authenticate, maintain, or communicate for PokerDesk, and to public authorities where disclosure is legally required. Providers are required to protect the data where applicable.

PokerDesk uses Hostinger Email Services for company email. Hostinger processes sender and recipient details, message and delivery metadata, and message content to deliver and store correspondence. If you choose Google, Facebook, or another external sign-in, that provider also processes the sign-in under its own notice before sending the approved account details to PokerDesk.

Some tournament-source, travel, activity, training, calendar, and other links take you to independent third-party sites. A travel link may include the destination, origin airport, and travel dates shown or selected so the third party can open a relevant search. The site also receives the information a browser normally sends when you open it and applies its own privacy notice. PokerDesk does not send your full personal tournament plan merely because you open an external link.

If a provider processes personal data outside the European Economic Area, PokerDesk uses an applicable lawful transfer mechanism where required, such as an adequacy decision or contractual safeguards. You may contact PokerDesk for information about the safeguard relevant to your data.

7. How long data is kept

• Browser-local plans and preferences remain until you clear them or their saved version is replaced.
• Account and saved-plan data is kept while needed to provide the account, then deleted or anonymized after a valid deletion request, subject to necessary legal exceptions.
• Account sessions expire after no more than 30 days; external sign-in attempt cookies expire after no more than 10 minutes.
• Correspondence is kept only as long as needed to handle the request, meet a legal duty, or establish, exercise, or defend a legal claim.
• Operational and security records are minimized and retained only as long as needed for their security or reliability purpose.

Restricted continuity backups are not used for ordinary product activity. If data that was validly deleted is present in a backup that cannot immediately be altered, the deletion must be re-applied before restored data is returned to ordinary use, subject to any overriding legal retention duty.

8. Your choices and rights

Subject to applicable conditions, you may request access, correction, deletion, restriction, or portability of your personal data, and object to processing based on legitimate interests. You may withdraw consent at any time without affecting processing that was lawful before withdrawal. PokerDesk may ask for proportionate information to verify that a requester is entitled to act for the account.

Send requests to privacy@pokerdesk.io. See the data deletion instructions for the shortest deletion route. You may also complain to the Austrian Data Protection Authority or another competent supervisory authority.

9. Automated decisions and data minimization

PokerDesk does not make decisions with legal or similarly significant effects about users through automated processing. The current service does not ask for payment-card or bank details, passport data, or precise location. Sharing a plan is an explicit user action; plans are private by default.

10. Changes to this notice

PokerDesk will revise the effective date and the relevant explanation before materially changing how it processes personal data. A fresh choice will be requested where the change legally requires one.