Privacy policy

This Privacy Policy explains how LynxPoker, LLC ("Company," "we," "us," or "our") collects, uses, stores, shares, and protects personal data in connection with this website (lynx.poker), the LynxPoker web application, the LynxPoker players app, the club websites published with LynxPoker, and related services (the "Service").

The Service is operated by LynxPoker, LLC, a United States company, with its team based in Israel.

2.1 When we act as data controller

LynxPoker, LLC is the Data Controller for:

• Staff Account Data: information provided by tournament staff when creating and using their LynxPoker accounts.
• Players App Account Data: the account, profile and settings of anyone who signs up in the LynxPoker players app.
• Technical Data: data collected automatically for security, performance, and product improvement.
• Newsletter Data: the email address of anyone who signs up for our newsletter.

2.2 When we act as data processor

LynxPoker, LLC is the Data Processor for:

• Player Data: data about tournament players that a club (the "Customer") or its staff enters into the Service.
• Club Site Messages: messages that visitors send through the contact form of a club website.

The Customer (the club) is the Data Controller for that data, and we process it only on the Customer's behalf and instructions. Questions about the data a club keeps about you go to that club. Your own players app account is ours: we answer for it directly.

3.1 Staff account data (controller)

3.2 Players app account data (controller)

3.3 Player data (processor — on behalf of the customer)

Player Data is entered and controlled by the Customer. Players with questions about this data should contact the club directly.

3.4 Technical data (controller)

3.5 Emails and club site messages

• Newsletter (Controller): your email address, the page you signed up on and the site language, used only to send you the newsletter. You can unsubscribe from any newsletter email.
• Product Tips (Controller): when you sign up as club staff, we may email you tips about LynxPoker. You can opt out at any time through the link in any of those emails or by writing to us.
• Club Site Messages (Processor): the name, email, optional phone and message a visitor sends through a club website's contact form. They are delivered to the club and kept for the club. To stop spam, the form runs Cloudflare Turnstile, and we keep only a one-way code made from the sender's IP address, never the address itself.

3.6 Is giving data required?

No law requires you to give us personal data. Some data is needed to provide the Service: without an email address and a sign-in you cannot have an account, and without billing details a club cannot buy a plan. Everything else is voluntary: a profile photo, a home city, your location, notifications, analytics and the newsletter. If you do not give it, the Service still works; only that feature is not available to you.

4.1 Under GDPR (EU/UK users)

• Performance of a Contract (Art. 6(1)(b)) — Staff Account Data and Players App Account Data.
• Consent (Art. 6(1)(a)) — analytics cookies and session replays for visitors in the EU/EEA/UK area, analytics in the players app, your location, push notifications, and the newsletter. You can withdraw consent at any time, as Section 12 describes.
• Legitimate Interests (Art. 6(1)(f)) — security and fraud prevention; outside the EU/EEA/UK area, analytics, with an opt-out at any time; product tips emails to club staff who sign up, with an opt-out at any time; and crash reports from the mobile apps, so a fault that stops the app working can be found and fixed quickly. Crash reports carry no name, email or account, only a random identifier for the app install (see Section 12).
• Legal Obligation (Art. 6(1)(c)) — where required by law.
• Processor Obligation (Art. 28) — Player Data and Club Site Messages, on behalf of the Customer.

4.2 Under Israeli law

We process personal data in accordance with the Israeli Privacy Protection Law 5741-1981 and its regulations. This policy tells you the purposes for which your data is used, who receives it, and whether you must give it (Section 3.6).

1. Providing the Service: Account management, authentication, tournament features, real-time sync, support.
2. Security and Fraud Prevention: Monitoring for unauthorized access, investigating incidents.
3. Performance and Reliability: Diagnosing issues, optimizing performance.
4. Product Improvement: Analyzing usage patterns.
5. Communications: Transactional emails; product tips to club staff who sign up, which you can stop at any time; and, if you sign up for it, the newsletter.
6. Legal Compliance: Fulfilling legal obligations, responding to lawful requests.

6.1 We do not sell personal data

We do not sell, rent, or trade personal data to third parties for their marketing purposes.

6.2 Service providers

We share data with the following service providers, bound by contract (Data Processing Agreements) to process it only for the purposes we specify:

• Google LLC — Firebase Authentication for sign-in; Google Cloud Storage for profile photos and club logos; Google Analytics 4 and Google Ads conversion measurement on this website and the web app; Firebase Analytics and Firebase Crashlytics in the players app (only after you opt in; Firebase Analytics gets your account ID); Google Maps Places, which receives the address a club types into the web app's address search; Google Fonts, which the web app and club websites load from Google's servers, so Google receives your IP address; and, on Android phones, the city name for a near-me search. Google's privacy policy: https://policies.google.com/privacy
• PostHog, Inc. — product analytics, stored in PostHog's EU cloud: events and session replays in the web app, where signed-in staff are identified by email and name; events in the players app, only after you opt in, identified by account ID and email; and events from our servers, with IDs and counts only.
• Functional Software, Inc. (Sentry) — error and crash reports (error details, without message contents) from the web app, the backend and the mobile apps, stored in Sentry's EU (Germany) region.
• Render Services, Inc. — hosting of our servers and databases, in the United States (Oregon).
• Cloudflare, Inc. — hosting of this website and of club websites, custom domains and their certificates, and the Turnstile anti-spam check on club website forms.
• Resend — delivery of account emails, the newsletter, and club website messages.
• Payment processor — Stripe, for plan and credit payments.
• Expo (650 Industries, Inc.) — delivery of push notifications to your phone, through Apple Push Notification service or Firebase Cloud Messaging.
• Apple Inc. — Sign in with Apple, push notifications to Apple devices, and, on iPhones, the city name for a near-me search.
• Adobe Inc. — fonts the web app loads from Adobe Fonts, so Adobe receives your IP address.
• Google (YouTube) and Vimeo, Inc. — videos a club chooses to show on its club website. They load only from youtube-nocookie.com and with Vimeo's do-not-track setting, and the provider receives your IP address when the video loads.

6.3 Legal requirements

We may also disclose data when required by law, pursuant to a valid legal request, or to protect the rights, property, or safety of LynxPoker, our users, or others.

Our servers are in the United States, and our team is in Israel. Israel has been recognized by the European Commission as providing an adequate level of data protection (Commission Decision 2011/61/EU). Where data is transferred to countries without an adequacy determination, we implement Standard Contractual Clauses (SCCs).

We implement appropriate technical and organizational measures including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Access controls and role-based permissions
• Regular security assessments and monitoring
• Secure software development practices
• Incident response procedures

• Staff Account Data: Kept while your account is open, and deleted when you ask us to delete it.
• Players App Account Data: Kept until you delete your account. Deletion takes effect at once: your account and profile, your photos, your club connections and tournament registrations, your sign-in (Firebase Authentication, and the Sign in with Apple link), your contact at our email provider, and your profile and events at PostHog are deleted, and your devices' push tokens are unlinked from you. Records a club keeps about the tournaments you played stay with that club (Section 3.3). If the same email also runs a club on LynxPoker, only the players app profile, photos, club connections and registrations are removed, so the club's account is not lost. Copies in our hosting provider's database backups expire on their own.
• Player Data: Kept while the club's account is open. The club can change or delete it at any time, and it is deleted when the club's account is deleted.
• Billing Details: Kept with the club's account. Stripe keeps payment and invoice records for as long as payment and tax law require.
• Club Site Messages: Kept until the club deletes them or its account.
• Newsletter Data: Kept until you unsubscribe.
• Analytics Data: Kept until you delete your account or ask us to delete it. Google Analytics also deletes old data under the retention setting of our account there.
• Marketing Attribution Data: The campaign and ad click that brought you, saved with your account when you sign up, and only if you allow analytics. Kept with your account and deleted with it. Before you sign up, your browser keeps it for this visit and, for up to 90 days, only while you allow analytics.
• Crash Reports (Sentry): Sentry deletes them after 90 days.
• Free Trial Record: We keep a hashed copy of a club owner's email address and of a random browser id the app stores. We keep this record even after the account is deleted, and use it only to allow one free trial per owner, email address and browser.

10.1 GDPR (EU/UK residents)

Right to access, rectification, erasure, restriction, data portability, objection, consent withdrawal, and to lodge a complaint with your local supervisory authority.

10.2 Israeli law

Right to access, correct, and request deletion under the Privacy Protection Law 5741-1981.

10.3 Exercising your rights

The Service is not intended for individuals under 18. We do not knowingly collect data from children. If you believe a child has provided data to us, contact us immediately.

12.1 Essential cookies

Required for authentication, session management, and security. They cannot be turned off because the Service cannot work without them.

12.2 Analytics on this website and the web app

We use Google Analytics 4 (GA4) on this website and the web app, and PostHog in the web app, to measure how visitors find and use LynxPoker.

• In the EU/EEA/UK area (we tell from your browser's time zone), analytics is off until you select "Accept" in the cookie bar.
• Everywhere else, analytics is on unless you select "Opt out" in the cookie bar.
• Your choice is saved in your browser and applies on every later visit. You can change it at any time with "Cookie settings": at the bottom of every page of this website, and in the web app on its public pages and your Profile page.
• While analytics is off, Google Analytics stores no cookies on your device and receives only signals without any identifier, which Google uses to estimate total numbers.
• In the web app, PostHog does not start in the EU/EEA/UK area until you accept, and does not start if you decline. Elsewhere it runs unless you opt out.

What analytics collects:

• Client identifier — a random ID in the _ga / _ga_* cookies that lets GA4 recognize a returning browser
• User ID — after sign-up, the web app's own Google tag attaches your Firebase user identifier as the GA4 user_id, an opaque identifier, not your email or name; PostHog identifies signed-in staff by email and name
• Event data — page views, button clicks, sign-up, log-in, plan choice and checkout, plan and credit purchases, plan changes, and poster QR scans
• Marketing source — UTM parameters and ad click identifiers (such as the Google Ads click ID) on inbound links. If you sign up and have allowed analytics, the web app saves them with your account, together with the page you first landed on and the website you came from. Without that permission, they are not saved: they only travel in the link to the web app for that visit
• Cross-domain session — the website (lynx.poker) and the web app (app.lynx.poker) share analytics state, so a visit and a sign-up count as one journey
• Session replays — in the web app, PostHog records the screen layout, clicks and scrolling, with all text and every input masked and images hidden

Google signals: for visitors signed in to a Google account with ads personalization on, GA4 can add aggregated demographic and cross-device reports. We see them only in aggregate. You can turn this off for every site at https://myadcenter.google.com, or for our sites by declining or opting out in the cookie bar.

12.3 Players app analytics and crash diagnostics

The players app uses PostHog, Firebase Analytics and Firebase Crashlytics only after you opt in inside the app; until then nothing is collected. When you are signed in, both PostHog and Firebase Analytics get your account ID, and PostHog also gets your email. You can withdraw consent at any time from the app, via your profile settings or the analytics link on the sign-in screen: analytics collection stops at once, and Crashlytics from the next time the app starts. The app does not collect the advertising ID (GAID / IDFA), and there is no cross-app tracking.

12.4 Mobile app crash reports

Separately from the opt-in analytics above, the mobile apps send a report to Sentry when the app crashes, or when a screen hits an error and shows the app's error screen instead, so we can find and fix the fault. These reports are sent from every install and are limited to what is needed to fix the fault:

• the error message and where in the app it happened (stack trace),
• the app version and the app update it was running,
• the device model and operating system version,
• a random identifier for the app install,
• the last requests the app made before the fault, as addresses only, without their parameters.

They do not contain your name, email, LynxPoker account identifier, IP address, device name, screenshots, or what you typed or tapped. They are not used for analytics, advertising, or to build a profile of you, and are deleted within 90 days.

12.5 Advertising and Google Ads

We advertise LynxPoker on Google Ads. On this website and the web app we use Google Ads conversion measurement and Google's ad cookies (ad storage and ad user data) only to measure whether an ad led to a sign-up, a first tournament or a payment. We do not use ad personalization or remarketing: we tell Google that ad personalization is always denied, so your visit is never used to show you ads elsewhere. The cookies follow the same choice as analytics:

• In the EU/EEA/UK area (we tell from your browser's time zone), they are off until you select "Accept" in the cookie bar.
• Everywhere else, they are on unless you turn them off with "Opt out" in the cookie bar.
• When they are off, we tell Google that ad storage and ad user data are denied. You can change your choice at any time with "Cookie settings".

When a sign-up, a first tournament or a first payment happens, our servers send Google Analytics that event with the random browser ID (client_id) your browser had, your club's internal ID and, for a first payment, the amount and currency, so Google Ads can match it to the ad. If you are signed in and later decline in "Cookie settings", the web app asks our server to delete the stored browser ID, so no further events are sent for your account. We do not use tracking pixels from other ad networks.

EU/UK residents may also lodge a complaint with their local Data Protection Authority.

Material changes will be communicated at least thirty (30) days before taking effect. Continued use constitutes acceptance.