Effective date: August 26, 2026

Privacy Policy

ChipClimb (“we”, “us”, or “our”) is a poker session tracker built for individual grinders. This policy explains what data we collect, why we collect it, and how you can control it.

Who is responsible for your data

ChipClimb is based in Ontario, Canada, and is the data controller for the purposes of applicable privacy law — meaning we decide what data is collected and why, and we are accountable for how it is handled. For any privacy question, request, or complaint, contact chipclimb@gmail.com. We answer privacy requests at that address.

1. Data We Collect

Account data

• Email address — used to log you in and send transactional emails.
• Display name — shown on the leaderboard and to friends (only if you opt in).
• Password — stored as a salted hash by Supabase Auth. We never see it in plain text.

Session & bankroll data

• Poker sessions you log: date, game type, stakes, buy-in, cash-out, hours, venue, notes.
• Bankroll entries and transaction history.
• Opponent notes and tendencies you record.

Social & rank data

• Friend connections (only if you initiate them).
• Rank snapshots computed from your sessions — shared on the global leaderboard only if you opt in.
• Achievement unlocks.

Payment data

• Payments are handled entirely by Stripe. We store only your Stripe customer ID — never your card number, CVV, or billing address. Stripe's privacy policy applies to payment data.

Usage data

• We do not run any analytics or product-tracking tool. There is no Google Analytics, no advertising pixel, and no cross-site tracking of any kind.
• Standard server logs (IP address, browser type, timestamp) are generated by our hosting provider as a normal part of serving the site.
• Security events. We keep a record of security-relevant actions on your account — sign-in attempts, password changes, rate-limit blocks, and rejected file uploads. Each entry stores the event type, your account ID, a shortened version of your IP address (not the full address), your browser type, and the time. We use it only to detect and investigate attacks on accounts, and we delete these records after 90 days. We deliberately do not record which email address was used in a failed sign-in, because that record would itself be a list of accounts worth attacking.

AI scan data

• When you use the screenshot scanner, your image is sent to Anthropic's API to be read. We never store the image — it is held in memory only for the length of the request and is never written to our database or file storage.
• Anthropic acts as our service provider for this processing. Under their commercial terms, the images and results we send are not used to train AI models. Their retention periods and trust-and-safety exceptions are set by Anthropic and are outside our control — see their privacy policy for the current terms.
• You are responsible for what you upload. You must have the right to submit any image you scan, and you should not upload images containing other people's personal information, identity documents, or full payment card details. We cannot control what an image contains before you send it, and anything visible in the image is transmitted to our AI provider along with the rest of it. If you upload a screenshot by mistake, delete the resulting session and no copy of the image remains with us.

2. How We Use Your Data

• To provide and improve the ChipClimb app and its features.
• To authenticate you and keep your account secure.
• To compute your rank and display it on the leaderboard (only with your opt-in).
• To process subscription payments and manage your Pro status.
• To send transactional emails (account confirmation, password reset). We do not send marketing emails.

3. Data Sharing

We do not sell your data. We share it only with the services required to operate ChipClimb:

• Supabase — database and authentication hosting.
• Vercel — application hosting and content delivery.
• Stripe — payment processing.
• Anthropic — AI image processing for the screenshot scanner.

Other users can see your display name on the leaderboard and as a friend only if you have explicitly enabled discoverability or opted in to the leaderboard. Your session details, bankroll, and notes are never shared with other users.

4. Where Your Data Is Processed

ChipClimb is operated from Ontario, Canada, but the services we rely on to run it are based in the United States. This means your information is transferred outside Canada and stored and processed in the United States.

• Anthropic (screenshot scanning) — processes data in the United States.
• Stripe (payments) — processes data in the United States.
• Vercel (hosting) — serves the site from a global network of edge locations, so requests may be handled in whichever region is closest to you.
• Supabase (database, accounts) — stores your account and session data in the United States (Ohio).

While your information is in the United States it is subject to United States law, and may be accessible to US courts, law enforcement, and national security authorities under lawful process — regardless of where you live. By using ChipClimb you consent to this transfer.

If you are located outside Canada, note that your information is also handled by us in Canada and is subject to Canadian law.

If you are in the EEA, UK, or Switzerland. Transferring personal data from your region to the United States requires a specific legal safeguard. We rely on the data processing agreements we hold with each provider named above, which incorporate the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. You can request details of the safeguards that apply to your data by emailing us.

5. Data Retention

Your data is stored for as long as your account is active. You can delete your account at any time from Settings → Delete Account, which permanently removes all your sessions, bankroll entries, notes, and profile data from our database. This action is irreversible.

Two things have their own retention period. Security event records (described above) are deleted after 90 days. Billing records held by Stripe are kept for as long as tax and accounting law requires, which is outside our control. Deleting your account removes your data from ChipClimb; it does not erase invoices Stripe is legally required to retain.

6. Security

All data is transmitted over HTTPS. Your session and bankroll data is protected by row-level security policies in our database — no other user can query your data, and our application enforces this at the database layer, not just the API layer. Passwords are never stored in plain text.

7. If There Is a Data Breach

No system is perfectly secure. If we discover a breach of security safeguards affecting your personal information, and it creates a real risk of significant harm to you, we will notify you directly by email as soon as feasible, and we will report the breach to the Office of the Privacy Commissioner of Canada as required by law. Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach.

Our notice will describe what happened, what information was involved, what we have done in response, and what you can do to protect yourself. We also keep an internal record of security incidents, whether or not they trigger a reporting obligation.

8. Automated Ranking

Your rank is calculated automatically. Software reads the sessions you have logged — buy-ins, cash-outs, stakes, and hours — and places you in a tier and stake bracket using fixed thresholds. No person reviews this, and no data beyond your own logged sessions is used.

Ranking affects only your position in the app and on the leaderboard if you have opted in. It has no legal effect, does not affect your access to features you have paid for, and is not used to make decisions about you outside ChipClimb. If you believe your rank is wrong, you can correct or delete the underlying sessions at any time, or contact us to have it looked at.

9. Disclosure Required by Law

We may disclose your personal information without your consent where we are legally required or permitted to do so — for example in response to a court order, subpoena, search warrant, or other valid legal process, or where disclosure is necessary to investigate a suspected violation of our terms, to protect the rights, property, or safety of ChipClimb, our users, or the public, or to establish or defend a legal claim.

Because our providers operate in the United States, your information may also be subject to lawful access requests from United States authorities, as described above. Where we are legally permitted to tell you about a request for your data, we will.

10. Your Rights

You have the right to:

• Access — export or view all data associated with your account.
• Correct — update your display name, email, or session data at any time.
• Delete — permanently delete your account and all associated data.
• Opt out — disable leaderboard visibility, discoverability, and stat sharing at any time in Settings.

To exercise any of these rights or request a data export, email us at chipclimb@gmail.com.

11. Cookies

ChipClimb uses a single session cookie to keep you logged in, plus local browser storage for your theme and selected bankroll. We do not use advertising cookies, tracking pixels, or third-party analytics cookies of any kind.

Regional availability. Our hosting provider derives an approximate country of origin from the network address of each incoming request and supplies it to us as a two-letter country code. We evaluate that code at the moment the request is received, for the sole purpose of determining whether the service is available in your territory, and we do not record it, associate it with your account, or use it for analytics, personalisation, or any other purpose. ChipClimb is not currently offered to residents of the European Economic Area or the United Kingdom, as we do not presently maintain the local representation those regimes require of providers established outside them. Requests originating from those territories are declined at the point of access. Where a request is declined, no account is created and no personal information is retained.

12. Links to Other Sites

ChipClimb links out to services we do not control — our payment provider, the privacy policies of the providers listed above, and venue information on third-party maps. If you follow one of those links, that site's own privacy policy governs what it collects, not this one. We are not responsible for the content or practices of sites we do not operate, and we would encourage you to read their policies before providing them with information.

13. Children

ChipClimb is not directed at anyone under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it promptly.

14. Changes to This Policy

We may update this policy as the app evolves. Material changes will be noted by updating the effective date above. Continued use of ChipClimb after changes constitutes acceptance.

15. Contact

Questions about this policy? chipclimb@gmail.com

16. Accessibility

ChipClimb should be usable by everyone, including people who navigate by keyboard, use a screen reader, need larger text, or find low-contrast text hard to read. We treat accessibility problems as bugs, not as feature requests.

The standard we target. We aim for WCAG 2.1 Level AA, the standard referenced by the Accessibility for Ontarians with Disabilities Act, by United States Department of Justice settlements under the Americans with Disabilities Act, and by the European Accessibility Act.

What currently conforms. Verified by testing every page in the application, in both light and dark themes, at mobile and desktop widths:

• Text and background colours meet the 4.5:1 minimum throughout
• Every form field has a programmatic label
• Every image has alternative text, and decorative images are marked as such
• Every button and link has an accessible name
• Headings run in order without skipped levels
• Keyboard focus is always visible — a gold outline at 9.8:1 contrast
• A skip link lets keyboard users jump past the navigation
• Pages reflow to 320px with no horizontal scrolling
• Profit and loss carry +/− signs, so meaning never depends on colour alone
• Animation is reduced for anyone whose system asks for reduced motion

Known limitations. We publish these rather than claim conformance we have not reached:

• The venue globe is visual. The 3D map renders to a canvas, which assistive technology cannot describe. The same information is available as text: the venue search on that page is fully keyboard operable, and every session and venue is listed on the Sessions page.
• Some labels are small. A few badges and captions render at 8–9px. They meet contrast requirements, and browser zoom scales them, but they are smaller than we would like and we are increasing them.

How we test. Automated contrast, labelling, heading-order and reflow checks run against every page in both themes and at both widths. Automated testing catches roughly a third of accessibility problems, so reports from people actually using the service matter more than our own results.

Tell us about a problem. If any part of ChipClimb is difficult or impossible for you to use, email chipclimb@gmail.com. Tell us the page and what went wrong — you do not need to know the technical cause. We aim to acknowledge within 3 business days and to give you either a fix or a timeline. If something blocks you from using a feature you have paid for, say so and we will prioritise it.