Privacy policy

Solving happens on your device

Strategy solving runs in your own browser or phone (WebAssembly / native engine). The boards, ranges and solutions you study never leave the device and are not uploaded to us.

Training stats, the mistake book and custom drills are stored in local browser storage only. You can inspect, export or delete all of it in Settings → Data & privacy.

Account data we store

Account: email address, a password hash (never the password itself), whether the address is verified, and the signup date. If you sign in with Google or Apple we also store that provider’s user identifier so you resolve to the same account next time.

Hands you choose to save: when you save or import hands, or turn on automatic upload, the hand history and any available per-decision scores reach us. They are what the leak report is built from.

Usage counters: monthly counts of cloud saves and AI coach calls, and daily library training hands, used to enforce plan limits.

Subscription: for a subscription bought on the web, Stripe customer and subscription identifiers. For one bought in the iOS or Android app, payment is handled by Apple or Google, and RevenueCat applies the subscription to your account (see Third parties). Either way, we never see or store your card details.

Third parties

Stripe — payments and subscription management for subscriptions bought on the web.

Apple (App Store) / Google (Google Play) — payment processing for subscriptions bought in the iOS or Android app. We never see your card details.

RevenueCat — subscription infrastructure for the iOS and Android apps. It receives the App Store or Google Play purchase records together with your account’s user id, so the subscription can be applied to your account.

Google Analytics — traffic and feature-usage measurement on the website and web app, only after you accept (see “Cookies and analytics on the web” below).

Google Analytics for Firebase — usage measurement in the iOS and Android apps, on by default and switchable off in the app (see “Analytics in the iOS and Android apps” below).

Anthropic (Claude) — the AI coach. It receives the board, your hand, the available actions and their EVs; it does not receive your email or account identifier.

Resend — verification and password-reset email.

Google / Apple — authentication, if you choose to sign in with them.

Beyond these processors we do not sell, rent, or share your data for advertising.

Retention and deletion

Account data is kept while the account exists. In Settings → Data & privacy you can delete every saved hand, or delete the account itself — which also removes saved hands, usage counters and entitlements, and cancels an active subscription bought on the web. A subscription bought in the iOS or Android app is not cancelled by deleting the account: cancel it in your Apple or Google account first, or it will keep renewing. Neither deletion can be undone.

Local data is entirely yours: clear it from the settings screen, or by clearing site data in your browser.

Cookies and analytics on the web

On the website and the web app, analytics is off until you say otherwise. On a first visit, Google Consent Mode v2 sets every category to denied, and no analytics cookie is written. Google Analytics (GA4) only starts once you accept on the banner. The iOS and Android apps work differently; see the next section.

After that it sets first-party cookies (_ga, _ga_*) and records the page path, referrer, approximate location and device type. What Analytics receives never includes your email, an account identifier, or any hand data — solving and training happen on your device to begin with.

No advertising, no cross-site ad tracking, and nothing fed into advertising audiences.

You can change your mind at any time. On the site, “Cookie settings” in the footer reopens the banner; in the web app, Settings → Data & privacy → Anonymous usage analytics. Choosing essential-only, or switching it back off, also deletes the _ga cookies already written.

With Do Not Track enabled in your browser, neither the site nor the web app loads the analytics script, and neither shows you the banner.

The site (vipergto.com) and the web app (app.vipergto.com) report into the same Google Analytics property, but each asks for consent on its own, so a choice made on one does not carry to the other.

Your session token lives in localStorage, not in a cookie.

Analytics in the iOS and Android apps

The iOS and Android apps measure usage by default, with an off switch. Unlike the website and the web app, they do not ask first. They use Google Analytics for Firebase to record which screens are opened and when a solve finishes.

Measurement uses an app-instance identifier generated by the Firebase SDK. The apps do not use the advertising identifier (no IDFA on iOS, no Android Advertising ID), and they set no user id or account id.

What Analytics receives never includes your email, hand histories, boards, ranges, or anything you type. Ad storage, ad personalisation and ad user data are all turned off. As part of Analytics processing, Google may derive an approximate location from your IP address.

To turn it off, open Settings → Legal → Anonymous usage analytics in the app. Switching it off stops measurement and deletes the analytics identifier on that device.

Contact

For any question or request about your data, write to hi@vipergto.com.