Introduction

OnTheButton ("we", "our", or "us") is a bookkeeping and coordination platform for private, recreational home poker games. This Privacy Policy explains what personal information we collect, how we use it, and the rights you have over it — including under Singapore's Personal Data Protection Act (PDPA) and, for users in scope of it, the EU/UK General Data Protection Regulation (GDPR).

Information We Collect

Account Information

When you create an account, we collect:

• Full name (first and last name)
• Email address
• Optional settlement-display handles (PayNow, Venmo, CashApp, Zelle) — shown to other members so they know where to send money directly; we never process or move this money ourselves
• Profile photo (optional)

Game & Card Room Records

When you participate in a card room (club), we collect:

• Game participation records (which games you joined, and which card room)
• Buy-in and cashout amounts, as recorded by hosts/admins for bookkeeping — not processed as a payment by us
• Game statistics (games played, net result over time)
• Strike and suspension records, where a card room uses that feature

Vehicle Licence Plates

Some card rooms are in buildings whose security desk needs a list of expected vehicles. Where a card room has turned this on (it is available only on paid plans), you may be asked for your vehicle licence plate when you join a game, and you may save one or two plates to your profile so you do not have to retype them.

• Providing a plate is optional — you can join a game without answering
• Plates you answer for a game are visible only to that card room's owner, who uses them to give the building's security desk a parking list
• Plates saved to your profile are stored against your account rather than a single card room, so they are available to you across every card room you belong to. A saved plate is never submitted to a card room on your behalf — only a plate you actually answer with is shared
• You can change or remove your saved plates at any time from your profile

Billing Information (Pro subscriptions)

If a card room upgrades to a paid plan, payment card details are collected and processed entirely by Stripe, our payment processor — we never see or store your full card number. We retain only the subscription status and Stripe's customer/ subscription identifiers needed to administer billing.

Authentication Data

We use secure credential-based authentication with hashed password storage (bcrypt), and support signing in with Google. Your password is never stored in plain text and cannot be recovered (only reset).

We do not record login timestamps, and we do not keep server-side session records — your signed-in state is held in a signed cookie in your browser rather than in our database. We record your IP address in one situation only: when you request deletion of your account, it is stored alongside that request in our audit log.

How We Use Your Information

We use your information to:

• Manage your account and authenticate your identity
• Organize and coordinate poker games within your card room(s)
• Track game participation and financial records for bookkeeping
• Send notifications about games, suspensions, billing, and account status
• Generate statistics, leaderboards, and season standings
• Administer subscription billing, where applicable
• Communicate with you via email

Information Sharing

We do not sell your personal information. We share it only:

• Within your card room: your name, profile photo, and game statistics are visible to other members of the same card room — never to members of a different one.
• Service providers: Mailgun (email delivery), Railway (hosting), Stripe (subscription billing, if applicable), and Umami (cookieless website statistics — aggregate counts only, no personal data). These providers process data on our behalf to provide their services, under their own privacy and security commitments.
• Legal requirements: if required by law, or to protect our rights, safety, or the safety of others.

Data Security

We implement reasonable security measures, including bcrypt password hashing, HTTPS for all traffic between your browser and this service, server-side validation, and access controls restricting administrative functions to authorized roles. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Retention & Deletion

We retain your account information and game history for as long as your account is active, and for a reasonable period after to preserve the accuracy of other members' game records (buy-ins, cashouts, and results that reference you stay consistent for everyone else in the ledger).

You can export your own data yourself. Your profile page has an export link, and a fuller machine-readable export of your personal data — your profile, game participation, buy-ins and cashouts, strikes and suspensions, notification preferences, and the audit-log entries about you — is available in JSON. Exports cover your own data only; they never include credentials.

Account deletion is a contact-based process. You may request deletion of your account at any time by contacting an administrator of your card room, or us at the address below. On request, we anonymize your identifying information (name, email, photo, settlement handles) while keeping the underlying game records intact so other players' history and totals stay accurate. A self-service deletion feature exists in our codebase but is switched off and has no in-product route to it, so it is not available to you today; if that changes, this policy will be updated. There is also no self-service "leave a card room" control — ask an administrator of that card room.

Your Rights — PDPA (Singapore)

Under Singapore's Personal Data Protection Act, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate personal data
• Withdraw consent to our collection, use, or disclosure of your data, subject to legal or contractual restrictions
• Request deletion of your account, per the process above

Data Protection Officer contact: dpo@meridianrock.sg.

Your Rights — GDPR Basics

If you are located in the EU/UK, we process your data on the basis of contract (to provide the Service you signed up for) or legitimate interest (e.g. account security). You additionally have the right to:

• Rectification of inaccurate data
• Erasure ("right to be forgotten"), subject to the record-keeping limits described above
• Data portability (an export of your data in a structured format)
• Object to processing based on legitimate interest
• Lodge a complaint with your local supervisory authority

EU/UK representative (Art. 27 GDPR / UK GDPR): we have not appointed one. OnTheButton is operated from Singapore. If our user base brings us within the Art. 27 requirement, we will appoint a representative and update this policy.

Children's Privacy & Local Law

Our service is not directed at children, and we do not knowingly collect personal information from children. You are responsible for complying with the applicable laws in your own jurisdiction, including any minimum-age or other eligibility requirements that apply to you where you live. If you believe we have collected information from a child, contact us immediately and we will investigate and delete it.

International Transfers

OnTheButton is operated from Singapore. If you access the Service from outside Singapore, your information may be transferred to and processed in Singapore and in the jurisdictions of our service providers (Mailgun, Railway, Stripe, Umami). By using the Service, you consent to this transfer.

Cookies

We use essential cookies to keep you signed in and to provide core functionality. The sign-in cookie is persistent, not session-only: it lasts up to 30 days, so you stay signed in between visits until it expires or you sign out. We do not use advertising cookies or third-party tracking cookies.

For website statistics we use Umami, a cookieless analytics service. It sets no cookies and does not track you across websites. Each page view sends the page address, the page title, the address of the page you came from, the site you are on, your browser's language, and your screen size. As with any request to any website, the service also receives your IP address and browser identification, and derives your approximate country, browser and device type from them; the provider states that it anonymises this data and stores no personally identifiable information. It never sends your name, your email, or your account — we do not connect these statistics to your identity. Page addresses that contain a one-time link (for example a password-reset or guest-claim link) have that part removed before anything is sent, and the part of an address after a “?” is never sent at all.

As with any request your browser makes to any website, the request itself also reveals your IP address and browser user-agent to the provider. We do not receive those as part of the statistics we see, which are aggregate counts.

Page addresses that contain a one-time link — a password-reset or guest-claim link — have that part removed before anything is sent, and the part of an address after a “?” is never sent at all. This is deliberate: those links are working credentials, and sending them to a third party would hand over the ability to use them.

Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page indicates when it was last revised. Material changes will be highlighted here.

Contact Us

Questions about this Privacy Policy, or to exercise any of the rights above: support@onthebutton.app (support inbox), dpo@meridianrock.sg for data-protection matters, or contact a site administrator for your card room. OnTheButton is operated by Meridian Rock Pte Ltd, a company incorporated in Singapore.