Introduction

OnTheButton ("we", "our", or "us") is a bookkeeping and coordination platform for private, recreational home poker games. This Privacy Policy explains what personal information we collect, how we use it, and the rights you have over it — including under Singapore's Personal Data Protection Act (PDPA) and, for users in scope of it, the EU/UK General Data Protection Regulation (GDPR).

Information We Collect

Account Information

When you create an account, we collect:

• Full name (first and last name)
• Email address
• Optional settlement-display handles (PayNow, Venmo, CashApp, Zelle) — shown to other members so they know where to send money directly; we never process or move this money ourselves
• Profile photo (optional)

Game & Card Room Records

When you participate in a card room (club), we collect:

• Game participation records (which games you joined, and which card room)
• Buy-in and cashout amounts, as recorded by hosts/admins for bookkeeping — not processed as a payment by us
• Game statistics (games played, net result over time)
• Strike and suspension records, where a card room uses that feature

Billing Information (Pro subscriptions)

If a card room upgrades to a paid plan, payment card details are collected and processed entirely by Stripe, our payment processor — we never see or store your full card number. We retain only the subscription status and Stripe's customer/ subscription identifiers needed to administer billing.

Authentication Data

We use secure credential-based authentication with encrypted password storage (bcrypt hashing), and support signing in with Google. We collect login timestamps, IP addresses, and session information to maintain account security. Your password is never stored in plain text and cannot be recovered (only reset).

How We Use Your Information

We use your information to:

• Manage your account and authenticate your identity
• Organize and coordinate poker games within your card room(s)
• Track game participation and financial records for bookkeeping
• Send notifications about games, suspensions, billing, and account status
• Generate statistics, leaderboards, and season standings
• Administer subscription billing, where applicable
• Communicate with you via email

Information Sharing

We do not sell your personal information. We share it only:

• Within your card room: your name, profile photo, and game statistics are visible to other members of the same card room — never to members of a different one.
• Service providers: Mailgun (email delivery), Railway (hosting), and Stripe (subscription billing, if applicable). These providers process data on our behalf to provide their services, under their own privacy and security commitments.
• Legal requirements: if required by law, or to protect our rights, safety, or the safety of others.

Data Security

We implement reasonable security measures, including bcrypt password hashing, encrypted database connections, server-side validation, and access controls restricting administrative functions to authorized roles. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Retention & Deletion

We retain your account information and game history for as long as your account is active, and for a reasonable period after to preserve the accuracy of other members' game records (buy-ins, cashouts, and results that reference you stay consistent for everyone else in the ledger).

Today, account deletion is a manual, contact-based process: you may request deletion of your account at any time by contacting a site administrator or the person who invited you. On request, we anonymize your identifying information (name, email, photo, settlement handles) while keeping the underlying game records intact so other players' history and totals stay accurate. Self-serve export, leave-a-club, and account/club deletion tools are planned (tracked internally as SEN-32) but are not yet built — this policy will be updated once they ship.

Your Rights — PDPA (Singapore)

Under Singapore's Personal Data Protection Act, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate personal data
• Withdraw consent to our collection, use, or disclosure of your data, subject to legal or contractual restrictions
• Request deletion of your account, per the process above

Data Protection Officer contact: [DPO name/contact — to be designated].

Your Rights — GDPR Basics

If you are located in the EU/UK, we process your data on the basis of contract (to provide the Service you signed up for) or legitimate interest (e.g. account security). You additionally have the right to:

• Rectification of inaccurate data
• Erasure ("right to be forgotten"), subject to the record-keeping limits described above
• Data portability (an export of your data in a structured format)
• Object to processing based on legitimate interest
• Lodge a complaint with your local supervisory authority

EU/UK representative (if required under Art. 27 GDPR / UK GDPR): [representative name/contact — to be designated if the user base requires it].

Children's Privacy & Local Law

Our service is not directed at children, and we do not knowingly collect personal information from children. You are responsible for complying with the applicable laws in your own jurisdiction, including any minimum-age or other eligibility requirements that apply to you where you live. If you believe we have collected information from a child, contact us immediately and we will investigate and delete it.

International Transfers

OnTheButton is operated from Singapore. If you access the Service from outside Singapore, your information may be transferred to and processed in Singapore and in the jurisdictions of our service providers (Mailgun, Railway, Stripe). By using the Service, you consent to this transfer.

Cookies

We use essential, session-only cookies to keep you logged in and to provide core functionality. We do not use advertising cookies or third-party tracking cookies.

Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page indicates when it was last revised. Material changes will be highlighted here.

Contact Us

Questions about this Privacy Policy, or to exercise any of the rights above: support@onthebutton.app (support inbox), or contact a site administrator for your card room. [Registered company name and address — to be added.]