Privacy

Last updated 11 October 2026.

Short version: you can use every drill without an account, and then nothing about you is stored by us. If you sign in, we keep one row of scores tied to a scrambled version of your Discord id, and you can delete it from Settings whenever you like. No ads, no analytics, no selling or sharing data.

Using the trainer without signing in

The cards, odds and scoring all run in your browser. Your answers are not sent anywhere. The site is hosted on Cloudflare, so, like any web host, Cloudflare handles your IP address and browser details to deliver the pages. We have logging switched off for the part of the site that we run, and we don't add analytics, trackers, ads, or third-party fonts and images.

Your browser keeps a few things on your device:

• Your settings: sound, vibration and tips on or off.
• Whether you have unlocked the poker slang mode.
• The days you secured your daily streak while signed out (just the dates).
• A copy of the site's files, so the trainer works offline.

These never leave your device. Clearing this site's data in your browser removes them.

Signing in

Signing in is optional and only does one thing: it saves your scores so they follow you between visits and devices.

Bot check. When you press Sign in, and only then, the page loads Cloudflare Turnstile, an invisible check that you are not a bot. Turnstile runs in your browser and Cloudflare processes signals from it to make that call. We only receive a pass or fail token, which we check with Cloudflare once.

Discord. We ask Discord for the identify permission only. That gives us your Discord user id, username, display name and profile picture, not your email or your servers. We use the access token once to read your id, then revoke it straight away. We never store your Discord id itself.

Your profile picture. While you sign in, our server downloads a small copy of your Discord profile picture (or Discord's default one if you haven't set one) and hands it to your browser, which keeps it to show in the account menu. Our server doesn't keep it, and pages never load it from Discord, so Discord can't see when you visit. Signing out or deleting your data removes it from your browser. If you change your picture on Discord, it updates the next time you sign in.

Your session. A cookie keeps you signed in for 30 days. It holds a scrambled id, your display name and an expiry date, signed so it can't be forged. It is HttpOnly, sent only over HTTPS and only to this site. A second short-lived cookie (10 minutes) guards the sign-in step against forgery and is cleared when you come back from Discord.

What we store when you are signed in

One database row per player, kept in Cloudflare D1. It contains:

• A keyed hash of your Discord id. It can only be matched to a Discord account with a secret key that stays on the server.
• Your total answers, correct answers and best streak in each mode.
• Up to 40 spots you miss most in each mode, for the weak spots page.
• Your totals for each day you played, for up to the last 365 days with any play.
• Random ids of your last 20 saved batches, so nothing gets counted twice.
• Only if you turn on the daily reminder: your browser's push address and the keys to encrypt messages for it, the time you picked and your time zone (like Europe/London). The time zone is how we know when your evening is.
• When the row was last updated.

Your name and picture are not in the database. While you are signed in, your browser also keeps your display name, your profile picture, your saved totals and any answers waiting to be sent, so the trainer works offline and syncs when you are back.

Daily reminders

Reminders are off unless you turn them on in Settings, and they need you to be signed in. Your browser then gives us a push address, an address at your browser maker's push service (Apple, Google or Mozilla). At the time you pick, if you haven't secured your streak that day, our server sends one short message to that address. It is encrypted for your browser, so the push service can't read it. We send nothing else, we don't learn whether you opened it, and sending one doesn't change your row.

Turning reminders off, signing out on that device or deleting your data stops them. Turning them off removes the push address from your row; if a push address stops working (for example you blocked notifications), we remove it the next time a message to it bounces.

Deleting your data

Open Settings (from the account menu), press Delete my data… and type DELETE to confirm. That deletes your row, signs you out and clears the copy and your picture in your browser. Signing out without deleting keeps the row, and keeps any unsent answers in your browser for next time.

We don't delete rows on our own, so your scores stay until you remove them. If you can't sign in any more, email us your Discord user id and we will delete the row for you.

Who else is involved

• Cloudflare hosts the site and the database, and runs Turnstile when you sign in.
• Discord handles signing in. Their own privacy policy covers what happens on their side.
• Apple, Google or Mozilla, only if you turn on reminders: their push service delivers the encrypted message to your device, so they see that a message from us arrived for it.

Nobody else. We don't sell or share data, and there is nothing to sell.

Changes and contact

If what the site stores changes, this page changes with it and the date at the top moves. Questions or requests: hello@poker-trainer.app.