Scope
LeakSeek ("we", "our", or "the app") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share information when you use our mobile app, our website, our support channels, our newsletter and beta forms, and our community verification pages.
LeakSeek is the data controller for the processing described here. You can reach us at any time at contact@leakseek.poker.
Accounts and Sign-In
The app creates an anonymous account the first time you open it, so that you can train before deciding whether to register. That account is identified only by a randomly generated user ID and holds no email address or name.
You can later link that account to an email address, to Sign in with Apple, or to Google Sign-In. When you sign in with Apple or Google, we receive the identifiers and email address that provider returns to us (including Apple's private relay address if you choose to hide your email). For Sign in with Apple we also store a refresh token, which exists solely so that deleting your LeakSeek account also revokes the app's access to your Apple ID.
Information We Collect
Account and authentication data: Anonymous user ID, email address (once you register), login and session data, authentication events, and the sign-in provider you used, via Supabase Auth — including password reset, social login, and account linking flows.
Training and gameplay data: Training hands dealt to you, the decisions you make, hand and session results, time spent, session summaries, and replay history.
Progression and ranking data: XP, levels, streaks, daily plans and their completion, credits and daily allowances, concept mastery and skill scores, ELO ratings per game format, and derived playstyle indicators such as aggression and tight/loose tendencies.
Onboarding questionnaire answers: The answers you give during onboarding — the goal you pick, the difficulty you report, your self-declared stakes bracket, your study habits, the minutes per day you commit to, and your preferred game formats. These drive your diagnosis, your roadmap, and the hands the app selects for you.
Settings and preferences: Training filters, language, sound and haptics settings, notification preferences per category, and your analytics preference.
Notification data: If you enable notifications, a push token issued by the Expo push service, plus your platform, time zone, locale, app version, and last-seen time. We also log the notifications we send you, their category, their delivery status, and whether they were opened.
Product analytics events: In-app events such as screens viewed, training sessions started and finished, lessons and drills completed, paywalls shown, and purchases started or completed — together with a device-scoped anonymous identifier, your user ID once signed in, app version, platform, and locale. See Product Analytics and Your Choices below.
Diagnostics and crash data: Crash reports, error logs, performance traces, and sampled session replays of the app interface, via Sentry. See Crash Reporting and Session Replay below.
Subscription status: Entitlement and purchase state from RevenueCat plus store billing status from the Apple App Store and Google Play, and any founder or promotional code you redeem.
Support and contact submissions: Subject, message content, your authenticated user ID, and your account email when you write to us through the in-app contact form.
Website newsletter data: Email address and anti-abuse metadata such as IP address, user agent, rate-limit records, and unsubscribe status.
Beta and feedback submissions: If you apply to the beta or submit feedback on our website: the email address on your store account, an optional Discord handle, your platform, the formats and stakes you play, your volume and self-rated level, free-text answers about your leaks and your experience, the tools you use and what you spend on them, and satisfaction or recommendation scores.
Discord verification data: If you use our Discord verification page: your Discord user ID and username, the email address or beta code you submit, and anti-abuse rate-limit records.
Product Analytics and Your Choices
We use PostHog, hosted in the European Union, together with our own database, to understand how LeakSeek is used and to improve it. Events are explicitly instrumented by us — we do not use automatic capture of taps and screens, and PostHog session replay is disabled.
Analytics events are attributed to a random identifier generated on your device before you sign in, and to your LeakSeek user ID afterwards. We never send your email address, your name, or your avatar to PostHog. We also attach aggregated person-level properties such as your level, your streak bracket, your subscription tier, and a derived playstyle label.
You can turn this off. Open Settings in the app and switch off product analytics. The preference is stored with your account and applies both to the app and to events generated on our servers on your behalf. Crash reporting and strictly necessary service logs are not covered by this switch.
Crash Reporting and Session Replay
We use Sentry to detect crashes and errors. Sentry receives technical diagnostics, breadcrumbs and logs, device and OS information, your IP address, and — when you are signed in — your user ID and account email, so that we can trace a specific report back to a specific complaint.
Sentry also records mobile session replay: a reconstruction of the app interface for a sample of sessions (approximately one in ten) and for sessions in which an error occurs. Replays capture app screens and interactions; they do not capture your passwords, your keyboard, or anything outside the LeakSeek app.
Website Analytics and Cookies
Our website uses Google Analytics 4 to measure page views, scroll depth, section views, CTA clicks, FAQ interactions, newsletter conversions, and language changes. Google Analytics sets cookies or equivalent local identifiers in your browser and processes your IP address and user agent.
We use no advertising, remarketing, or social-media pixels. The mobile app does not use cookies and does not use the advertising identifier on your device.
What We Do Not Do
- We do not sell or rent your personal data
- We do not show advertising, and we do not track you across other companies' apps or websites
- We do not collect your precise location, your contacts, your photos, your microphone, or your camera
- We do not connect to, import from, or handle any real-money poker account, and LeakSeek involves no real-money wagering
- We do not store full payment card numbers or store account credentials
How We Use Data
- Provide and secure authentication and account access
- Deliver training features, session tracking, ranking, and progression
- Personalise your plan, your diagnosis, and the hands and lessons the app selects for you
- Send the notifications and reminders you have enabled, and measure whether they are useful
- Process and manage subscriptions, credits, and entitlement access, and validate promotional eligibility
- Respond to support requests and improve product quality, stability, and content
- Run newsletter, beta, and community operations, and prevent abuse
- Understand product usage in aggregate to decide what to build next
Legal Bases for Processing (EEA/UK)
- Performance of a contract: creating and securing your account, delivering training, progression and ranking, and managing subscriptions and entitlements
- Consent: push notifications, the newsletter, product analytics (which you can switch off in Settings), and website analytics cookies
- Legitimate interests: keeping the service secure and available, preventing fraud and abuse, diagnosing crashes, and handling support requests
- Legal obligation: tax, accounting, and responding to lawful requests
Sharing and Processors
We do not sell your personal data. We share data with service providers only as needed to operate LeakSeek:
- Supabase (authentication, database, edge functions)
- RevenueCat (subscription and entitlement management)
- Apple App Store and Google Play (payments and billing)
- PostHog (product analytics, EU-hosted)
- Sentry (error monitoring, diagnostics, session replay)
- Expo, Apple Push Notification service, and Firebase Cloud Messaging (push notification delivery)
- Google Analytics (website analytics)
- Resend (newsletter and transactional email delivery)
- Discord (community, and the optional community verification flow)
We may also disclose data where required by law, to enforce our Terms, or in connection with a merger, acquisition, or sale of assets — in which case we will notify you before your data becomes subject to a different policy.
International Transfers
Some of our providers are established outside the European Economic Area, principally in the United States. Where personal data is transferred outside the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, on the EU – US Data Privacy Framework where the provider is certified, or on another transfer mechanism permitted by applicable law. You can ask us for details at contact@leakseek.poker.
Security and Retention
We apply reasonable technical and organisational safeguards, including row-level access control in our database, encrypted transport, and restricted administrative access. However, no system is completely secure.
We retain personal data only as long as needed for service delivery, legal obligations, fraud prevention, and legitimate business operations. Indicatively:
- Account, training, and progression data: for as long as your account exists
- Analytics events: retained in aggregate for product analysis; deleted or de-identified when your account is deleted
- Crash reports and session replays: kept for a limited diagnostic window as configured with Sentry
- Push tokens and notification logs: until you disable notifications, the token is revoked by the platform, or your account is deleted
- Newsletter, beta, and verification records: until you unsubscribe or ask us to delete them, plus a short anti-abuse window
- Billing records: as required by tax and accounting law
Payment Information
Purchases are processed by the Apple App Store and Google Play, with subscription state integrated through RevenueCat. We receive your entitlement and transaction status, never your full payment card number.
Push Notifications
Push notifications are optional and off until you allow them. You can choose which categories you receive in the app's settings, and you can turn notifications off entirely at any time from your device settings. Disabling them does not delete your account or your progress.
Automated Processing
LeakSeek personalises what it shows you — your diagnosis, your daily plan, the hands you are dealt, the concepts it flags as rusty — based on your answers and your play. This profiling serves the training itself. It produces no legal effect and no similarly significant effect on you, and there is no automated decision-making of that kind in the app.
Children's Privacy
LeakSeek is not intended for users under the age of 18. We do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us immediately.
Your Rights
You have the right to:
- Access the personal information we hold about you
- Correct inaccurate or incomplete personal information
- Request deletion of your account and associated data
- Request a copy/export of your data where applicable
- Object to or restrict certain processing where permitted
- Withdraw your consent at any time — for analytics in the app's Settings, for notifications in your device settings, and for the newsletter via the unsubscribe link — without affecting processing carried out before withdrawal
To exercise these rights, please contact us at contact@leakseek.poker. If you are in the EEA or the UK, you also have the right to lodge a complaint with your data protection authority; in France, that is the CNIL.
Deleting Your Account
You can delete your account from within the app, or from the account deletion page on our website. Deletion removes your authentication record, erases or irreversibly anonymises the data associated with you in our database, deletes your analytics profile and its events at PostHog, and — if you signed in with Apple — revokes LeakSeek's access to your Apple ID.
Note: deleting your account does not cancel a subscription bought through the App Store or Google Play. Cancel it in your store account settings before deleting, or it will keep renewing.
Changes to This Policy
If we make changes to this Privacy Policy, we will update the "Last updated" date at the top of this page and may notify you through the app, website, or email. Continued use of LeakSeek after changes become effective constitutes acceptance of the updated policy.
Contact
If you have any questions or concerns about this Privacy Policy, please contact us at:
contact@leakseek.poker