Privacy Policy

1. Information We Collect

When you use HeroCall, we collect the following information:

• Account information: Email address, display name, and authentication credentials when you create an account.
• Hand data: Poker hand descriptions you submit for analysis, including parsed hand data (positions, cards, actions, stack sizes).
• Conversations: Messages exchanged with the AI coach, including follow-up questions and coaching responses.
• Usage data: How you interact with the Service, including pages visited, features used, and session duration. To diagnose usability problems we also record session replays — a reconstruction of your clicks, scrolling, and movement through the app. The text of the page, including your hands, your messages, the coaching you receive, and anything you type, is masked in your browser before the recording is sent.
• Technical data: Your IP address and basic device and browser information, used for security, rate limiting, and abuse prevention. For the no-account demo, usage limits are keyed to your IP address.
• Preferences: Your poker preferences (stakes, game type) and application settings (theme, profile details).

2. How We Use Your Information

We use collected information to:

• Provide and improve the AI coaching service
• Process and analyze your poker hands
• Maintain your conversation history and hand records
• Authenticate your identity and secure your account
• Understand usage patterns to improve the product
• Communicate with you about the Service

3. AI Processing

Your hand descriptions and conversations are processed by third-party AI models (such as OpenAI, Anthropic, or similar providers) to generate coaching analysis. These providers may process your data according to their own privacy policies. We send them your hand descriptions, your messages, and the conversation's prior context — what is needed for analysis and coaching. We do not send your name, email address, or other account information to AI model providers.

4. Data Storage and Security

Your data is stored in secured PostgreSQL databases. We use industry-standard security measures including encrypted connections (HTTPS/TLS), secure authentication via Supabase Auth, and access controls to protect your information. However, no method of electronic storage is 100% secure, and we cannot guarantee absolute security.

5. Data Sharing

We do not sell your personal information, and we do not share it for cross-context behavioral advertising (as those terms are defined by the California Consumer Privacy Act). We disclose data to the service providers below, who process it on our instructions:

• AI service providers: To process hand analysis and coaching (hand data and conversation content only).
• AI observability providers: To debug and improve coaching quality, our AI requests and responses (your hand descriptions, messages, and the coach's replies), together with your user ID, are recorded with a third-party service that provides monitoring for AI systems, acting as our processor.
• Infrastructure providers: Cloud hosting and database services that store and process data on our behalf.
• Analytics providers: We use a third-party product-analytics service (currently PostHog) to measure how the Service is used. For signed-in users this includes your user ID, email address, and per-user event streams (pages viewed, features used, hand reviews started and completed). Events are associated with your account so we can understand and improve the product; they are not sold or used for third-party advertising.
• Email service providers: If you join our waitlist or mailing list, your email address (and, where you provide it, your typical stakes) is stored with the third-party service that sends our emails. You can unsubscribe at any time via the link in any email.
• Payment processor: If you purchase a subscription, payments are handled by Stripe. We share your email address with Stripe to create your billing account and store only your Stripe customer and subscription identifiers — we never see or store your card details.
• Legal requirements: When required by law or to protect our rights.

6. Who We Are, and Your Privacy Rights

HeroCall is operated by an individual based in British Columbia, Canada. Our privacy officer is accountable for the personal information described in this policy and can be reached at support@herocallpoker.com.

We collect and use your personal information with your consent and for the purposes described above: providing the Service, keeping it secure, and improving it. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice — withdrawing consent for essential processing means we can no longer provide the Service to you.

You have the right to ask what personal information we hold about you, to receive a copy of it, and to have inaccurate information corrected. Email us at support@herocallpoker.com and we will respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or to the Information and Privacy Commissioner for British Columbia.

Our servers and several of our service providers are located in the United States, and some of our AI providers may process data in other countries. Personal information stored outside Canada is subject to the laws of the country where it is held and may be accessible to that country's courts and authorities. If you use the Service from outside Canada, your information will be transferred to and processed in Canada and the United States.

7. Managing Your Data

From the application you can:

• Access your personal data through your profile and hand history
• Update or correct your profile information
• Delete individual hands from your history
• Delete your account, which permanently removes your conversations, hands, tags, and profile from our database and erases your login identity
• Request an export of your data by emailing support@herocallpoker.com

To exercise these rights, use the account settings in the application or contact us at support@herocallpoker.com. Section 6 describes the rights you have under Canadian privacy law and how to raise a concern with us or with a regulator.

8. Cookies and Local Storage

HeroCall uses browser local storage to persist your theme preference and authentication session. We use analytics cookies (PostHog) to understand usage patterns. You can disable cookies in your browser settings, though this may affect functionality.

Our analytics provider also records session replays of how you use the app — which elements you click, how far you scroll, and how you move between pages. The text of the page is masked in your browser before the recording is sent, so a replay shows the shape of your session rather than the content of your hands, your messages, or the coaching you received. Web addresses are recorded as they appear in your browser's address bar.

If you try the demo without an account, we store one randomly generated identifier in your browser's local storage, and we keep a matching record on our servers. It exists only to count how many free hand reviews the demo has given you, contains nothing about you, and is never linked to an account or shared with anyone. Clearing your browser's site data removes the identifier and starts a fresh count, though the earlier record remains on our servers. Hand descriptions you submit in the demo are processed by our AI providers and stored on our servers like any other conversation; because there is no account attached, we cannot delete them at your request unless you contact us with details that identify the session. Demo usage limits are keyed to your IP address.

9. Shared Hand Reviews

If you choose to share a hand review, we create a public web page containing a frozen snapshot of that conversation: the hand details, your messages, the coaching responses, and — only if you opt in — the display name you chose. Anyone with the link can view it without an account, and it may be reposted by others. We generate a preview image of the hand for link unfurls. You can revoke a share link at any time from the app, and deleting the conversation or your account also disables the link. We ask search engines not to index shared pages, but we cannot control copies made while a link was live.

10. Data Retention

We retain your data for as long as your account is active. Conversations and hand data are stored indefinitely unless you delete them.

When you delete your account, your conversations, hands, and profile are deleted from our production database immediately, and your login identity is erased from our authentication provider. Deleted data may persist in our encrypted database backups for up to 7 days before being overwritten in the ordinary course of our backup rotation. Analytics events already sent to our analytics provider, AI-processing traces held by our observability provider, and billing records held by our payment processor are deleted on their respective schedules; contact us to request expedited erasure of these.

11. Children's Privacy

HeroCall is not intended for users under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a user under 18, we will delete that information promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page with an updated effective date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact

If you have questions about this Privacy Policy or your data, please contact us at support@herocallpoker.com.