Privacy, Legal & Account
- OctoCoach takes privacy seriously. All your personal data is stored encrypted in Firebase Firestore.
- Age verification: at signup you confirmed you're 18+. Only 18 and over may use the app.
- Terms of Service: available via the link at the bottom of the Auth screen, in Settings, and at /legal/terms.
- Privacy Policy: GDPR-compliant, available in Settings and at /legal/privacy.
- AI Disclaimer: the coach is a support tool, not a substitute for professional advice. Available in Settings and at /legal/ai-disclaimer.
- One-time consent: the welcome screen with your date of birth and the Terms, Privacy, and AI Disclaimer checkboxes appears only once, at your first sign-in, and is not asked again on later launches. If the app cannot reach the server when it starts, it shows a loading spinner and retries rather than asking for your consent again.
- Pseudonymization: opponents' real names you log stay in your account only. AI context shows them as OPP-XXXXXX, and every share (text, poll, or replay link) shows numbered villains (Villain 1, Villain 2). No one receiving a share link sees the real name.
- Note residual risk: the 'notes' field in the app is free-form. If you wrote real names there, they're stored as-is. Avoid writing full names in notes.
- Account deletion: Settings → Delete account. Type 'delete' to confirm. Deletion includes: all sessions, hands, player profiles, and Firebase Auth account.
- Data access / export request (DSAR): any user can export their own data from Settings → Data → 'Download My Data' (a single JSON file). For anything not covered, email privacy@octocoach.app and we respond within 30 days (see also the 'Support, Contact & Privacy' section).
- Notifications and access: through the browser/PWA. Permission options are also controlled via device settings.
- Crisis support: if gambling gets out of control, Settings → Responsible Play has links to support organizations.
- Usage analytics: OctoCoach measures feature usage with Amplitude - events go through OctoCoach's own servers so they carry no IP address; session recordings are masked (all text and numbers hidden) and upload directly from the browser to Amplitude, which does see the IP for those uploads like any direct web connection. Events also include basic device information from standard browser headers (browser and operating-system type, the language your browser reports, and the app's interface language), your approximate country as derived on your device from its time-zone setting, and coarse session characteristics (game type, bucketed stakes range, session length range, win-or-loss outcome) - never your IP and never monetary amounts. Usage-analytics events are kept up to 24 months. You can turn it all off in Settings → Data → 'Usage analytics'. Deleting your account also erases these analytics copies. Full details in the Privacy Policy, sections 1, 3 and 5-7.