Privacy Policy
Last updated: 8 October 2026. Privacy-first by design: here is exactly what we collect, why, and the rights you have over it.
Privacy-first, by design
Your bankroll is nobody’s business but yours. We built it that way on purpose.
Nothing tracked in the app
We don’t track how or when you play: no behavioural logs, no data selling, no ads. The public site only counts visits, without cookies.
Encrypted and locked to you
Your data is encrypted in transit and at rest, and locked to your account alone: no other user can reach it. We never sell or share it, and we keep one week of rolling backup, just for you, in case your device fails.
Payments via Stripe
Card and billing details are handled entirely by Stripe. Your payment info never touches our servers.
0. Data controller
Data processing is carried out by Bankroll Lab team, a project currently being set up as a sole proprietorship (EI), whose identified responsible person is Damyan Kardashev. No Data Protection Officer (DPO) has been appointed at this stage: this is not a legal requirement at the project’s current scale. For any question about your data: support@bankroll-lab.com.
1. Data collected
Email address and password (via our authentication provider, Supabase); the data you enter yourself into the tool (tournament results, bankroll, staking/action-sale history); billing data needed for your subscription (name, email, country; never card details, which are processed exclusively by Stripe and never reach our servers); if you use staking and choose to link a Discord account: your Discord user ID and the profile details Discord shares at that moment (username, avatar, email), and whether you joined the Bankroll Lab Discord server.
2. Purposes and legal bases
Providing the Service and managing your account (performance of a contract, GDPR art. 6.1.b); linking your Discord account, at your request, to give you access to the private staking channels of the players you deal with (performance of a contract, art. 6.1.b); billing your subscription (performance of a contract / legal accounting obligation, art. 6.1.b and c); keeping the Service secure and preventing fraud (legitimate interest, art. 6.1.f). We do not profile users, do not make automated decisions with legal effect on you, and never use your data for advertising purposes.
3. Recipients of data (processors)
Your data is shared only with the technical providers necessary to run the Service: Stripe (payments), Supabase (database, authentication, cloud backups), Railway (application server hosting), Cloudflare (site hosting, content delivery, and cookieless audience measurement on the public pages of the site, never inside the app), and Discord (the problem reports you send from the app, with your account email so we can reply; and, if you link your Discord account, our bot adds you to the Bankroll Lab server and to the private channels of the staking deals you are part of, where it posts only sale, closing and results notices, never any amount). If you turn on “Contact on Discord”, your Discord ID appears on your public profile so that other players can message you. We do not sell any data and do not share it with third parties for commercial or advertising purposes.
4. Data location and transfers outside the EU
Your account database, authentication and cloud backups are hosted by Supabase in the European Union (region eu-central-2). The application server that runs the calculations is hosted by Railway in the United States, and Stripe, Cloudflare and Discord also operate globally. Where data is processed outside the European Economic Area, that transfer is governed by the European Commission’s Standard Contractual Clauses (or an equivalent adequacy mechanism) under those providers’ data processing agreements.
5. Retention period
Cloud backups are limited to a short rolling window of about 7 days and are not kept long-term. Your account data is kept for as long as your account is active. You can ask us to delete your account and all associated data at any time (your right to erasure) and we will do so within 30 days of your request. Billing records are kept longer to meet Belgian accounting and tax obligations (typically up to 7 years). Unlinking your Discord account removes your access to the staking channels; what you write on Discord is governed by Discord’s own privacy policy.
6. Cookies
The site uses a single, strictly functional cookie to remember your chosen language (30-day duration). No advertising, analytics or behavioural-tracking cookie is used. Since this cookie is strictly necessary for the site to work, no consent banner is required for it.
7. Your rights
Under the GDPR, you have the right to access, rectify, erase, restrict, port and object to the processing of your data, as well as the right to withdraw consent at any time where processing relies on it. To exercise these rights: support@bankroll-lab.com. You may also lodge a complaint with the Belgian data protection authority (APD/GBA, autoriteprotectiondonnees.be).
8. Security
Communications with the Service are encrypted (HTTPS). Authentication and data storage are handled by specialised providers (Supabase); payment data never reaches our servers (Stripe).
9. Minors
The Service is aimed at adult poker players; it is not intended for minors and we do not knowingly collect data about them.
10. Changes
This policy may be updated; any material change will be notified by email or on the site before it takes effect.