1. Who we are
DeepRuns ("we", "us") is a web application for organizing and running poker tournaments. It is operated by the DeepRuns project, currently by an individual and not by a registered legal entity. For privacy questions or requests, contact us at [email protected].
This policy describes the personal information we handle when you use DeepRuns, why we use it, when we share it, and the choices and rights available to you.
2. Information we collect
Account and profile information: your email address, display name, country, timezone, sign-in details, and account preferences. If you sign in with a password, the authentication provider stores a protected password credential. If you choose Google sign-in when available, we receive account information from Google needed to create or authenticate your account.
Tournament information: tournament names and settings, blinds, buy-ins and entries, re-entries, payouts, player roster names, tables, seating, clock state, and results that you or your organizer enter. Public tournament pages may show some of this information to anyone with the link.
Location and technical information: when you complete your profile, we use your request IP address with ipdata.co to look up a country code and may store the resulting code. Authentication records can include the IP address and browser user-agent associated with a session. We also process technical and diagnostic information such as request details, device and browser information, error reports, and app interaction data.
Feedback: if you send feedback, we collect the category and message, the page path and related tournament context, and any contact email you provide. If you ask for a reply, we use that email to respond. Feedback can be submitted without an account.
Newsletter preferences: if you request newsletter emails, we collect your email address, signup source, confirmation and subscription status, and records of your consent or withdrawal. A confirmation link is required before a new subscription becomes active.
3. How we use information
We use account and tournament information to provide and operate DeepRuns, authenticate accounts, save tournament data, deliver live tournament updates, support shared tournament views, and respond to support requests.
We use technical and diagnostic information to secure, troubleshoot, maintain, and improve the Service. In production, when configured, Sentry is used for error reporting and session replay. The current Sentry configuration samples all eligible sessions for replay. These tools are not used for advertising.
Only after you accept optional analytics, we use PostHog to understand website and product usage, including page visits, reviewed tournament-page tabs, interactions, traffic sources, browser name and version, operating system, browser language, timezone offset, screen and viewport sizes, session identifiers and duration, navigation timing, approximate location including country, and structured product actions. Product events describe successful tournament, clock, roster, entry, seating, table, payout, profile, feedback, and newsletter actions using reviewed categories, counts, and feature switches, not raw content or financial amounts. PostHog uses a randomly generated browser identifier stored in a cookie to recognize visits from the same browser. When you are signed in, we link analytics to your authentication account ID and may create a person profile with your plan category. This is account-linked, pseudonymous personal data, not anonymous analytics; we do not send account names or email addresses. PostHog receives the site hostname, browser user-agent, and request IP address, which can be used for GeoIP location enrichment. We filter out form values, raw content, raw URL query strings and fragments, and player or tournament identifiers. Traffic sources are limited to reviewed source domains and campaign categories. We do not use analytics for advertising.
With the same optional analytics consent, PostHog may record masked session replays of page structure, navigation, pointer movements, scrolling, and interactions. All DOM text, input values, and source attributes are masked, and media, canvas, embedded frames, hidden or file inputs, and analytics-choice controls are blocked. Replay URLs are reduced to route templates. Console messages, network headers and bodies, and arbitrary custom replay events are not sent. These safeguards intentionally reduce replay visual fidelity. Recording depends on the PostHog project replay settings. Signing out or switching accounts resets the browser identity and recording session so later activity is not attributed to the previous account.
We use email addresses to send account and service messages such as verification, password reset, welcome, feedback, and newsletter confirmation emails. We send marketing newsletters only after you confirm your subscription or otherwise provide the applicable consent. You can withdraw newsletter consent using the unsubscribe option in a marketing email or by contacting us.
Depending on the purpose and applicable law, we process information to provide the Service you request, meet legal obligations, pursue legitimate interests in operating and securing DeepRuns, or on the basis of your consent. You may withdraw consent at any time where processing relies on consent.
4. Cookies and similar technologies
DeepRuns uses a strictly necessary session cookie to keep you signed in. We remember your optional analytics choice in local browser storage separately from account or legal-document acceptance. The expanded account-linked analytics and masked replay scope requires a new choice; acceptance of the earlier analytics scope does not enable it. PostHog is not initialized and no new PostHog requests or analytics cookies are created before you accept this scope. After acceptance, PostHog uses first-party analytics and consent cookies with a configured lifetime of up to 180 days, and may use session storage for technical session state. You can reject analytics without losing access to any features, or withdraw consent through Analytics settings beside Feedback, where present, on any page. Withdrawal stops capture and replay, aborts pending fetch requests and retries, and removes active PostHog analytics persistence; it does not delete previously collected events, profiles, or recordings. Other configured diagnostic tools, including Sentry, may use browser storage or similar technologies for their diagnostic and session replay features. The analytics choice controls PostHog only. We do not use these tools for advertising.
5. How we share information
We do not sell personal information. We share it with service providers that help us operate DeepRuns, including: ipdata.co for country lookup; PostHog (EU-hosted endpoint) for product analytics; Sentry for error reporting and session replay; Resend for account, feedback, and newsletter emails and subscription management; Pusher for live tournament updates; Google when you choose Google sign-in; and our hosting, database, and infrastructure providers.
These providers process information to deliver their services to us. The information they receive depends on the feature being used. For example, tournament updates are sent through Pusher, and information shown on a public tournament page is available to anyone who has its link.
We may also disclose information when required by law, to protect rights and safety, or in connection with a transfer or restructuring of the Service.
6. Public tournament information
A tournament organizer can share a read-only tournament page or TV view using a link. Anyone with that link may be able to see the tournament information displayed there, including player names and event details. Do not enter or publish information you do not have permission to share. Contact the organizer who created the tournament if you want information removed from a shared view.
7. Retention
We keep account and tournament information while it is needed to provide the Service and maintain your account. You can request account deletion by contacting [email protected]. We will delete or de-identify information when it is no longer needed, subject to legal requirements, legitimate operational needs, and information held temporarily in backups.
Newsletter records are kept as needed to honor your subscription choices and retain evidence of consent or withdrawal. A newsletter confirmation link expires after 24 hours. Feedback, email delivery records, security logs, and diagnostic data are retained as needed for their operational purposes; retention periods may vary by system and provider.
8. Your choices and rights
You can update profile information and newsletter preferences in your account settings. You can unsubscribe from marketing emails using the link in the email. You may also contact us to request access to, correction of, deletion of, or a copy of your personal information, or to object to or restrict certain processing.
Depending on where you live, including in the EU/EEA under the GDPR, you may have additional rights and the right to complain to your local data protection authority. We may need to verify your identity before responding.
9. Security and international processing
We use reasonable technical and organizational measures, including encrypted connections and protected password credentials, to help safeguard information. No method of transmission or storage is completely secure.
Our service providers may process information in countries other than the country where you live. Where applicable, we rely on appropriate safeguards for international transfers.
10. Changes to this policy
We may update this policy as DeepRuns or our data practices change. For material changes, we will provide notice by email or in the Service where practicable and may ask you to accept the updated policy before continuing to use your account. The version and last-updated date identify the policy currently in effect.