How SpraggyPoker uses personal information
SpraggyPoker is operated by Ben Spragg. Ben Spragg is the controller responsible for the personal information described in this notice.
Privacy contact: privacy@spraggypoker.com
Information we collect
| Category | Examples |
|---|---|
| Account and identity | Twitch or Discord account ID, display name, avatar, email where supplied by the provider, linked-account status and encrypted OAuth tokens. |
| Profile and community activity | Handle, bio, posts, comments, reactions, bookmarks, mentions and notifications. |
| Poker hands | Anonymised hand-history text, parsed hand data, labels, notes, highlights, reveal settings and external hand identifiers. Before upload, your screen name is replaced with your selected community name and opponents are replaced with seat-number aliases. |
| Community integrations | Twitch subscriber status and channel-point redemptions, selected Discord roles and emote identifiers from Twitch, Discord, BetterTTV and FrankerFaceZ. |
| Safety and moderation | Reports, report details, moderation decisions, suspensions, appeals and related correspondence. |
| Technical and security | Session token, session expiry, IP address and user agent in authentication records, pseudonymous rate-limit keys, and limited request diagnostics such as route, status, timing and Cloudflare request ID. |
| Requests and correspondence | Emails and information supplied in privacy, legal, support or safety requests. |
Where the information comes from
Most information comes directly from you. Account information and relevant channel or server status comes from Twitch or Discord when you sign in, link an account or use an integration. Other users may provide information when they mention or report you. Cloudflare supplies security and request information needed to deliver the site.
Why we use it and our lawful bases
- Contract: to create your account, authenticate you, publish requested content, provide replays, reactions, bookmarks and notifications, and administer account closure.
- Legitimate interests: to secure and operate the site, prevent abuse, understand basic performance, support the community, maintain records, enforce the rules and improve features. We balance these interests against users' rights, particularly where children may use the service.
- Legal obligation: to respond to data-rights and complaint requests, preserve required records, address unlawful content, cooperate with authorities where required, and meet safety and regulatory duties.
- Consent: only for genuinely optional processing that asks for consent, such as a future email newsletter. You may withdraw consent at any time without affecting earlier lawful use.
What is visible to others
Published posts, comments, reactions, selected profile details and community badges are public. Articles are public. Bookmarks, anonymised source histories, OAuth tokens, reports and moderation records are not public. A normalized replay may still reveal information you include in a post, label or note, so review it before publishing.
Who receives information
- Cloudflare provides hosting, database, object storage, security, delivery and cookie-free performance measurement.
- Twitch and Discord provide sign-in and optional community integrations. They receive the requests needed for those features and process information under their own notices.
- YouTube and Twitch video receive information only if you choose to load an embedded video in an article.
- BetterTTV and FrankerFaceZ may receive ordinary network information when their emote images are displayed.
- The site's authorised developer and moderators may access information only as needed for hosting, support, security and moderation.
- Regulators, courts, law enforcement, professional advisers or another service provider may receive information where required by law or reasonably necessary to establish, exercise or defend legal rights.
We do not sell personal information.
International access and transfers
Service providers and the authorised developer may process information outside the UK, including in Canada and the United States. Where UK data-protection law requires it, transfers use an adequacy regulation or appropriate contractual and organisational safeguards. You may ask the privacy contact for information about the safeguard relevant to a transfer.
How long we keep information
- Account, profile and published community information is normally kept while the account or content remains active.
- Authentication sessions are kept until they expire or are revoked. Pseudonymous rate-limit records are removed after 24 hours.
- Anonymised source histories are kept privately while the attached post is retained so the hand can be reparsed and supported. The original player names are removed in your browser before upload.
- Unclaimed Discord-created drafts expire after 24 hours.
- Removed content, reports and moderation records may be retained for a limited period where needed for appeals, repeat-abuse prevention, safety or legal claims. The period depends on the seriousness of the issue and applicable limitation or legal requirements.
- Privacy and legal correspondence is kept only as long as needed to answer the request and demonstrate that it was handled.
Backups and provider logs may persist for a short additional period before deletion. Information may be kept longer where law requires it or a live dispute, safety issue or investigation makes that necessary.
Your rights
Depending on the circumstances, you may have rights to be informed, access a copy, correct information, erase information, restrict or object to use, receive portable information, and withdraw consent. You also have rights relating to decisions made solely by automated means. SpraggyPoker does not currently make legal or similarly significant decisions about users solely by automated means.
Email privacy@spraggypoker.com with your account name, the right you want to use and enough detail to locate the information. We may ask for proportionate proof of identity. Rights requests are normally answered within one month.
Data-protection complaints
You can complain about how your personal information was collected, used, secured, retained, disclosed, or how a rights request was handled. Email privacy@spraggypoker.com with the subject “Privacy complaint” and explain what happened, when it happened, and the outcome you want. We will acknowledge a complaint within 30 days, investigate it without undue delay, keep you informed where appropriate, and tell you the outcome.
You may also complain to the UK Information Commissioner's Office at ico.org.uk. We would appreciate the chance to address the issue first, but you do not have to contact us before contacting the ICO.
Children
We do not use behavioural advertising, direct messages or public location features. Because we do not verify each member's age, privacy-protective defaults are applied to everyone. If a parent or guardian believes a child has provided personal information improperly, they may contact us so we can investigate and remove it where appropriate.
Security
Measures include encrypted OAuth tokens, HTTPS, access controls, restrictive browser security headers, private object storage for raw hands, request rate limits and limited operational logs. No online service can promise absolute security. Please report a suspected security or privacy incident promptly.
Changes to this notice
We will update the date and explain material changes in a reasonable in-product notice. Earlier versions may be requested from the privacy contact.
Effective 28 July 2026. Last updated 28 July 2026.