Privacy Policy
Compliant with the GDPR (EU Regulation 2016/679) — Last updated: July 2026
Data controller
Julien Armand — Forge.poker
Contact: hello@forge.poker
Data collected
• Email address — identification and login
• Username — displayed in the interface (optional)
• Ranges and training history — operation of the service
• Activity log — latest actions in the app (tab opened, training session completed…), limited to the last 50 events per account and automatically deleted after 30 days; the date and time of your last activity are also kept
• Connection data — security (managed by Supabase)
• Sign-up origin — the page from which you create your account, the first page you visited, the site you arrived from (domain name only) and any campaign parameters (utm), collected once at account creation to understand how Forge.poker is discovered. No IP address, no browsing history.
• Newsletter email — only if you consented at sign-up (sending tips and news)
• Contact messages — if you write to us via the contact form (email and message), used solely to reply to you
Legal basis
Performance of the service contract (Art. 6.1.b GDPR) for the operation of your account, and explicit consent (Art. 6.1.a GDPR) for sending the newsletter. This consent is optional, collected via an unticked box separate from the Terms, and revocable at any time (unsubscribe link in every email or from your Settings). The sign-up origin and the security mechanisms (anti-bot protection, rate limiting) rely on our legitimate interest (Art. 6.1.f GDPR): understanding how the site is discovered and protecting it from abuse, with the minimum data necessary.
Retention period
Your data is kept for the entire period your account is active. When you request deletion of your account, it is immediately deactivated then permanently deleted after a 7-day grace period; during that time deletion remains reversible (just log back in to cancel it) and any subscription is canceled right away. Failing restoration, all your data is erased at the end of that period; residual technical logs are deleted within a maximum of 30 days.
Processors
• Supabase Inc. — database hosting and authentication (EU servers)
• Vercel Inc. (US) — website hosting and anonymous technical performance measurement (Speed Insights)
• Stripe Payments Europe, Ltd. — payment processing and subscription management (email and customer ID). Forge.poker never has access to your full banking details.
• Resend (US) — sending transactional emails and the newsletter.
• Cloudflare, Inc. (US) — anti-bot protection (Turnstile) at account creation and login.
• Upstash, Inc. (US) — rate limiting to prevent abuse; the IP address serves as a temporary counter and is kept for only a few minutes.
• Google Ireland Ltd. / Google LLC — audience measurement (Google Analytics), only if you have consented, and the "Continue with Google" sign-in service if you choose that authentication method.
Transfers outside the EU: some providers (Vercel, Resend, Cloudflare, Upstash, Google) are established in or process data in the United States. These transfers are governed by the European Commission's Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
No data is sold or shared with third parties for commercial purposes.
Cookies
Forge.poker places a strictly necessary authentication cookie (Supabase), a few internal functional trackers (preferences, cookie choice, session lock, sign-up origin — with no third parties involved) as well as, subject to your consent, audience-measurement cookies (Google Analytics). See our Cookie Policy for more details.
Your rights (GDPR)
You have the following rights:
• Access — view your data
• Rectification — change your email or username in the Settings
• Erasure — delete your account in the Settings
• Portability — export your data (JSON) from the Settings
• Objection — contact: hello@forge.poker
• Withdrawal of consent — unsubscribe from the newsletter at any time (link in every email or button in your Settings), without affecting your account
Complaint
You may lodge a complaint with the CNIL (French data protection authority): www.cnil.fr