Privacy Policy
1. Who is responsible
Omahalytics ("we", "us"), is the controller of your personal data under the EU General Data Protection Regulation (GDPR). This policy covers the Omahalytics website and the calculator app. For anything about your data, email privacy@omahalytics.com.
2. What we collect
- Account data. When you sign up: your email address and an account ID, held by our sign in provider, and your plan with its end date. We never see your password; if you sign in with Google or another provider, we receive only your email address and account ID from it.
- IP address. Every request carries your IP address. We use it for rate limits and to protect the Service from abuse. If you use the calculator without signing in, your IP address (for IPv6, its /64 network) is what your usage is counted under. Our server never stores it as it is, only as a keyed hash (see section 11).
- Usage data. For each account, or IP address when not signed in, and each day: the number of runs, deals simulated, range requests, sample hands and computing time. When a limit is reached we record the time, the account or IP address and which limit it was.
- Shared links. When you share a run, we store the snapshot you chose to share (ranges, board, settings, results and title) with your account ID, the creation date and a view count. We do not record who views a link.
The ranges, boards and settings you enter are sent to our server to run the calculation. They stay in memory while the run is active and are not stored afterwards, unless you share the run, except in our server log.
- Server log. For each request: the time, the address within the Service, the result, how long it took, the ranges, board, filters and settings sent with it, and the keyed hash of your account ID or IP address (never the address itself). It also records when your runs start and end, and the limits you reach.
We do not collect your name, address, date of birth, poker site accounts or hand histories. When paid plans launch, card details will go straight to our payment provider; we will only receive the payment status and what is needed for invoices, and we will update this policy before that happens.
3. Why we use it
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and running your account, providing the plan you are on | Account data, usage data | Contract, Art. 6(1)(b) |
| Running calculations and shared links you ask for | Your inputs, shared links | Contract, Art. 6(1)(b) |
| Applying daily limits and rate limits | Usage data, IP address | Contract, Art. 6(1)(b), and our legitimate interest in fair use of shared servers, Art. 6(1)(f) |
| Detecting and stopping abuse: scripted access, shared accounts, attacks | IP address, usage data, limit records | Legitimate interest in keeping the Service secure and available, Art. 6(1)(f) |
| Finding and fixing errors and slow requests, keeping the Service running | Server log | Legitimate interest in a working, secure Service, Art. 6(1)(f) |
| Emails about your account, plan changes and changes to our terms | Email address | Contract, Art. 6(1)(b) |
| Understanding which pages of the website are visited | Aggregated page views (see section 5) | Legitimate interest in improving the website, Art. 6(1)(f) |
| Keeping invoices once paid plans launch | Billing records | Legal obligation, Art. 6(1)(c) |
We send product news only if you opt in, and you can unsubscribe at any time. Where we rely on legitimate interest, you can object; see section 9.
5. Website analytics
To count visits to the website we use Cloudflare Web Analytics, which sets no cookies, stores nothing on your device and does not build a profile of you or follow you across sites. We see only totals, such as page views, referring sites, countries and device types.
6. Who receives your data
We use a few service providers that process data for us under data processing agreements, only on our instructions:
- Clerk, Inc., our sign in provider: account data and sign in cookies.
- Hetzner, which runs our servers in Finland: everything stored by the Service.
- Cloudflare, Inc., which carries traffic to our servers and protects them from attacks: IP addresses and requests passing through its network, and website analytics.
Anyone you send a shared link to can see that snapshot. We may disclose data when the law requires it, or to establish or defend legal claims. If the Service is taken over by another company, your data passes to it under this policy, and we tell you first. We never sell or rent your data.
7. Transfers outside the EEA
Some providers are based in the United States. Where data leaves the European Economic Area, we rely on the EU US Data Privacy Framework for certified providers, or on the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards that apply.
8. How long we keep it
| Data | Kept for |
|---|---|
| Account data | While your account exists; deleted within 30 days of you deleting it |
| Usage data and limit records of an account | 12 months, then deleted |
| Usage data and limit records of an IP address (not signed in) | 90 days, then deleted |
| Server log | 30 days, then deleted |
| IP addresses in rate limits | In memory only, for minutes |
| Shared links | Until you delete them or they expire (one year on Pro), and when your account is deleted |
| Backups | Overwritten within 30 days |
| Invoices, once paid plans launch | As long as tax law requires |
We may keep specific records longer if we need them for a legal claim or an ongoing abuse investigation, and only for as long as that lasts.
9. Your rights
Under the GDPR you have the right to:
- get a copy of your personal data, and receive it in a machine readable format;
- have incorrect data corrected;
- have your data deleted;
- restrict how we use it while a question is settled;
- object to uses based on our legitimate interest;
- withdraw any consent you gave, without affecting earlier use.
Email privacy@omahalytics.com from the address on your account. We reply within one month and may ask you to confirm your identity.
You have the right to complain to a data protection authority. In Poland this is the President of the Personal Data Protection Office (UODO, uodo.gov.pl); you can also contact the authority where you live or work. We would appreciate the chance to sort it out with you first.
10. Automatic limits
Daily quotas and rate limits are applied automatically: when you reach one, the calculator pauses until the limit resets. This does not have legal or similarly significant effects on you. A decision to suspend or close an account is always reviewed by a person.
11. Security
All traffic is encrypted with HTTPS. Access to our servers and databases is limited to the people who run the Service, and passwords are handled only by our sign in provider. We collect as little as we can, which is the best protection there is.
Our own databases never hold your email address, account ID or IP address as they are. Usage records and shared links are filed under a keyed hash of them (pseudonymisation): the key is kept apart from the data and its backups, so the records alone do not show who they belong to. We use the key only to find your records when you ask to see or delete them, and to investigate abuse.
If a breach puts your rights at risk, we tell you and the authority as the law requires.
12. Children
Omahalytics is only for people aged 18 or over. We do not knowingly collect data from anyone younger; if we learn that we have, we delete it.
13. Changes to this policy
When we add a provider, a new kind of data or paid plans, we update this policy and change the date at the top. For significant changes we email you before they take effect.
14. Contact
Omahalytics
Email: privacy@omahalytics.com