Privacy Policy

Not legal advice. If you need help with your rights, talk to a lawyer in your country. • Roll is a poker tracker plus a small social feed. • You can use Roll without an account. Until you make one, your data stays on your phone. • Anything you post, share, or put on your profile is public. • We use Supabase to store your data. We don't sell it. • You can delete your account anytime. Deletion is immediate and can't be undone — export your data first. Your photos are removed as part of that deletion; residual backup copies are purged within 30 days. • Need anything? Email roll@rollpoker.xyz.

Stuff you give us — only if you create an account: • Email or phone (so you can sign in) • Username, avatar, bio • Your posts, photos, comments, sessions, tags, shared links Stuff we pick up automatically: • Who you follow, block, or report • Device type, OS, app version • Crash logs Contacts — only if you tap Find Friends: If you use Find Friends, Roll reads your address book on your device and sends the phone numbers and email addresses to our server to check which ones already belong to Roll users. We don't store them — the check runs, returns the matching profiles, and the identifiers are discarded. Decline the permission and every other part of Roll works normally. Stuff we don't collect: • Payment info (Roll has no in-app purchases) • GPS location • Health or biometric data • Anything from other apps

You can use Roll without an account. No email, no phone number, no sign-up. In that mode your sessions, bankroll, hands, and settings live only on your device. They are not uploaded, we cannot read them, and we have no idea who you are. If you delete the app, that data goes with it — export it first if you want to keep it. If you later create an account, Roll asks what to do with the data already on your phone: add it to your new account, keep it on the phone only, or delete it. Nothing is uploaded until you choose.

Roll is social. Treat anything you post as something anyone could see. • Your profile (username, avatar, bio, follower counts) — visible to every Roll user. • Posts and comments — visible per the privacy setting you pick: public, followers, or private. • Shared session pages (rollpoker.xyz/s/…) — visible to anyone with the link.

We auto-screen post captions, comments, bios, usernames, and shared text. Bad words get blocked with a notice. You can edit and try again. You can also: • Report any post, comment, or user from the "⋯" menu. • Block anyone. Neither of you sees the other after that. • Manage blocks in Settings → Blocked users. If we remove your content, we'll tell you why. Push back by emailing roll@rollpoker.xyz.

• Run the app (your feed, stats, sessions) • Keep your account secure • Send sign-in codes and account notices • Send occasional product updates and ask for feedback — you can opt out at any time • Catch spam, abuse, and rule-breakers • Fix bugs • Comply with the law For EU/UK users, our GDPR legal bases are: running your account (contract), keeping things secure and useful (legitimate interest), consent (for product and feedback emails, and anywhere else we ask), and the law (when it tells us we have to).

We don't sell anything. We use these companies to run Roll: • Supabase — Database, login, file storage • OpenRouter — AI that parses your text (no identity attached) • AssemblyAI — Turns your voice notes into text • Apple, Google — App distribution + push notifications • Expo — App updates Each one has a contract with us about how they handle your data. We may also share data: • when the law makes us • to protect Roll and the people using it • if Roll gets acquired (we'll tell you first)

Without asking us: • See your data → open the app • Export everything → Settings → Delete Account → Download everything, or on the web at rollpoker.xyz/delete-account • Export sessions only → Settings → Export Data (CSV) • Delete your account → Settings → Delete Account, or rollpoker.xyz/delete-account (immediate and permanent; backups and photos purged within 30 days) • Edit profile or posts → in the app • Block users → Settings → Blocked users • Report content → "⋯" menu • Opt out of product and feedback emails → reply "unsubscribe" to any of them, or email roll@rollpoker.xyz For everything else, email roll@rollpoker.xyz. EU, UK, or Switzerland (GDPR): You can ask us to: show, fix, move, limit, or delete your data. You can also object to processing or take back your consent. We respond within 30 days. You can also complain to your country's data protection authority. California (CCPA / CPRA): You can: see what we collect, delete it, correct it, or opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising. Roll does not sell or share personal information for behavioral advertising. Email us to use any of these. Other US states (TX, VA, CO, CT, UT, and others): Your state probably gives you similar rights. Email us.

• TLS in transit • Encrypted at rest in Supabase • Every database table has row-level access controls • We update dependencies and review security regularly No system is bulletproof. If we get breached, we'll tell you — and any regulator we have to notify — within 72 hours.

Roll runs in the United States. If you use Roll from elsewhere, your data crosses borders to reach us. For EU/UK/Swiss users, we use Standard Contractual Clauses with our service providers. Email us for a copy.

• Active account — as long as you keep using Roll • Deleted account — removed immediately; residual backup copies purged within 30 days (photos too) • Records we must keep by law (fraud, tax, abuse) — as long as the law says • Backups — Supabase's standard 7–30 day rotation You can't undo account deletion.

You need to be 13 or older to use Roll. If you're a parent and your under-13 kid signed up, email roll@rollpoker.xyz and we'll delete the account. In some EU countries, users between 13 and 16 may need a parent's permission.

If someone's posting your copyrighted work on Roll without permission: • Email: roll@rollpoker.xyz · subject: DMCA notice • Agent ID: DMCA-1073038 Your notice needs the six items in 17 USC §512(c)(3). The full template lives at rollpoker.xyz/legal/dmca. We take down content fast. Users who get multiple valid complaints lose their accounts.

If you're in the EU and you see content that breaks your country's law: use the in-app Report button, or email roll@rollpoker.xyz. We'll confirm we got it, review it, and tell you what we decided and why. You can push back by replying to the same email.

• Mobile app: no cookies. We store a few things locally on your device (theme, sign-in token, offline queue) so the app works. • Website (rollpoker.xyz): may use one sign-in cookie. No ad tracking. No third-party tracking.

We update this policy when things change. The "Last updated" date at the top moves. For big changes, we'll tell you in the app or by email. Using Roll after a change means you accept it.

• Email: roll@rollpoker.xyz • Web: https://rollpoker.xyz/support Use the same email for privacy questions, data requests, DMCA notices, or anything else.