Privacy.

Last updated 22 October 2026.

The short version

Felt Reps keeps what it needs to deal you spots, grade them, keep your progress and, if you subscribe, know what you paid for. You can play the first 10 spots without giving us your name or email. We never sell your information, there are no ads, and Felt Reps sets no cookies of its own.

Who is responsible

Mooky Consulting Ltd., of 2150 Winston Park Drive, Unit 203 #1558, Oakville, ON L6H 5V1, Canada, runs Felt Reps and decides how your information is used (under the GDPR, the controller). Email contact@feltreps.com about anything in this policy.

What we keep, why, and for how long

Each item below says what it is, why we keep it, the legal reason that allows it (for people in the EU and the UK), and how long it is kept. "Our contract with you" means we need it to give you the service you asked for. "Legitimate interests" means we need it to run Felt Reps fairly and safely, and we have weighed that against your privacy.

Session id: A random id your browser gets the first time you open the drill, with no name or email behind it until you sign up. It ties your answers and your free spots to you. Our contract with you. Kept until you ask us to delete it.
Email address: If you sign up or sign in by email. We use it to send sign-in links, and to write to you about your account and your subscription: a renewal reminder, your plan ending, a price change, a change to these terms or this policy, and a note when your account is deleted. Reminders (a weekly recap, your streak, your free spots coming back) only if you ask for them. You can turn any of these off in Settings, and every reminder has a link that stops it. When you print a cheat sheet, your account email is printed at the bottom of each page. We don't keep the printout. Our contract with you, and, for reminders, your consent. Kept until your account is deleted.
Sign-in provider: Whether you signed in by email, with Google or with Apple. With Google, Google tells us your Google account id, your email address and, if you have set them, your name and profile picture. With Apple, Apple tells us your Apple account id and your email address, or, if you chose to hide it, a private address Apple forwards to it. Our contract with you. Kept until your account is deleted.
Your session's IP address and browser: Supabase, which runs sign-in, records the IP address and browser of every session, to keep sign-in secure. That is part of Supabase's own security records, kept under Supabase's own retention, not one we set. Legitimate interests (keeping sign-in secure).
Your answers: For every spot you answer: which type of spot it was and the exact situation within it, the settings it was dealt with and the random draw behind the deal, what you chose, whether it was right, and when. That is your history, and your progress is built from it. Our contract with you. Kept until your account is deleted.
The deal log: For every spot we deal you: who it was dealt to, when, and whether it was a free spot, a daily spot, a subscriber's spot or a shared one. It enforces the limits described in the terms. Legitimate interests. Deleted within three days.
The cheat-sheet log: For every cheat sheet we show you and every time you print a seat's sheets: which account, a scrambled form of your IP address (the same daily scramble as the deal log's), when, whether it was a sheet on screen or a printout, and which spot or seat it was for. It counts a free account's sheets for the day and limits how many sheets one account or one network can open. Legitimate interests (keeping the free sheets fair and stopping anyone copying the strategy). Deleted within three days.
A scrambled form of your IP address: Kept next to each entry in the deal log and the cheat-sheet log, to limit how many free spots and sheets one network gets and to stop anyone pulling the strategy out of the drill or the sheets. The scramble changes every day, so it cannot be linked from one day to the next by anyone without our key. In our own tables, we never store your IP address itself, only this scrambled form; Supabase and PostHog see your real IP address, as described above and below. Legitimate interests. Deleted with its log entry, within three days.
A scrambled device fingerprint: A script in your browser (ThumbmarkJS) works out a fingerprint from how your browser and device are set up, such as the screen, the fonts and the graphics card. Your browser sends it with each spot it asks for, and we keep only a scrambled copy of it, made with a secret key of ours so it cannot be turned back into the fingerprint, next to how many free spots that device has used and which version of the sign-up screen it was shown. It is how a new browser or a private window on the same device carries on the same free count. Legitimate interests (keeping the free spots fair). Deleted 13 months after the device was first seen.
Your time zone: The time zone your device reports, kept from the first time you use the drill, so your 3 daily spots, and a free account's daily cheat sheets, come back at your midnight. Our contract with you. Kept until your account is deleted.
Your free spots: How many free spots you have used, the day you signed up, how many of today's spots are gone, and, with a free account, which game your free cheat sheets are for and the day it was chosen. Our contract with you. Kept until your account is deleted.
Your subscription: If you subscribe: your plan, whether it is active, when it renews or ends, and the ids Stripe gives your customer record and your subscription. Your card details go to Stripe and never reach us. Our contract with you, and the law, which requires sales records for tax. Kept while you have an account; Stripe keeps its payment records for as long as tax and accounting law requires.
Your notification choices: Which emails and reminders you turned on or off, and, so we can show you asked, when, how (in Settings, at sign-up, from the offer in the phone app, or from a link in an email) and the words you were shown. Your consent, and the law, which asks us to keep proof of it. Kept until your account is deleted.
Your phone's notification address: If you allow notifications in the phone app: the address Apple or Google gives your phone for them, whether it is an iPhone or an Android phone, and the language the app is in. Only to send you the reminders you turned on. Your consent. Kept until Apple or Google tells us the app is gone from the phone, or your account is deleted; turning notifications off on the phone stops them at once.
What we sent you: For each email or reminder: which kind it was, when it went, and whether it was opened. It keeps us from sending you the same thing twice or more than one reminder a day. When an address bounces or someone marks our email as spam, we keep a scrambled form of the address so we never write to it again. Legitimate interests. Kept 13 months; the scrambled address is kept until you ask us to remove it.
Shared spots: When you share a spot, we keep the spot (its type, its settings and the random draw behind it) and which session shared it, so the link keeps working. Our contract with you. The spot is kept so the link still works; it stops being linked to you when your account is deleted.
Usage events: Short records of what happens in the app, sent to PostHog, an analytics service, so we can see which drills get used and where people stop. There are twenty-two kinds of event: opening the app or the front page, opening a drill, waiting for a spot to be dealt (and for how long), answering a spot, finishing the front page's spots, meeting the daily goal, turning auto-deal on or off, sharing a spot, answering "what do you play?", being offered to save your progress, reaching the end of the free spots, starting a sign-up, finishing one, being shown the plans, going to checkout, starting a switch to the yearly plan, deleting an account, being shown a leak, opening a cheat sheet, printing one, being refused a cheat sheet or a printout, and linking your history to your account when you sign up or sign in. Opening a drill, starting or finishing a sign-up, being shown the plans and starting a switch to the yearly plan say so when they happen from a cheat sheet. They carry a random id rather than your name, the drill and spot type, whether you were right, your game settings, how many leaks the end-of-run and plans screens counted (just the number), which version of the sign-up screen you were shown, whether you have an account or a plan and whether a cheat sheet was for your own game, which seat a printed sheet was for, why a sheet or a printout was refused and which plan you had then, and, when you open the drill from a link someone shared, that it was a shared link, and, when that link also says where it was posted (a reply on Reddit, say), that place. Going to checkout says which plan you chose and, in the phone app, whether you are paying through the App Store or Google Play. Starting a switch to the yearly plan says which plan you had and where it is paid for: through Stripe on the web, or in the App Store or Google Play. Deleting an account says whether it still had a plan in the App Store or Google Play. PostHog also receives your IP address when each event is sent, and uses it to work out a rough location. When you sign up or sign in, that random id is linked to your account id so your history before and after lines up. No cards, no hand histories, nothing you type. Legitimate interests. Kept by PostHog for up to one year.
Error reports: When something breaks, in the app or on our server, a report goes to Sentry, an error-tracking service, so we can find the fault and fix it. A report from your browser has the error message, where in our code it happened, your browser and operating system, and which page you were on. When a page's address carries a sign-in link or a checkout, that part is cut off before the report goes. A report from our server has the error and which part of the server it came from. There is no name, no email address and no account id in a report, nothing you type, and no recording of your screen. Sentry sees your IP address when a report arrives, as any website does, and is set not to store it. Reports are only sent when something goes wrong. Legitimate interests (keeping Felt Reps working). Kept by Sentry for up to 90 days.

When you open the drill, we read which country your connection comes from to suggest the games played there and to show prices in your currency. We don't store it.

The drill also keeps your settings and progress in your own browser (see "Cookies and local storage"). Clearing your browser data erases that copy.

Who helps us run it

These companies process information for us, and only to provide their part of Felt Reps:

Supabase: our database, sign-in and server. Everything in "What we keep" is stored there.
Vercel: hosts the website.
Stripe: takes payments and runs the page where you manage your subscription. Stripe gets your email, your Felt Reps account id, your card and the name on it, and any billing address checkout asks for.
PostHog: usage events.
Sentry: error reports.
Resend: sends the sign-in emails, the emails about your account, and any reminders you ask for, and tells us when one bounces or is opened.
Google: if you choose to sign in with Google, and, on an Android phone, to deliver the notifications you allow.
Apple: if you choose to sign in with Apple, and, on an iPhone, to deliver the notifications you allow.

We do not sell your information, and we do not give it to anyone else unless the law requires us to.

Cookies and local storage

Felt Reps sets no cookies. The drill keeps its own data in your browser's local storage. Under keys starting poker. it keeps your settings, your session stats, how you have done in each situation you have been dealt, which spot types you have been dealt, your daily count and level, answers not yet sent, a random id for usage events, and where you stand on the free spots. Under keys starting sb- it keeps the session that signs you in. Stripe's checkout and subscription pages run on Stripe's own site and may use cookies there under Stripe's own policy.

Your rights

You can ask us for a copy of what we keep about you, in a form you can take elsewhere; to correct it; to delete it; or to stop or limit how we use it. Email contact@feltreps.com from the address on your account. Without an account, tell us roughly when and from which browser you used the drill, so we can find it. We answer within one month. You can also delete your account yourself, with Delete account on your account screen in the drill. Deleting your account deletes your answers, your free-spot record and your subscription record, and unlinks any spot you shared. It also ends your subscription at once, with no refund for the time left. If you are in the EU or the UK and unhappy with how we handled a request, you can complain to your data protection authority.

If you live in California: we do not sell or share your personal information, as the California Consumer Privacy Act (as amended by the California Privacy Rights Act) defines those words, and we do not use it for targeted advertising. You have the right to know what we collect, to have it deleted or corrected, and not to be treated differently for using those rights.

Children

Felt Reps is not for anyone under 18. If we learn that someone under 18 has an account, we delete it.

Where your information goes

The companies above may store or process information in the United States and in other countries outside the EU and the UK. Where they do, they rely on the protections the law requires for those transfers, such as the European Commission's standard contractual clauses and the UK's addendum to them.

Keeping it safe

Your answers and your account can be read only by you and by our server. In our own tables, IP addresses and device fingerprints are kept scrambled; see "What we keep" for where Supabase and PostHog see them directly, for their own purposes. Card details never reach us. No system is perfectly safe; if something goes wrong that affects you, we tell you and the authorities as the law requires.

Changes to this policy

The date at the top says when this policy last changed. If a change matters to how your information is used, we email account holders before it applies.

How to reach us

Email contact@feltreps.com, or write to Mooky Consulting Ltd., 2150 Winston Park Drive, Unit 203 #1558, Oakville, ON L6H 5V1, Canada.