Privacy Policy

This policy explains what information the iGTO app collects, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. We built iGTO to keep data collection to what the app actually needs, and this document describes precisely what that is.

1. Who we are

iGTO is a poker strategy training app operated by Laross Consulting AB ("we", "us", "our"), the company responsible for your personal data (the "data controller").

2. What iGTO is

iGTO is a "thin client": you practice poker decisions in the app, and the game-theory analysis and grading are performed by our own backend service. To do this, the app sends the choices you make and a small amount of technical information to our servers. You can use most of the app as a guest, without an account. Signing in with Apple lets your progress follow you across devices and unlocks account features.

3. Information we collect

3.1 Account and identity

• Guest use (no account): when you first open the app it generates a random identifier stored on your device (a "device ID"). This lets us save your training progress and streaks without asking for any personal details. It is not linked to your name, email, or any advertising identifier.
• Sign in with Apple: if you choose to sign in, Apple provides us with a stable, app-specific identifier for you and — only the first time you authorize the app, and only if you allow it — your name and email address. Apple may give us a private "relay" email that hides your real address. We use this to create and secure your account. We request no other information from Apple.
• Authentication tokens: after sign-in we store secure login tokens in your device's Keychain so you stay signed in. On our servers we store only token metadata needed to keep your session secure (for example, to detect a stolen token); we do not store the token itself.

3.2 Training and usage data

As you use the app we record your poker training activity so we can grade you, track your progress, and show your history:

• Which practice spots and daily challenges you played and the action you chose on each, and whether it was graded correct.
• Aggregate statistics, daily scores, current and longest streaks, and streak "shields".
• Custom solve requests (the poker scenario parameters you configure). These describe poker situations, not you.

While you are a guest this activity is tied to your device ID. When you sign in, your guest progress is merged into your account.

3.3 Product analytics

We collect first-party analytics to understand how the app is used and to improve it. Analytics events are sent only to our own servers — never to a third-party analytics company. Each event contains:

• An event name from a fixed, predefined list (for example, a screen was viewed, a button was tapped, a daily round completed, the paywall was shown or dismissed).
• Your device ID and, once you sign in, your account ID, plus a session identifier and a timestamp.
• A small, strictly limited set of contextual properties from a fixed allow-list (such as the screen name, the element tapped, or whether an answer was correct). The app cannot attach free-form text or any other personal detail to an event — anything outside the allow-list is discarded before storage.

3.4 Device and technical data

With each request to our servers the app includes basic technical information so the service works correctly and so we can diagnose problems:

• Operating system name and version (e.g. "iOS 18"), device model (e.g. iPhone17,3), language/locale, and time zone.
• App version and build number, platform ("ios"), and a per-request identifier.
• In-app navigation context (which screen or flow you were in) to help us reproduce issues.
• IP address: like any internet service, our servers and content-delivery network necessarily receive your IP address when your device connects. We use it transiently to rate-limit abuse and we do not store it in our database or application logs.

3.5 Crash and performance diagnostics

If the app crashes, hangs, or hits an unexpected error, we collect a diagnostic report — the type of problem, a short summary (such as an exception type or a hang duration), and a call stack — and send it to our own servers. This is handled by Apple's MetricKit and our own logging; we do not use any third-party crash-reporting service. These reports are technical and are not intended to contain personal information.

3.6 Subscriptions and purchases

iGTO offers an optional paid subscription ("GT_O Pro"). Purchases are processed by Apple through in-app purchase and are managed for us by RevenueCat (see Section 5). We use these to determine whether your subscription is active. We never see or receive your credit-card or payment details — those are handled entirely by Apple. RevenueCat receives your app account ID and your purchase and subscription history; we do not send your name or email to RevenueCat.

3.7 Data stored on your device

Some information stays on your device and is not sent to us, including your login tokens (in the Keychain), your guest device ID and app settings (such as your daily-reminder preference), your daily progress and custom-spot history, and queued analytics/diagnostic events awaiting upload. RevenueCat's SDK also caches your subscription status locally.

3.8 Friends and leaderboards

When you add another player as a friend, iGTO shares a limited set of your daily challenge activity with the friends you have mutually added:

• Your chosen display name.
• Your results on each daily challenge you have completed: your score (the percentage of hands matching the solver), the expected value (EV) you gave up, and your current streak.

This information is visible only to players you have both agreed to connect with — each friend request must be accepted by the other person — and only for challenges you have completed yourself. You can remove a friend at any time, which immediately stops sharing your activity with them and removes theirs from your view.

To add a friend you must enter their exact display name. iGTO does not provide a searchable directory of users and does not reveal whether a name exists beyond confirming an exact match.

We do not sell this information or share it with third parties. Friends and leaderboards are available only to signed‑in accounts; guest play is never shared.

What we do not collect

• No advertising identifier (no IDFA) and no cross-app or cross-site tracking. The app shows no App Tracking Transparency prompt because it does not track you.
• No location, camera, photos, microphone, contacts, health, or speech-recognition data.
• No remote push notifications — the optional daily reminder is a local notification scheduled on your device, so no push token is collected.
• No third-party advertising, attribution, analytics, or crash-reporting services.
• We never receive your payment-card details.

4. How we use your information and our legal bases

For users in the European Economic Area and the United Kingdom, we rely on the following legal bases under the GDPR:

We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not use it for advertising.

5. Service providers and third parties

We share personal data only with the service providers we need to run the app. We do not sell your personal data and we do not share it for cross-context behavioural advertising. Our providers are:

We may also disclose information if required by law, to enforce our terms, or to protect the rights, safety, and security of our users or the service.

6. International data transfers

We are based in the European Union (Sweden). Some of our service providers are located in the United States or process data outside the EEA/UK. Where personal data is transferred outside the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with the provider's own compliance measures. You may contact us for more information about these safeguards.

7. How long we keep your data

• Account, training, streak, and analytics data: retained while your account exists so your history and progress remain available. When you delete your account we delete this data (see Section 10).
• Guest data: tied to your device ID; it remains until it is merged into an account you create or is otherwise removed.
• Login/session records: session-token metadata is short-lived and expired records are purged automatically (within roughly 30 days).
• Diagnostic and server logs: retained only as long as needed to investigate and fix problems.
• Purchase records: some subscription and transaction records may be retained after account deletion where we are required to keep them for accounting, tax, or fraud-prevention purposes.

8. How we protect your data

All communication between the app and our servers uses encrypted HTTPS connections. Login tokens are stored in the device Keychain, and passwords and tokens are redacted from our server logs. We limit access to personal data to what is necessary to operate the service. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.

9. Your rights

Depending on where you live, you have some or all of the following rights over your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data, including by deleting your account (see Section 10).
• Portability — receive certain data in a portable format.
• Restriction and objection — ask us to limit or stop certain processing based on our legitimate interests.
• Withdraw consent — where we rely on consent (for example, daily reminders), you can withdraw it at any time without affecting prior processing.

To exercise any of these rights, email info@gt-o.com. We will respond within the time required by applicable law. If you are in the EEA or UK and believe we have not handled your data properly, you have the right to complain to your local data protection authority; in Sweden this is the Swedish Authority for Privacy Protection (IMY, imy.se).

10. Deleting your account and data

You can delete your account and its associated data directly from within the app, in the app's settings. This permanently removes your account and the training, streak, analytics, subscription-entitlement, and unlock data linked to it (subject to the limited retention described in Section 7). If you cannot access the app, email info@gt-o.com and we will process your deletion request.

Deleting the app from your device removes locally stored data such as your login tokens and guest device ID, but does not by itself delete server-side account data — use the in-app deletion option for that. To cancel a subscription, use Settings → your Apple ID → Subscriptions on your device; deleting your account does not automatically cancel an active Apple subscription.

11. Your California privacy rights

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we collect and how we use and disclose it, to request access to and deletion of your personal information, to correct inaccurate information, and to not be discriminated against for exercising these rights. We do not sell your personal information, and we do not share it for cross-context behavioural advertising. The categories of information we collect and our purposes are described in Sections 3–5. To exercise your rights, contact info@gt-o.com.

12. Children

iGTO is intended for adults and is not directed to children. The app is rated 17+ because it depicts simulated gambling (poker); it involves no real-money gambling. We do not knowingly collect personal information from children under 13 (or the equivalent minimum age in your country). If you believe a child has provided us with personal data, contact us and we will delete it.

13. Tracking and "Do Not Track"

iGTO does not track you across other apps or websites and does not use advertising identifiers, so there is no cross-app tracking to disable. Because the app performs no such tracking, browser "Do Not Track" signals do not apply.

14. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the "Last updated" date above and, where appropriate, notify you in the app. Your continued use of iGTO after an update means you accept the revised policy.

15. Contact us

If you have any questions about this policy or your personal data, contact us at info@gt-o.com.