Privacy Policy

Last updated: 26 October 2026

Overview

Stoa Poker (“we,” “us,” “our”) is a poker training application and website operated by EPM Labs, LLC. We respect your privacy and are committed to protecting your personal data.

Stoa Poker is purely educational. It does not offer real-money gambling, play-money gambling, or games of chance of any kind.

What We Collect

Website (stoapoker.com)

Email address, only if you voluntarily give us one:
- Our email list, if you sign up for updates. This is optional and is not required to install the app.
- Before launch, Android beta access. During the beta, Google Play required us to add testers by their Google account, one at a time, so testers who asked for Android access gave us a Google account address and we entered it into the Google Play Console. The beta ended when Stoa Poker launched on Google Play on 4 October 2026. Anyone can now install the app from Google Play, and we no longer ask for or add tester addresses.
Analytics data: anonymous page views, scroll depth, and click patterns via Google Analytics 4 (GA4). We do not collect personally identifiable information through website analytics.

App

Analytics (sent to Google Firebase)

Usage analytics and crash reports are off until you turn them on, at first launch or later in More, then Settings.

Usage events: which skills are practiced, session duration, drill decisions (correct/incorrect), navigation patterns, and feature usage via Firebase Analytics
Crash reports: anonymous error reports via Firebase Crashlytics to improve app stability, including device model and OS version
Approximate location: Firebase Analytics estimates a coarse location from your IP address. For a signed-in user, this analytics data can be connected to your account through RevenueCat, which receives both your account’s user ID and, with usage analytics on, your Firebase Analytics app instance ID.
Advertising ID: Firebase Analytics receives your device’s Android Advertising ID. We use it strictly for analytics purposes: distinguishing re-installs from genuine new installs, deduplicating users across sessions, and measuring app performance. We do not use the advertising ID for advertising, marketing, or personalized content. You can reset or delete your Advertising ID at any time via Android Settings → Privacy → Ads, or opt out of personalized advertising entirely.

Accounts (optional)

You can use the app without an account. If you sign in, with Apple, with Google, or with a link we email you, Firebase Authentication (Google) stores:

your email address
a user ID that Firebase assigns to your account
your display name, which Apple or Google supplies when you first sign in and which you can change on the Account screen
which sign-in methods are connected to your account, and when the account was created and last signed in

Firebase also logs IP addresses. On the Account screen you can connect or disconnect Apple, Google and email sign-in, and your user ID stays the same. According to Firebase, Firebase Authentication runs from data centers in the United States.

Sign-in, add-email and account-deletion emails are sent through Amazon Simple Email Service (Amazon SES), operated by Amazon Web Services in the United States. When you ask for a sign-in link, ask to add an email address to your account, or confirm deleting your account by email, our server creates the link with Firebase and sends the email through Amazon SES. Amazon SES receives your email address and the email itself, including its link. We have not turned on the Amazon SES features that store copies of sent emails. If an email bounces or is reported as spam, Amazon SES sends a notice about it to our support inbox at hello@stoapoker.com. The notice names your email address and may include a copy of the email. An address that bounces permanently or is reported as spam also goes on Amazon SES’s suppression list, which stops further emails to it. The emails carry no open or click tracking. If you use an earlier version of the app, Firebase sends these emails instead.

Our server limits how many of these emails one email address can receive and one IP address can request. To do that, it keeps two records in Google Cloud Firestore in the United States, one for the email address and one for the IP address. Each record holds a count and is stored under a hash of that address, never the address itself. A hash is a code computed from the address. For an IPv6 address, the newer and longer format, only its first half, the /64 prefix, is hashed. Each record expires at the end of the hour in which you asked for the email, and Firestore then deletes it automatically, usually within a day. Our server’s own logs record which kind of email was asked for and whether it was sent, and never your email address, your IP address or the link. Google Cloud, which runs our server, keeps its own log of each request, and that log records your IP address for 30 days.

Cloud progress storage is off by default. If you are signed in and turn it on, at first launch or in More, then Settings, your practice progress is stored in Google Cloud Firestore under your user ID, so you can restore it on another device. That includes your skill progress, a record of each drill you answer (the hand, your action, whether it was correct, and when), your streak and practice totals, your onboarding profile (first name, tester group, experience level), your tutorial progress, and your privacy settings. It is stored in the United States. Signing out or turning the setting off stops syncing and leaves the saved copy in place until you delete your account.

Sent on every launch

Three services run each time the app starts, whatever your analytics settings:

Firebase Remote Config (Google) supplies the app’s feature settings. Firebase receives an installation ID, your country code, language, time zone, operating system version and app ID. Firebase’s documentation does not say whether the country comes from your device settings or your IP address, so we treat it as approximate location.
RevenueCat manages subscriptions. It receives your purchase and subscription history from the App Store or Google Play, under your account’s user ID if you are signed in and under an anonymous ID if you are not. Your email address and name never go to RevenueCat. With usage analytics on, RevenueCat also receives your Firebase Analytics app instance ID, which connects subscription events to app analytics.
Firebase App Check (Google) checks whether requests to Firebase come from a genuine copy of the app on a real device. When the app needs a new App Check token, it sends Firebase an attestation. An attestation is a statement about the app and device, from Google Play Integrity on Android or Apple App Attest on iPhone and iPad. Firebase checks the attestation and returns a token, which the app sends with its requests to the Firebase services that support App Check. The app adds nothing of its own to the attestation: no user ID, email address or practice progress. In versions of the app where our server sends sign-in, add-email and account-deletion emails, the server rejects a request for one of those emails when the request lacks a valid App Check token. Apart from that, the Firebase services the app uses do not reject a request for lacking a valid token, so App Check blocks nothing else.

Onboarding Questions

When you first open the app, it asks three questions:

First name. It stays on your device unless you are signed in with Cloud progress storage on, when it syncs with your progress. It is never sent to analytics.
Tester group: how you primarily play poker (home game, card room, or learning)
Poker experience level: your self-reported experience (beginner, intermediate, or experienced)

Your answers are stored on your device. With usage analytics on, the tester group and experience level are sent to Firebase Analytics as user properties to help us understand how different player types use the app.

Local Data (stored on your device)

The following data is stored on your device. Items marked synced also go to Cloud Firestore while you are signed in with Cloud progress storage on (see Accounts, above). Everything else stays on your device:

Skill progress (synced): your decision history (last 20 decisions per skill with timestamps), mastery status, and spaced repetition review intervals
Drill history, streak and practice totals (synced): a record of each drill you answer, your practice streak, and your practice totals
Local telemetry: drill-level performance data including response times and session identifiers, used to power on-device analytics. It is recorded only while usage analytics is on
Tutorial progress (synced): whether you’ve completed the in-app tutorial
Privacy settings (synced): your choices for usage analytics, crash reports, Cloud progress storage and the practice reminder
Theme preference: your dark/light mode selection
Onboarding profile (synced): your onboarding responses (name, tester group, experience level)

Deleting your account, or signing in to a different account on the same device, clears the synced progress, your onboarding profile and your tutorial progress from the device.

What We Don’t Collect

No payment information on our servers (subscriptions processed through Apple App Store / Google Play)
No precise location. The app never uses your device’s location services. Approximate location is described under App, above
No contacts or phone data
No social media profiles
No photos, camera, or microphone access
No gambling data (there is none, because this is a training tool). Your subscription purchase history is handled by RevenueCat, as described above
No cross-app tracking, no ad personalization, and no advertising partners

Email Communications

If you sign up for our email list, we use SendFox to manage communications. You can unsubscribe at any time via the link in any email.

We do not sell or rent your email address, and we do not share it for anyone else’s marketing. The one case where an address was passed to a third party was the Android beta described above, where a tester’s Google account address was entered into Google Play Console for the sole purpose of granting access to the test build. That ended at launch. Nothing on this site requires an email.

Third-Party Services

Service	Purpose	Privacy Policy
Google Analytics 4	Website analytics	Google Privacy
Firebase Analytics	App usage analytics	Firebase Privacy
Firebase Crashlytics	App crash reporting	Firebase Privacy
Firebase Authentication	Optional app accounts and sign-in	Firebase Privacy
Cloud Functions for Firebase	Our server, which creates the links for sign-in, add-email and account-deletion emails and sends those emails	Firebase Privacy
Amazon SES (Amazon Web Services)	Sign-in, add-email and account-deletion emails	Amazon Web Services Privacy
Cloud Firestore	Cloud progress storage for signed-in users who turn it on, and short-lived records that limit how many sign-in, add-email and account-deletion emails are sent, created whenever someone asks for one of those emails, signed in or not	Firebase Privacy
Firebase Remote Config	App feature settings, on every launch	Firebase Privacy
Firebase App Check	App and device checks, started on every launch	Firebase Privacy
SendFox	Email list management	SendFox Privacy
Google Play	Android app distribution and subscription purchases	Google Privacy
Apple App Store and TestFlight	iOS app distribution and subscription purchases, and test builds for invited testers	Apple Privacy
RevenueCat	Subscription management. For a signed-in user, RevenueCat receives your Stoa account’s user ID, so a subscription follows your account to each device. RevenueCat keeps your purchase record after you delete your account until you ask us to remove it.	RevenueCat Privacy

Data Retention

Email addresses are retained until you unsubscribe
Firebase Analytics data is retained per Google’s standard retention policies
Local app data is retained on your device until you delete the app or clear app data
Account data and synced progress are retained until you delete your account. According to Firebase, a deleted account is removed from its live and backup systems within 180 days
Subscription records at RevenueCat are retained after you delete your account, until you ask us to remove them
Sign-in, add-email and account-deletion emails are not stored in Amazon SES for us to read. A notice about an email that bounced or was reported as spam stays in our support inbox until we delete it
Addresses on Amazon SES’s suppression list are retained until you ask us to remove them. An address goes on the list if an email to it bounces permanently or is reported as spam, and the list stops further emails to it. After a permanent bounce, Amazon SES also keeps the address on its own global list for up to 14 days, which we can’t change
Records that limit how many emails are sent are retained until the end of the hour in which the email was requested, and Firestore then deletes them automatically, usually within a day
IP addresses in Google Cloud’s request logs for our server are retained for 30 days

How to Delete Your Data

Your account: In the app, go to More, then Account, then Delete account. This deletes your Stoa account from Firebase Authentication, the progress saved to your account in Cloud Firestore, and the progress on this device. A Stoa account is meant to sign you in to every Stoa app, so deleting it removes it from all of them. Analytics data already sent stays in Firebase Analytics until its retention period ends. You can also email hello@stoapoker.com to have your account deleted.
Local app data: Uninstall the app, or go to your device settings and clear the app’s data/cache
Firebase Analytics: Google deletes analytics events when the retention period ends. They carry no name or email address. We don’t delete them before that retention period ends. To stop collection, turn off Usage analytics in More, then Settings
Subscription records (RevenueCat): Deleting your account in the app leaves your purchase record at RevenueCat. Email hello@stoapoker.com to have it removed. Apple and Google keep their own purchase records.
Email suppression list (Amazon SES): If an email to your address bounced permanently or was reported as spam, deleting your account in the app leaves your address on Amazon SES’s suppression list. Email hello@stoapoker.com to have it removed.
Email list: Click the unsubscribe link in any email, or contact us at hello@stoapoker.com

Children’s Privacy

Stoa Poker does not knowingly collect data from children under 13. Our app contains no gambling, no real money, and no social features.

Your Rights

You may request to:

Access your personal data
Delete your personal data
Unsubscribe from emails
Opt out of analytics (in the app under More, then Settings, or via browser settings or device settings)

Changes

We may update this policy from time to time. Changes will be posted on this page with an updated date.

Contact

EPM Labs, LLC Email: hello@stoapoker.com