We collect the minimum needed to run XPloit, and we don't sell your data.
This Privacy Policy is effective as of July 25, 2026 and was last updated on July 25, 2026. It supersedes the version dated February 18, 2026, and now covers the XPloit mobile app as well as the website. By using XPloit, you agree to the collection and use of information in accordance with this policy.
Account information. When you create an account, we collect your name, email address, and authentication credentials through our authentication provider. You may also provide a profile photo or display name.
User-provided content. Hand histories, notes, chat messages, coaching interactions, and any other content you submit to the platform. This includes text you type into review sessions, practice sessions, and coaching conversations.
Usage data. We automatically collect information about how you interact with XPloit, including pages visited, features used, session duration, practice hands completed, and performance metrics (grades, streaks, spot types).
Device and technical data. Browser type and version, operating system, device type, IP address, referring URL, and general location (city/region level, derived from IP).
Voice input. Where you can dictate your reasoning instead of typing it, the recording is transcribed by the speech recognition built into your browser or device, which may process the audio on that vendor's servers under their own privacy policy (for example Apple on iOS, or your browser vendor on the web). We receive only the resulting text, and we do not store the audio.
Billing information. Payment processing is handled entirely by our payment providers: Stripe for subscriptions purchased on the web, and Apple's App Store (via RevenueCat) for subscriptions purchased inside the mobile app. We do not store your credit card number, CVV, or full payment details on our servers. We receive and store only transaction metadata: plan type, subscription status, and billing cycle dates.
Analytics and diagnostics. We collect product analytics (which screens and features are used) and crash/error diagnostics. What gets stored on your device depends on your region, and you can turn analytics off entirely. See “Analytics and error monitoring” below.
Guest activity. You can play a Daily Spot or a shared hand without an account. When you do, we store the play-through and a randomly generated guest identifier so the result can be shown back to you and claimed if you later sign up. This is not linked to a name or email unless you create an account.
Cookies and local storage. We use essential cookies for authentication sessions, and browser local storage to preserve your in-progress work (such as review state and chat history). Analytics storage is region-dependent and is never set in the EU, UK, EEA, or Switzerland. We do not use third-party advertising cookies. See our Cookie Policy.
Mobile app storage. The app stores your authentication session in the operating system's secure storage, and keeps hands, practice scenarios, and pending saves on the device so it works offline. Local data is removed when you sign out or delete the app.
We use the information we collect to:
We will not use your data for purposes materially different from those listed here without notifying you and, where required by law, obtaining your consent.
XPloit uses large language model (LLM) providers to power coaching, grading, and practice hand generation. When you use these features, relevant content (such as hand histories, your written reasoning, and board/action context) is sent to third-party AI inference providers for processing.
We minimize what is shared: only the data necessary to generate a response is transmitted. Your name, email, and account identifiers are not included in AI requests. AI providers process data according to their own privacy policies and data processing agreements, and we select providers that do not use customer inputs for model training.
Our current AI inference provider is OpenAI. This list may change as we evaluate providers; material changes will be reflected in updates to this policy.
Product analytics (PostHog). We count things like which screens are opened, which features are used, and where people drop out of a flow, so we know what to build and fix. If you are signed in, these events are associated with your account.
We do not put a cookie banner in front of you. Instead, how we store this depends on where you are. In the EU, UK, EEA, and Switzerland, analytics runs in memory only: nothing is written to your device, the identifier is discarded when you close the tab or the app, and your IP address is dropped from the events. Because nothing is stored on your device, there is no cookie to consent to, and the measurement itself rests on our legitimate interest in understanding how our own product is used. Everywhere else, we keep a first-party identifier on the device so we can tell a returning visitor from a new one. If we cannot determine your region, we default to the memory-only mode.
You can switch analytics off entirely in Settings under Privacy, on the web and in the app. That stops collection and clears what is stored on that device.
Error and crash monitoring (Sentry). When something breaks, we collect the error, the page or screen it happened on, and technical context needed to reproduce it. In production, Sentry may also capture a short replay of the moments leading up to an error. This is triggered by errors only, not by ordinary use, and text content is masked by default. We do not record normal browsing sessions.
Campaign attribution. If you arrive from a link with campaign parameters, we record which campaign brought you (first and most recent). We keep the referring website's hostname only, never the full referring URL, and in the regions described above this is held in memory rather than written to your device.
Most of XPloit is private to you. These features are the exceptions, and all of them are opt in:
Deleting a share, comment, or account removes it from these surfaces going forward, but we cannot recall copies that other people already saved or screenshotted.
We use the following categories of third-party services to operate XPloit:
Each provider receives only the minimum data necessary to perform its function. We maintain data processing agreements with our key providers where applicable. We do not sell, rent, or share your personal information with third parties for their own marketing purposes.
We implement reasonable technical and organizational measures to protect your data, including:
No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If we become aware of a security breach that affects your personal information, we will notify affected users and relevant authorities as required by applicable law, typically within 72 hours of confirmation.
We retain your data for as long as your account is active or as needed to provide you services. Specifically:
You can delete your account and its associated data directly from account settings, on the web and in the mobile app. You can also email admin@xploitpoker.com with the subject line “Account Deletion Request.” We will process emailed requests within 30 days and confirm completion by email.
Depending on your jurisdiction, you may have the following rights regarding your personal data:
California residents (CCPA): You have the right to know what personal information we collect and how it is used, to request deletion, and to opt out of the sale of personal information. We do not sell personal information.
European residents (GDPR): Our legal bases for processing include consent (where you have provided it), contract performance (to deliver the service you signed up for), and legitimate interests (to improve and secure the platform). You may withdraw consent at any time. You have the right to lodge a complaint with your local data protection authority.
To exercise any of these rights, contact us at admin@xploitpoker.com. We will respond within 30 days (or sooner if required by applicable law).
XPloit is operated from the United States. If you access XPloit from outside the United States, your data may be transferred to, stored, and processed in the United States or other countries where our service providers operate. By using XPloit, you consent to such transfers. We rely on standard contractual clauses and other lawful transfer mechanisms where required.
XPloit is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe a child under 18 has provided us with personal information, please contact us at admin@xploitpoker.com.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on this page with a new “last updated” date, and where appropriate, by email. Your continued use of XPloit after changes are posted constitutes acceptance of the revised policy.
If you have questions about this Privacy Policy or how we handle your data, contact us at admin@xploitpoker.com.