Privacy Policy

Introduction

This Privacy Policy describes how RangeIQ Poker ("RangeIQ", "we", "us", or "our"), operated by IQ Digital Holdings LLC, a Nevada limited liability company, collects, uses, stores, and protects your information when you use our marketing website (rangeiqpoker.com) and web application (app.rangeiqpoker.com), collectively the "Service".

By creating an account or otherwise using the Service, you agree to the practices described in this Privacy Policy. We are committed to protecting your personal information and your right to privacy, and to being transparent about what we collect and why.

Information We Collect

Account information. When you create an account, we collect:

• Your email address (required)
• An encrypted password hash (we never store your plaintext password)
• If you sign in with Google: your name, email address, and Google account identifier (we do not receive your Google password)
• Your account creation date and last sign-in timestamp

Subscription and billing information. If you subscribe to a paid plan:

• Subscription status, plan type, billing period, and renewal dates
• Payment method metadata (card type, last four digits, expiration) — we do not store full card numbers; these are handled by our payment processor
• Billing address and country (collected by our payment processor for tax compliance)
• Transaction history including dates, amounts, currencies, and applicable taxes

Promotional grant information. If you redeem a comp or promotional access code:

• The redemption code used, the date of redemption, and the duration of access granted
• Notes associated with the grant (such as the source of the promotion)

Usage data. When you use the Service:

• Pages visited, features used, buttons clicked, and session duration
• Hand histories, saved spots, drill responses, and Study Vault entries you create within the app
• Affiliate referral identifiers, if you arrived via an affiliate link
• Error logs and crash reports (including browser console output) used to diagnose issues

Device and connection information. Automatically collected when you visit the Service:

• IP address and approximate location (derived from IP, typically at the city level)
• Browser type and version, operating system, and device type
• Referring URL and the time and date of your visit

Communications. Any messages, support requests, or feedback you send to us, including the content of those messages and your contact information.

How We Use Your Information

We use the information described above to:

• Provide, operate, secure, and improve the Service
• Generate IQ Reasoning explanations for engine recommendations using the limited hand-state data described in the Sub-Processors section
• Authenticate you and maintain your active session
• Process subscription payments, manage billing, and apply applicable taxes
• Apply, validate, and enforce promotional grants and comp codes
• Send transactional emails such as receipts, password resets, magic-link sign-in codes, comp expiration warnings, and account notifications
• Send marketing communications (only if you have explicitly opted in by subscribing to our newsletter; you can unsubscribe at any time)
• Respond to your support inquiries and feedback
• Track affiliate referrals and pay affiliate commissions
• Detect, prevent, investigate, and address fraud, security incidents, and abuse
• Comply with legal obligations, respond to lawful requests, and enforce our Terms of Service

Cookies and Tracking Technologies

We use cookies and similar technologies, grouped into essential cookies (always active) and non-essential analytics and advertising-measurement tools (loaded only with your consent). We do not sell your personal information or use it for cross-site behavioral advertising profiles.

Essential cookies. Required for the Service to function. These do not require consent and include:

• Authentication cookies set by Supabase, which keep you signed in across pages and sessions
• Session and security cookies used to prevent cross-site request forgery and similar attacks
• Affiliate attribution. If you arrive via an affiliate link, our partner Tolt sets a first-party cookie (typical duration: 90 days) to attribute any subsequent subscription to that affiliate. Disabling it only affects affiliate attribution, not your use of the Service.

Non-essential analytics and advertising measurement. With your consent, we use the following to understand aggregate usage and measure our marketing. These are loaded only after you select “Accept all” in our cookie banner, and remain disabled if you decline:

• Google Analytics 4 — aggregate traffic and usage analytics
• Google Ads — conversion measurement and remarketing for our advertising
• Microsoft Clarity — aggregate session analytics and heatmaps used to improve usability

We also use Vercel Analytics, a privacy-friendly, cookieless analytics tool that does not track you across sites and runs regardless of your consent choice.

Consent management. We display a cookie consent banner and use Google Consent Mode v2. Until you choose “Accept all,” the analytics and advertising tools above are held in a consent-denied state and do not store cookies or identifiers on your device. You can change your choice at any time by clearing this site’s storage in your browser, or by contacting us at privacy@rangeiqpoker.com. You can also disable or delete cookies through your browser settings; if you disable essential cookies, parts of the Service may stop working, including your ability to remain signed in.

Third-Party Services and Sub-Processors

We use the following third-party service providers ("sub-processors") to operate the Service. Each provider has its own privacy practices; we encourage you to review them:

We do not sell, rent, or trade your personal information to third parties. Sub-processors are bound by data-processing agreements that limit their use of your information to the purposes for which we engage them.

Data Sharing and Disclosure

We do not sell your personal information. We share your information only in these limited circumstances:

• With sub-processors as described in the previous section, under contractual confidentiality and data-protection obligations
• With affiliates who referred your subscription, limited to commission-attribution metadata (we do not share your full account details with affiliates)
• To comply with legal obligations, valid court orders, subpoenas, or government requests, or to defend against legal claims
• To protect rights and safety, including investigating suspected fraud, abuse, or violations of our Terms of Service, and to protect the safety of our users or the public
• In connection with a corporate transaction, such as a merger, acquisition, financing, or sale of assets. In such an event, we will provide notice to affected users by email at least 30 days in advance of any change in how their information is controlled, where reasonably practicable

Data Security

We implement reasonable technical and organizational measures to protect your information against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption in transit (HTTPS / TLS) for all communications between your device and the Service
• Encryption at rest for stored data within Supabase
• Hashed and salted password storage; we never store plaintext passwords
• Restricted internal access to user data on a need-to-know basis
• Payment card data handled exclusively by Paddle, a PCI-DSS-compliant payment processor; full card numbers never reach our servers

No method of transmission over the internet or electronic storage is 100% secure. While we work to protect your information, we cannot guarantee absolute security.

Data Retention

We retain personal information only as long as necessary for the purposes described in this Privacy Policy or as required by applicable law:

• Active accounts: retained until you request deletion
• Deleted accounts: personal information is purged from our active systems within 90 days of the deletion request, except where retention is required by law (such as billing records) or where information has been anonymized
• Billing and transaction records: retained for at least 7 years to comply with applicable tax, accounting, and regulatory requirements
• Support communications: retained for up to 3 years from the date of the last communication, then deleted
• Server logs and analytics: retained for up to 12 months in identifiable form, then aggregated or deleted
• Affiliate attribution cookies: retained for 90 days from initial visit, after which attribution expires

Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access: request a copy of the personal information we hold about you
• Correction: request that we correct inaccurate or incomplete information
• Deletion: request that we delete your personal information, subject to legal retention requirements
• Portability: request your data in a structured, commonly used, machine-readable format
• Restriction or objection: request that we restrict or stop certain processing of your information
• Opt out of marketing: unsubscribe from marketing emails at any time using the link in any marketing email, or by contacting us
• Withdraw consent: where we rely on your consent to process your information, withdraw that consent at any time without affecting the lawfulness of processing before withdrawal

To exercise any of these rights, contact us at privacy@rangeiqpoker.com. We will respond within the timeframes required by applicable law (typically 30 days). We may need to verify your identity before fulfilling your request.

California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act provide you with specific rights regarding your personal information, including the rights described above. In addition:

• Right to know: request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the purposes for collection, and the categories of third parties with whom we share it
• Right to opt out of sale or sharing: we do not sell or share your personal information for cross-context behavioral advertising. There is nothing to opt out of
• Right to non-discrimination: we will not discriminate against you for exercising any of your CCPA/CPRA rights
• Right to limit use of sensitive personal information: we do not use sensitive personal information for purposes that would trigger this right

To exercise any CCPA/CPRA right, contact us at privacy@rangeiqpoker.com. You may also designate an authorized agent to act on your behalf, subject to verification.

European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (or its UK or Swiss equivalent) applies to our processing of your personal information.

Data controller. IQ Digital Holdings LLC is the data controller for personal information collected through the Service.

Legal bases for processing. We process your personal information on the following legal bases:

• Performance of a contract: to provide the Service you have requested and to manage your account and subscription
• Legitimate interests: to operate, secure, and improve the Service, prevent fraud, and communicate with you about your account — provided these interests are not overridden by your rights
• Consent: for marketing communications and any non-essential cookies (where applicable)
• Legal obligation: to comply with tax, accounting, and other legal requirements

International transfers. Your personal information is transferred to and processed in the United States. Where we transfer personal information from the EEA, UK, or Switzerland to the United States, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms required by applicable law.

Right to lodge a complaint. You have the right to lodge a complaint with your local data protection authority. We would, however, appreciate the opportunity to address your concerns before you contact a regulator — please write to us at privacy@rangeiqpoker.com.

Children's Privacy

The Service is not intended for, and is not directed to, individuals under the age of 18. We require all account holders to be at least 18 years old, both because the subject matter of poker strategy is intended for adults and because many jurisdictions restrict poker-related content to adults.

We do not knowingly collect personal information from individuals under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@rangeiqpoker.com and we will take steps to delete that information promptly.

International Users

The Service is operated from the United States. Regardless of your location, when you use the Service your information may be transferred to, stored, and processed in the United States and other jurisdictions where our sub-processors operate. Data protection laws in those jurisdictions may differ from those in your country of residence. By using the Service, you consent to such transfers, subject to applicable safeguards.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable law. When we make material changes, we will notify you by updating the "Last updated" date at the top of this policy and, where appropriate, by sending you an email or displaying a notice within the Service.

Your continued use of the Service after a revised Privacy Policy takes effect constitutes your acceptance of the changes.

Contact Us

If you have any questions about this Privacy Policy, our data practices, or to exercise any of your rights described above, please contact us: