Who is responsible for your data
Unmined Limited is the data controller for FreePokerUSA.com. We are an Irish company, so the EU General Data Protection Regulation (GDPR), the Irish Data Protection Acts 1988 to 2018 and the ePrivacy Regulations 2011 (S.I. No. 336 of 2011) apply.
- Operator
- Unmined Limited
- Registered office
- 27 Mount Street Upper, Dublin 2, D02 F890, Ireland
- Company type
- Irish private company limited by shares
- Company number
- 647220 (Companies Registration Office, Ireland)
- [email protected]
We have not appointed a data protection officer. Send any privacy question or request to [email protected].
The short version
- No name, email address or payment details are needed for solo guest play.
- A first-party cookie keeps your seat. Accounts store a player name, saved activity and a confirmed email address. New accounts sign in with an email code. Older password accounts retain a salted password hash.
- Account emails are separate from optional emails about game nights, features and partner offers. The optional box starts unticked and is not required to register or play.
- In the EEA, UK and Switzerland, Google Analytics runs only if you accept it in the cookie banner. Elsewhere it runs automatically. Change your choice any time in Cookie settings.
- Our own first-party daily counts stay off unless you allow them.
- We do not sell your personal data, and there is no advertising on the site.
- You can delete your account at any time from the Account screen, or email us.
What keeps your seat
A first-party visitor cookie links guests to their server save and signed-in players to their account session. Hosting providers process network requests to deliver the site.
Accounts store your chosen player name, confirmed email and private saved activity. Older accounts also retain a salted password hash:
- Your current table, dealt cards, deck, and tournament state.
- Career progress, lessons, and daily challenges.
- Room selection and preferences.
Account saves load when you sign in on another device. Guest saves remain separate. When creating an account, you can choose to copy this browser’s guest progress; signing into an existing account does not merge it.
New accounts use email codes instead of passwords, with a single-use sign-in link where enabled. A pending code step is kept on this device so you can switch to your email app and return. Codes and sign-in tokens are never kept in browser storage. Keep a backup code for important solo progress.
What we process, and why
| Data | Purpose | Legal basis |
|---|---|---|
| Visitor cookie and guest save | Keep your table, progress and settings between visits | Performance of a contract, Art. 6(1)(b). The cookie is strictly necessary for the service you asked for, Reg. 5(5) of S.I. 336/2011 |
| Account: player name, saved activity and older-account password hash | Sign-in, cross-device saves, optional public score | Performance of a contract, Art. 6(1)(b) |
| Shared account avatar, friend requests, accepted connections and private messages | Use the same player across games and communicate with accepted friends. Your email is not shared | Performance of a contract, Art. 6(1)(b) |
| Saved group names, accepted friend connections chosen for each group, and favourite game settings | Remember the private invitation lists and setups you choose to save. These lists are private to your account | Performance of a contract, Art. 6(1)(b) |
| Optional online visibility and recent account check-ins | Show accepted friends you are online only when you enable this setting. Switch it off in Account | Consent, Art. 6(1)(a) |
| Player reports and messages explicitly attached to them | Review abuse and protect players. Restricted to authorised administrators | Legitimate interests in player safety, Art. 6(1)(f) |
| Account email address and hashed one-time codes and sign-in links | Confirm registration, sign in, confirm deletion and recover older accounts. Never shown to other players | Performance of a contract, Art. 6(1)(b) |
| Private rooms: player names and portraits, invitations, seating, hand state and recent chat | Run the private game you joined. Names, portraits and messages are visible to other people in your room; private cards are filtered by player | Performance of a contract, Art. 6(1)(b) |
| Private-room reports and action receipts | Handle abuse reports and prevent duplicate or invalid game actions | Legitimate interests, Art. 6(1)(f) |
| Optional email permission: choice, wording version, time and signup surface | Record your separate permission for emails about Free Poker USA game nights, features and selected partner offers. No partner data transfer is enabled by this signup form | Consent, Art. 6(1)(a). Change your choice in Account. Any marketing email must include an unsubscribe route |
| Optional first-party game measurement | Count the first measured visit, game launch, up to 20 completed solo hands or deals, daily activity, email sign-in requests, registrations, sign-ins and later-day returns. A local counter prevents duplicate hand counts. Invitation counts after hands 5 and 15 include displays, dismissals and account-button selections. No account ID, email, cards or raw hand identity is stored in these counts | Consent, Art. 6(1)(a). Withdraw it at any time in Privacy & measurement. The local measurement counter and server records are deleted on withdrawal; consent and server records expire after 35 days |
| Google Analytics data | Understand how pages and game features are used | EEA, UK and Switzerland: consent through the cookie banner, Art. 6(1)(a), and Reg. 5(3) of S.I. 336/2011. Elsewhere: legitimate interests in improving a free service, Art. 6(1)(f). Change it any time in Cookie settings |
| Players online count and approximate US state | Show how many people are playing and, in groups of 3 or more, where from | Legitimate interests, Art. 6(1)(f) |
| Daily active play time with approximate country and US state | Measure whether the game is fun enough to keep playing, and where it is played | Legitimate interests, Art. 6(1)(f) |
| Account activity: sign-ins, solo play time and hands, academy time and saved lesson progress, private-room hosting, admissions, hands and rematches, approximate location and signup location | Maintain a private first-party member record and understand which parts of the game people use. Solo activity is browser-reported; private-game actions are server-recorded. Seen only by our team | Legitimate interests, Art. 6(1)(f). You may object by contacting us |
| Suggestions and roadmap votes | Plan what to build and limit duplicate votes and spam | Legitimate interests, Art. 6(1)(f) |
| Emails you send us | Reply to bug reports, questions and requests | Legitimate interests, Art. 6(1)(f), and legal obligation, Art. 6(1)(c), for rights requests |
| Network and security logs | Deliver the site, prevent abuse and keep it secure | Legitimate interests, Art. 6(1)(f) |
We do not use your data for automated decisions that have legal or similarly significant effects on you. The computer opponents make decisions about poker hands, not about people.
Saved groups and game setups
When you save a group, we store its name and references to the accepted friend connections you selected. A favourite setup stores its name and game rules, not cards, chips or a live game. Saved choices belong to your account and are not a public club or contact list.
Saving a group sends nothing. Creating a game with that group sends invitations inside Free Poker USA. A rematch opens a fresh room and invites available players from the previous table; nobody is automatically seated or marked ready. Removed, blocked or deleted connections cannot be used to send new group invitations.
Delete saved choices in Play with friends. Deleting your account deletes its saved groups and setups. Closing a room does not delete your saved choices. Previous room results follow the existing private-room retention period, not a permanent results archive.
First-party daily counts
These separate game measurements are optional. If you allow them, the game records limited daily events against a pseudonymous browser identifier:
- Visits, hand starts and finishes, daily-puzzle progress, resumes, and refills.
- For Dramaha beta support, the fixed rules version and broad event categories such as draw confirmation or save failure.
Optional registration-invitation measurement records whether the invitation after hand or deal 5 or 15 was shown, dismissed or selected. A successful new registration or returning sign-in can be attributed to the latest selected invitation within seven days. These records contain no account ID or email address and follow the same consent, expiry and deletion controls.
These measurement tables do not store cards, deck order, hand histories, chip balances, raw saves, or error stacks. They also exclude names, emails, passwords, page URLs, IP addresses, device fingerprints, and session recordings.
Consent expires after 35 days. Older measurements are excluded then and purged on the next measurement request. Do Not Track and Global Privacy Control are respected.
Dashboard reports are grouped and suppress groups below five browsers. In the Account screen, open Privacy & measurement to see your choice.
“Keep off / delete measurements” removes this browser’s first-party measurement records without deleting your game. It does not delete unrelated hosting logs or Google Analytics data.
Google Analytics and your cookie choice
Google Analytics measures visits and usage with the tag G-93Q28G3T6Q. It uses analytics cookies and sends page addresses, page titles, browser details, and usage events to Google.
In the EEA, the UK and Switzerland, Google Analytics loads only after you select Accept analytics in the cookie banner. If you select Reject analytics, or your browser sends Global Privacy Control or Do Not Track, it does not load. If we can’t tell where you are, we ask.
Elsewhere, Google Analytics loads automatically. Anyone, anywhere, can change their choice at any time with , also linked at the foot of every page.
Do not put passwords or personal save codes in page addresses. Read how Google uses information from sites that use its services for Google’s processing information.
Gameplay events and controls
Inside the game and on our guides, Google Analytics also receives gameplay and usage events that exclude your name, account handle, cards, and typed text. These may include:
- Table format, difficulty, hand starts and finishes, action counts, and pauses.
- Lessons, guide quiz answers, puzzle answers, and tournament finishes.
- Buttons and menus used, error codes, page speed, and connection status.
- Broad device settings such as screen-size band, theme, touch support, and connection type.
We keep broad groupings on your device, such as guest or account and roughly how many hands you have played. Custom events never include your password, save code, hand history, saved game, or anything you type.
On the Player account screen, Privacy & measurement lets you switch custom gameplay events off on this device. Global Privacy Control and Do Not Track also switch those events off.
How to turn measurement off
Playing and saving do not depend on optional analytics. These controls affect this browser:
- Google Analytics: open Cookie settings and choose Reject analytics. This turns off both page visits and gameplay events sent to Google.
- Our daily game counts: in the game, open Settings, then Privacy & measurement. Choose Keep off / delete measurements.
You can also turn off just gameplay events while keeping Google page visits. That separate choice does not turn off page visits or our daily counts.
Google account features
Google signals can link visits across devices for people signed in to Google who have allowed ads personalization. Reports can include grouped age ranges, gender, and interests; they do not show us your Google account identity.
You can review or delete Google account activity at Google My Activity and manage ads personalization at My Ad Center. These Google account settings are separate from this site’s gameplay controls.
Friends and private messages
Add someone using their exact player name. There is no public player directory or email search. They must accept before you can message; both players see the account names and avatars in their connection.
Online visibility starts off. If you switch it on in Account, accepted friends can see when this account has a recent visible-tab check-in. Hidden status and offline status look the same to friends.
We do not show your location, exact last-seen time or private-table details. Messages are not end-to-end encrypted. The service stores and delivers them; they are not sent to Google Analytics or included in public room-growth figures.
Reporting a message copies that message and both player names into a restricted review queue. Blocking or removing a connection deletes its conversation for both players. An existing report may remain for up to 90 days.
Private account activity
Our protected account records show current friend counts and counts of retained messages sent in the last 30 days. They do not show conversation text. Only messages you explicitly report are copied to the restricted safety review queue.
Players online count
While the game is open in a visible tab, your browser tells our server it is still here about once a minute. These check-ins count recently active browsers, not people or opponents at your table. The header displays cards dealt today, a separate activity total.
With each check-in we store an approximate location: your US state, “outside the US”, or unknown. It comes from Cloudflare’s estimate of where your internet connection is.
We never store your IP address, city or exact location, and VPNs and mobile networks can make the estimate wrong. Each check-in replaces the last one, and the record is deleted about 10 minutes after you close the game.
Presence totals by state are grouped only when 10 or more browsers are active. Any state or group with fewer than 3 is merged into a larger group. These are approximate aggregate counts, not a location list for individual players.
The record uses its own one-way identifier made from your visitor cookie. It is not linked to your saved game, suggestions or analytics, and it is linked to your account only as described below.
The same check-in also reports how many seconds you were actively playing since the last one, split by lobby, table, learning and other pages.
A second counts only while the tab is visible and you have tapped, typed or scrolled in the last 90 seconds, or a hand is dealing at your table.
We add these up into a daily total under the same one-way identifier, so we can see how long people enjoy the game. Each daily total also keeps that day’s approximate location: your country, plus your state if you are in the US.
The records are deleted after 35 days. After that we keep only totals per day, country and US state.
If you are signed in, we also add your active seconds, hands and the games you played to your account’s own daily record, with that day’s approximate location. We record the approximate location where an account was created, too.
Only our team can see these account records, to understand how members play. They are never shown to other players and are deleted when you delete the account.
Our private member system also records sign-ins, academy time and server-confirmed private-room hosting, admissions, completed hands and rematches. These account records are separate from optional browser analytics and marketing permission. They contain no chat text or private cards. Ask us if you want to object to account-activity analysis.
Publicly, on the Build in public page, we only ever show totals across all players.
Suggestions and roadmap votes
The suggestion form stores the topic you choose, the optional roadmap item, and your text. It does not ask for your name or email, so we cannot reply. Please don’t include personal details.
The bug report form uses the same private inbox and limits. It stores your report text under “Something is not working”. It does not attach your account, game state, private cards, messages, invitation link or device details automatically.
Suggestions are private and are never published automatically. An I want this vote records the roadmap item once per browser.
Both use a separate one-way identifier made from your visitor cookie, to stop duplicate votes and limit daily suggestions. It is not linked to your saved game, account, or analytics.
Who else handles data
We use a small number of service providers. They process data on our behalf or under their own terms, as described below.
- Cloudflare, Inc. hosts the site, the game database and our network security, and sends account emails.
- Google Ireland Limited and Google LLC provide Google Analytics and Google Fonts.
- Indian Type Foundry (Fontshare) provides the Switzer typeface.
- Our email provider receives messages you send to [email protected].
We may also disclose data where Irish or EU law requires it, or to protect the security of the service and its players. We do not sell personal data or share it with advertisers.
Transfers outside the EEA
Some providers process data in the United States and other countries outside the European Economic Area. Where they do, the transfer relies on the EU-U.S. Data Privacy Framework for certified providers, or on the European Commission’s Standard Contractual Clauses. Email us for more detail on the safeguard that applies.
How long we keep data
| Data | Kept for |
|---|---|
| Account and its saved activity | Until you delete the account |
| Shared account avatar, accepted friends, blocked players and online-visibility setting | Until removed or account deletion |
| Private saved groups and favourite setups | Until you delete the saved choice or your account |
| Unaccepted friend requests | 14 days, then removed on the next friends request |
| Private messages between friends | 30 days, then removed on the next friends request. Removed sooner when either player removes or blocks the connection, or deletes their account |
| Friend online check-ins | Online for up to 90 seconds after the last check-in; expired rows removed after 120 seconds on the next friends request. Logging out removes that session’s check-in |
| Friend safety reports and explicitly reported messages | 90 days, then removed on the next friends request, or sooner on either account’s deletion |
| Account email address | Until you change it or delete the account. Older confirmation links expire after 24 hours and password-reset links after 60 minutes |
| Email-code and sign-in-link challenges | Codes and links work for ten minutes and share a single-use boundary. A new player has fifteen minutes after verification to choose a name. Expired challenge records are removed on a subsequent code request; proofs are stored only as hashes |
| Optional email permission and its history | Until account deletion. Changing the preference records the new choice and retains the permission history |
| Guest save | While this browser keeps its cookie. Email us to have a guest save deleted sooner |
| Optional first-party measurement | 35 days, then purged on the next measurement request |
| Google Analytics event data | No longer than the retention period set in our Google Analytics property, at most 14 months |
| Players online check-ins | About 10 minutes after the game is closed |
| Daily active play time | 35 days, then only totals per day, country and US state |
| Account activity and sign-up location | Until you delete the account |
| Private-room state, recent chat, invitations, reports and action receipts | Rooms close after two hours without activity. Room records are purged seven days after closure. Deleting an account removes its main account records but does not immediately erase the shared room history seen by other players |
| Private-game delivery receipts | Up to 90 days for retry deduplication. Daily account totals remain until account deletion. Pending deliveries are checked against the account identity and discarded if it has been deleted |
| Suggestions and roadmap votes | Until we no longer need them to plan the game |
| Emails to us | As long as needed to deal with your message, and any legal obligation linked to it |
Accounts and deletion
The Account screen lets you sign out, remove an opted-in public practice score, change optional email preferences or confirm account deletion with a separate email code. Older accounts can use their password where applicable. Account deletion removes the account, its saved activity, public score and email permission records, and revokes its sign-in sessions.
The separate guest save remains. Clearing cookies breaks this browser’s link to its guest save; it does not itself erase the server record.
Private activity is not published automatically. Public practice scores require a separate choice and remain self-reported, unverified, and ineligible for prizes.
New accounts use an email code or, where enabled, a single-use sign-in link. Older accounts retain their recovery route. Keep a backup code for important solo progress. To delete a guest save or ask about your data, email [email protected].
Your rights
Under the GDPR you can ask us to:
- give you a copy of your personal data (access, Art. 15);
- correct inaccurate data (Art. 16);
- delete your data (Art. 17);
- restrict how we use it (Art. 18);
- give you your data in a portable format (Art. 20);
- stop processing based on legitimate interests, including analytics (objection, Art. 21).
Where we rely on consent, you can withdraw it at any time without affecting earlier processing. Send requests to [email protected].
Because we don’t collect real names, and email is needed only for accounts, we may ask you to sign in, use your confirmed email or provide a save code, so we know the data is yours. We reply within one month. Complex requests can take up to two more months, and we will tell you if that happens.
You have the right to complain to the Irish Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland, or to the supervisory authority where you live or work. We’d appreciate the chance to fix things first, so please contact us.
Children
FreePokerUSA.com is for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you think a child has created an account, email us and we will delete it.
Players outside Ireland and the EU
We apply this notice to every player, wherever you live, including players in the United States. The rights listed above are open to you too. We do not sell personal information.
Changes to this notice
We will update this page when the game or our providers change. The date at the top shows the latest version. If a change matters for accounts, we will also tell you in the game.