Controller and contact
The controller is Artem Gusakov, tax ID Y4834686P, at Calle Londres, 14, 38660 Fañabé, Adeje, Santa Cruz de Tenerife, Spain, the operator of Coldstack. For questions about your data, write to soporte@coldstack.app. This policy covers the native Coldstack iOS app and its associated services. Coldstack records information you enter; it does not accept bets, hold funds or process payments between players.
Account data
We process your email, first and last names, username, date of birth, language, currency and any profile photo you add. Your date of birth checks the 18+ requirement, including when signing up with Apple or Google; registration does not require identity documents. If you choose Apple, we receive its identifier and the details you authorise, including a relay email if you hide your address. The authentication provider manages credentials; Coldstack does not store your password in plain text. Without required details, we cannot create or maintain your account. If you choose Google, we receive your identifier, name and email to authenticate you and fill in your profile.
Sessions limits and breaks
We store the details you record for Poker —cash and tournaments—, Sports, Casino and Other: dates, duration, manually entered places, amounts, entries, top-ups, cash-outs, odds, results, titles and notes, depending on the category. We calculate history and statistics from these records. We also store your loss and duration limits, preferences and break periods. These tools operate within Coldstack and do not control external operators. Amounts are records, not bank accounts or available balances. Avoid entering health data or sensitive information in free-text fields.
Friends groups and content
We process friend requests and connections, group membership and administrator roles, messages, selected photos, shared sessions, reports and blocks. Private games record participants, entries, top-ups, cash-outs and results. Group rankings show aggregated results for the monthly period according to your sharing choices. We do not calculate a debt settlement between participants. We may receive information about you when another user sends a request, adds you to a game, mentions you or submits a report; we use it for those features and to review incidents.
What other people see
Your email and date of birth are not shown to other users as profile details. Search and requests follow your settings: Everyone, Friends of friends or Nobody. Members see the messages, images and sessions you share in their group. For aggregated results, each group lets you choose Nothing, Poker results only or All my results; this is separate from sharing a particular session in chat. Game details are visible to authorised group members. Recipients may keep copies of what they receive; changing a preference does not delete those copies.
Purposes and legal bases
Contract performance under GDPR Article 6(1)(b) supports your account, records, statistics, requested settings, social features and emails needed for access and security. Our legitimate interests under Article 6(1)(f) are protecting accounts and users, preventing fraud and abuse, reviewing reports and maintaining the service; we limit these uses to what is necessary and you may object on grounds relating to your situation. Legal duties are addressed under Article 6(1)(c). We do not send advertising or build commercial profiles. Any new optional processing based on consent will be explained separately, with a way to withdraw it.
Providers and recipients
Supabase provides authentication, database, storage and backend services. Resend sends authentication and security emails, processing the recipient address, content —including access or confirmation links— and technical delivery data. Apple participates if you choose Sign in with Apple and in device services, applying its own terms within its role. Our support mailbox provider processes the enquiries you send us. Authorised support or security staff access data only when their task requires it. We also disclose data when legally required by a competent authority. We do not sell data to advertisers. If you choose Google, its sign-in service processes your identifier and may collect your IP address to prevent fraud.
Location and international transfers
The main database is hosted in Paris, France, in Supabase's eu-west-3 region. Auxiliary services, support and subprocessors may involve processing in other countries. Resend stores email data in the United States even when sending from a European region. International transfers are governed by provider processing agreements and applicable safeguards, including European Commission standard contractual clauses where relevant. You can request information and a copy of applicable safeguards at soporte@coldstack.app.
Data retention
Account details, settings and saved sessions: while you maintain the account, unless deleted earlier. Live sessions and unclosed games: discarded after 24 hours without generating a finished session. Shared messages and histories: while the relevant conversation or group exists, subject to your erasure requests and other participants' rights. Support enquiries and reports: until the request or incident is resolved; if a claim arises, during its handling and applicable legal periods. Under the current plan, Supabase API and database technical logs have one-day retention; writing new authentication audit events to the database is disabled. Resend retains emails and logs for 30 days and states a seven-day backup period. Supabase Free does not include scheduled project backups. Technical copies are not erased instantly when you delete your account. Retention for a specific legal duty is limited to the required data and period, with restricted access.
Deleting your account
Request deletion from Profile → Delete account or write to soporte@coldstack.app; we verify the request is yours without asking for your password. The process removes your account, profile, personal sessions, friendships and group membership, and cleans up the associated files it manages. Some text messages and closed-game histories may remain for other participants with the account link removed. Written text and names saved in those histories may still identify you: unlinking is not anonymisation. You may request a review and erasure of that data. We do not promise immediate backup erasure or an automatic confirmation email.
Your rights
You may request access, rectification, erasure, restriction, objection and portability where applicable, and withdraw consent for processing based on it. Edit your profile in the app and export your sessions as CSV from Account → Export data; that file does not include all account or social data. For other requests, write to soporte@coldstack.app. We normally respond within one month; if a lawful extension is needed, we inform you within that month. You may complain to the AEPD, www.aepd.es, or the relevant supervisory authority. If you believe someone under 18 has an account, tell us so we can investigate.
Device security and changes
The app uses device storage to maintain access and settings, and caches of data already loaded. Saving changes requires a connection; there is no persistent queue guaranteeing later synchronisation. Photos are selected through system controls; we do not access your whole library or use GPS for places you type. With permission, iOS schedules local reminders, including warnings before sessions are discarded; disable them in Settings. This version uses no advertising cookies or advertising or product-analytics SDKs. Providers generate technical logs such as IP addresses, access times and errors. We use encrypted communications and access controls without guaranteeing absolute security. We notify you before significant changes take effect.
↑ Back to top