PricingStart learning free

Privacy Policy

Last updated: 30.09.2026

This privacy policy informs you, in accordance with Article 13 of the General Data Protection Regulation (GDPR), which personal data is processed when you visit and subscribe to this website (“GTO Academy”).

1. Controller

The controller within the meaning of the GDPR is:

Sven Güttner

Walter-Hohmann-Str. 19

45128 Essen

Germany

Email: support@gto-academy.com

A data protection officer is not required under Article 37 GDPR and has not been appointed.

2. General information

GTO Academy is a subscription-based single-page application with a free, account-less preview. The parts of the site you can use without registering — the marketing and information pages including the glossary, the public range preview, a small number of free sample hands, and the solver at /solver — require no account; we only count how many free hands have been played from your internet connection so that the limit cannot simply be reset (see section 6b). The solver is a special case worth stating plainly: it calculates in your browser, on your device, and the spots you enter there are never sent to us or to anyone else (see section 6c). Creating an account removes that limit for the first chapter of the guided path, which can then be played without any count being kept at all (also section 6b). To drill in the full trainer or to subscribe, you create a user account; accounts are provided for us by Clerk (see section 4a). Access to the paid content additionally requires an active subscription, which is taken out via Stripe (see section 6).

Once you are signed in, each graded decision — in the paid trainer and in the free sample hands alike — is stored in our database under your account so that we can show you your own statistics and leak analysis (see section 6a). The training itself shows no advertising and loads no third-party advertising scripts.

Only if you actively consent via our cookie banner do we load marketing and analytics tools that measure the success of our advertising and how the website is used (in particular Google Analytics, the Reddit pixel and the session recording Microsoft Clarity; see section 3a). These are never loaded without your prior consent, and you can decline or withdraw at any time. Separately from those tools, we report completed sign-ups to Reddit from our own server so that we can tell which advertisements work; section 3b explains that processing and how to object to it. Our server also counts how often each page is requested — without cookies, without anything running in your browser and without recognising anyone (section 3c).

Personal data is otherwise processed only to the extent necessary to provide the service, as described below. No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.

3. Hosting, server logs, backups and country detection (Railway, bunny.net)

This website and the server behind it run on Railway, a cloud platform provided by Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA. Our application runs in Railway’s EU region (Amsterdam, the Netherlands).

While we complete the move of our domain away from Cloudflare, requests to this website still pass through the network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, which also provides our domain’s name servers (DNS); as long as it does, Cloudflare receives the connection data described below in the same way. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework.

When you access the website, your browser necessarily transmits data to the hosting provider’s server. The following data in particular is recorded in so-called server log files: the IP address of the requesting device; the date and time of access; the file or address (URL) requested; the amount of data transferred and the access status; the previously visited page (referrer), if transmitted; and the browser and operating system used (user agent).

The purpose of this processing is to deliver the website, to ensure stability and operational security, and to defend against attacks. The legal basis is Article 6(1)(f) GDPR (legitimate interest in a secure and functional website). The log data is not combined with other data sources and is not evaluated for marketing purposes. It is kept only for a limited period and then deleted, unless a specific security incident requires longer retention.

A data processing agreement pursuant to Article 28 GDPR is in place with Railway. Because Railway is a US company and may access the data from the USA, the transfer is safeguarded by the European Commission’s Standard Contractual Clauses (controller-to-processor module), which form part of that agreement.

Backups (bunny.net). So that your account, your subscription status and your training history are not lost if our server fails, our server copies its database once an hour to a storage service of BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia (“bunny.net”), which stores it in Frankfurt, Germany, with a second copy in Stockholm, Sweden. Each copy is encrypted on our server before it is sent, and the key never leaves us, so bunny.net holds only data it cannot read. Copies from the last 48 hours are kept, and after that one copy per day; every copy is deleted after 30 days at the latest. This means that data you have deleted, or that we have deleted with your account (section 9), can remain in an encrypted backup for up to 30 days before it is gone for good. A copy is only ever read back to restore the service after a failure. The legal basis is Article 6(1)(f) GDPR (legitimate interest in not losing our users’ data), and for the data needed to perform the contract also Article 6(1)(b) GDPR. bunny.net processes the copies on our behalf under a data processing agreement pursuant to Article 28 GDPR; the data does not leave the EU.

Country detection. To show prices in your local currency, and to decline a checkout from a country where our payment provider cannot sell, our server determines from your IP address which country your connection comes from. It uses a database stored on our own server for this (“IP to Country Lite” by DB-IP, licensed under CC BY 4.0 — IP geolocation by DB-IP); your IP address is not sent to DB-IP or to anyone else for it, and only the country is used. While requests still pass through Cloudflare, Cloudflare supplies the country as well, and we compare the two answers as totals only, without keeping any addresses. The legal basis is Article 6(1)(b) GDPR insofar as the country is needed to quote and sell a subscription, and otherwise Article 6(1)(f) GDPR (legitimate interest in showing the right price and in not selling where a sale is not possible).

Beyond these server logs and the page counts described in section 3c, we operate no analytics on the hosting layer, and no measurement beacon is served with our pages.

3a. Consent management and marketing/analytics tools (Google Analytics, Google Ads, Reddit, Microsoft Clarity)

To measure the success of our advertising campaigns, we use marketing and analytics tools from third parties. When you first visit the website, our own consent banner asks whether you agree to them. Until you answer, none of them is loaded and nothing is sent to them; if you decline, they are never loaded and the website remains fully usable. Your answer is stored in a cookie of our own (section 7).

Current status, stated plainly because a privacy policy should describe what actually happens rather than what is merely configured: as at the date of this policy, the four tools described below — Google Analytics 4, Google Ads conversion measurement, the Reddit pixel and Microsoft Clarity — are active, and each receives data only from visitors who have consented. (Earlier versions of this section named fewer tools than were running. Each was true when it was written and had stopped being true; the list is corrected here whenever it changes, and Microsoft Clarity is the most recent addition. Until 23.09.2026 the tools were executed through Cloudflare Zaraz, a tag manager run on Cloudflare’s servers; this section was rewritten when we stopped using it, and everyone who had answered the banner before is asked again, because the way the tools run has changed.)

How the tools are executed. If you consent, the tools’ own code is loaded into your browser directly from their providers — Google’s tag (gtag.js) from googletagmanager.com for Google Analytics and Google Ads, Reddit’s pixel from redditstatic.com, and Clarity from clarity.ms — and from then on your browser communicates with Google, Reddit and Microsoft directly. Each of them therefore receives your IP address and the technical information your browser sends with every request (for example the browser and operating system), and each can store and read identifiers on your device, which are listed in section 7. Before you decide, none of this code is loaded: events that occur in the meantime are held in your browser’s memory, sent if you accept and discarded if you decline.

What is measured. If you consent, we measure page views plus a short, fixed list of named events describing progress through the site: whether a drill was started, that a certain number of hands has been answered (at set milestones such as the 1st, 5th and 10th), whether the leak report, the range charts or the solver were used, when a free allowance ran out, when the pricing page was shown, which plan was selected, when an account was created, and when a checkout was started, failed or turned into a subscription. Each event carries at most a handful of attributes from a deliberately small vocabulary: which tier you are on (visitor without an account / free account / subscriber), where in the interface the event came from, which trainer mode, which scenario was drilled as a single readable key (for example “mtt·6max·30bb·BTN·rfi”), a count of hands, the plan chosen, and which allowance was affected. Your email address, your name and your user account identifier are never transmitted to these tools, and the content of your training — the cards, your individual answers, your statistics — is not sent to them either; that stays in our own database (section 6a).

Reddit pixel (Reddit conversion tracking). If you consent, the events described above are sent to Reddit, Inc., 548 Market Street, San Francisco, CA 94104, USA. Reddit’s pixel stores an identifier in a cookie on this website’s domain (“_rdt_uuid”) to recognise your browser between visits, and Reddit processes data such as your IP address, the pixel identifier, information about the pages you view and about conversion events (for example when you begin checkout or start a subscription), in order to measure and optimise the performance of our advertising on Reddit and, where applicable, to build advertising audiences. This may involve a transfer of data to the USA; Reddit relies on the European Commission’s Standard Contractual Clauses and/or the EU-US Data Privacy Framework. Reddit’s own privacy policy applies to the processing carried out by Reddit (reddit.com/policies/privacy-policy).

Google Analytics 4 (web analytics). If you consent, we activate Google Analytics 4, a web-analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for users in the EU/EEA, on behalf of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Analytics uses identifiers stored on your device (section 7) to recognise your browser, and processes data such as the pages you view, the events listed above, the referrer, a coarse location and information about your device and browser, in order to help us understand how the website is used and to improve it. Your IP address is transmitted to Google, because the requests are sent by your browser itself; according to Google, Google Analytics 4 uses it only to derive a coarse location and does not log or store it. Google signals and ad personalisation are switched off, so the data is not used to build advertising audiences for us. Data may be transferred to the USA; Google relies on the European Commission’s Standard Contractual Clauses and/or its certification under the EU-US Data Privacy Framework. Google’s own privacy policy applies to the processing carried out by Google (policies.google.com/privacy).

Google Ads (conversion measurement). If you consent, we report one of the events listed above — that a checkout turned into a subscription — to Google Ads, provided for users in the EU/EEA by Google Ireland Limited on behalf of Google LLC (addresses as above). The sole purpose is to learn which advertisements actually lead to sign-ups. Sent with each report are the address and title of the page you are on, the referring address, your time zone and your window and screen dimensions, and — if you reached us through a Google advertisement and consented to the storage described in section 7 — the click identifier of that advertisement, which is what lets a sign-up be matched to the advertisement that caused it instead of merely counted. Your email address, your name, your account identifier and the content of your training are not transmitted.

Like the other tools, these reports are sent by your browser directly to Google — to googleadservices.com, googleads.g.doubleclick.net and google.com — because matching a conversion to a click requires the request to arrive from the same browser that made the click. Google therefore receives your IP address with them and can read and set cookies for its own domains while handling them; on this website’s domain Google’s tag sets the cookie described in section 7. We do not use Google Ads remarketing: no advertising audiences are built from visits to this website. None of this happens unless you have consented, and it stops when you withdraw. Data may be transferred to the USA on the bases named above, and Google’s own privacy policy applies to its further processing.

Microsoft Clarity (session recording). If you consent, we load Microsoft Clarity, a product-analytics and session-replay service provided by Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) for users in the EU/EEA, on behalf of Microsoft Corporation (One Microsoft Way, Redmond, WA 98052, USA). Its script is loaded into your browser from clarity.ms and records how the page is used — where you scroll, where the pointer moves, where you tap or click, which elements you interact with, when a click produces nothing, together with your device, browser, screen size, approximate location derived from your IP address, the pages you visit and the referrer. From this Clarity reconstructs a replay of your visit and aggregate heatmaps, which we use for one purpose: to see where a layout, a price or a sentence loses people. Two identifiers are stored on your device for it, described in section 7.

What Clarity does not receive: text you type into forms and input fields is masked by Clarity before anything leaves your browser, so passwords, email addresses and payment details are never transmitted; your name, your account identifier and the content of your training are not sent either; and we do not use Clarity for advertising — Microsoft is told this explicitly on every load (the advertising consent signal is set to “denied” and is never granted), so the recordings are not used to build advertising audiences for us. Microsoft is an independent controller for its own further processing of Clarity data as described in its privacy statement (privacy.microsoft.com). Data may be transferred to the USA; Microsoft relies on the European Commission’s Standard Contractual Clauses and on its certification under the EU-US Data Privacy Framework. Recordings are retained by Clarity for up to 30 days and are then deleted.

The legal basis for activating these tools and for the associated storage of, and access to, information on your device is your consent pursuant to Article 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via the “Cookie settings” / “Cookie-Einstellungen” option in the consent banner; the withdrawal does not affect the lawfulness of processing carried out before it. Withdrawing ends a running Clarity recording, deletes the identifiers the tools stored on this website’s domain (section 7), and means that no tool is loaded on later visits. Any further marketing or analytics tools we may activate in future will run in the same consent-first manner and be listed here.

3b. Server-side conversion measurement (Reddit Conversions API)

Independently of the browser-side tools described in section 3a, we report a single event to Reddit from our own server when a subscription is successfully started after a checkout — but only if you consented to advertising measurement in our consent banner (section 3a); without that consent no event is sent: the fact that a sign-up occurred, a random identifier for that checkout (used to avoid double counting), your IP address, your browser identification (user agent) and your email address in irreversibly hashed form (SHA-256; Reddit can compare the hash with hashes of its own, but cannot read the address from it). If you reached us through a Reddit advertisement and you consented to the storage described in section 7, the click identifier of that advertisement is also transmitted; it is stored in your browser only in that case and is deleted after 90 days at the latest (see section 7). If you declined, no click identifier is stored on your device and none is transmitted here, with the result that the report cannot be linked to a particular advertisement.

The sole purpose is to measure which advertising campaigns actually lead to sign-ups. No profile of your use of the website is created for us in this way, and we do not receive any personal data back from Reddit. The recipient is Reddit, Inc. (see section 3a) in the USA; the transfer is based on Standard Contractual Clauses and/or the EU-US Data Privacy Framework, and Reddit’s own privacy policy applies to its further processing.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR. You can withdraw it at any time with effect for the future via the “Cookie settings” / “Cookie-Einstellungen” option in the consent banner; subscriptions started after the withdrawal are no longer reported.

3c. Counting page views on our own server, without cookies (Zählwerk)

To know how often our pages are visited, how visitors find us (for example through a search engine, a website linking to us or one of our campaigns) and which of our pages search engines and AI services read, our server counts the pages it delivers. Nothing is stored on or read from your device for this: there is no cookie, no script and no tracking pixel, and nothing is loaded into your browser. Only what your browser sends to our server anyway when it requests a page is used, and only when it requests a whole page — not for images, scripts or data the app loads afterwards. Moving between pages inside the app once it has loaded is not counted at all.

For each page requested, our web server passes the following to Zählwerk, a statistics service we run ourselves: the address of the page without its query string, except for campaign tags such as utm_source; whether the address carried an advertising click identifier (only that fact, never the identifier); the response status; the website you came from, reduced to its domain; your browser’s identification string (user agent); the first of your preferred languages; whether your browser sends the “Global Privacy Control” signal; and your IP address, shortened before it leaves our web server: for IPv4 the last of its four numbers is removed (203.0.113.57 becomes 203.0.113.0), for IPv6 everything after the first 48 of its 128 bits. The full address is passed on only when a request declares itself to be a crawler of Google, Microsoft (Bing) or OpenAI, so that it can be compared with the address ranges these companies publish for their crawlers; that is how genuine crawlers are told apart from imitations.

Zählwerk uses these details only in its working memory: it derives a few coarse characteristics — the country (from the shortened address, with the DB-IP database described in section 3; nothing is sent to DB-IP), the type of device, the browser and operating-system family, and the language — and then adds one to a counter that covers one hour, for example “page /pricing, from google.com, Germany, mobile, Safari: one more”. Requests from crawlers are counted separately, by the crawler’s name. What was passed to Zählwerk is then discarded. It keeps no IP address, no user agent, no identifier and no record of an individual visit, so you are not recognised on a later visit or on another page, no profile is created, and nothing is linked to your account or to any other data. What is stored are only these hourly counts, which contain nothing that identifies a visitor; they are deleted automatically after 25 months.

Our server also adds one to such an hourly counter for a few actions on this website: a checkout started, a subscription bought or ended, a cancellation form sent with its reason, a chapter of the training path finished, a chart drill started. Each count holds only the name of the action and a few coarse details about it: for a purchase or a cancellation the plan, the currency, whether the old or the current price applied, how many whole months a subscription ran and the reason given; for training the chapter or the chart and whether the visitor was signed in; for a checkout where on the site it was started. Never who did it, and no IP address, user agent or account.

Zählwerk runs on a server of ours at our hosting provider Railway, in its EU region (Amsterdam), and is covered by the data processing agreement with Railway described in section 3. Nothing from it is passed on to anyone else or used for advertising.

Because this counting neither stores nor reads information on your device, it does not fall under § 25(1) TDDDG. The legal basis for the brief processing described above is Article 6(1)(f) GDPR (our legitimate interest in knowing how much our website is used and how people find it, in finding pages that do not work, and in telling genuine crawlers from imitations). You can object at any time (Article 21 GDPR): open any page of this website with ?notrack=1 added to its address — for example gto-academy.com/?notrack=1 — and the page views of this browser are no longer counted, by means of the opt-out cookie described in section 7; or write to support@gto-academy.com. Because nothing is kept that relates to you, there is nothing we could later look up, hand over or delete for you (Article 11 GDPR).

4. Contacting us by email

If you contact us by email (for example at the address given in the Legal Notice), we process the data you send (your email address, the content of your message and any other details you provide) solely to handle and respond to your enquiry. The legal basis is Article 6(1)(f) GDPR (legitimate interest in responding to enquiries); where your enquiry is aimed at concluding or performing a contract, the legal basis is Article 6(1)(b) GDPR.

Your data is deleted once your enquiry has been dealt with conclusively and no statutory retention obligations prevent deletion. Your data is not passed on to third parties.

4a. User accounts and sign-in (Clerk)

To drill in the trainer or to take out a subscription you need a user account. Accounts, sign-up, sign-in and session management are provided for us by Clerk, Inc., 660 King Street, Unit 345, San Francisco, CA 94107, USA (“Clerk”), acting as our processor under a data processing agreement pursuant to Article 28 GDPR.

Depending on how you register, the following data is processed: your email address; the verification codes sent to it; if you sign in with Google, the data your Google account releases for this purpose (in particular your email address, your name and, where available, your profile picture — the login is carried out by Google, and Google’s privacy policy applies to that step, policies.google.com/privacy); and technical sign-in data such as the time of registration and of the last sign-in, the IP address and the browser used, which Clerk also processes to detect and prevent abuse (for example brute-force sign-in attempts). Clerk stores this data on our behalf and issues the session token described in section 7.

We additionally store on your account the information needed to grant access: the status of your subscription (for example active, trialing or inactive), the plan booked, the end of the current billing period, and the identifier of your Stripe customer record (see section 6). We do not store a password — sign-in works with an emailed one-time code or with Google.

The legal basis is Article 6(1)(b) GDPR (creation and performance of the user relationship and of the contract for the paid service) and, for the abuse prevention described above, Article 6(1)(f) GDPR (legitimate interest in secure accounts). Clerk processes data in the USA; the transfer is based on the European Commission’s Standard Contractual Clauses and/or the EU-US Data Privacy Framework. Your account data is stored for as long as your account exists; if you delete your account (see section 9), it is deleted, save where statutory retention obligations — in particular commercial and tax law obligations relating to the billing data held by Stripe — require otherwise. We do not use your email address for advertising unless you have separately and expressly asked us to — see section 4c, which describes the only such case and how to withdraw it.

4c. Study reminders (optional, consent only)

If you ask us to, we will send you occasional study reminders: what you last worked on, the weaknesses your own graded hands show, and news of new chapters. At most one email a week. This is entirely optional, it is never switched on by default, and the trainer works identically whether or not you ask for it.

We use a double opt-in procedure. When you press the button asking for reminders, we send a single confirmation email to the address on your account and record your request as pending. Nothing further is sent unless and until you follow the link in that confirmation email. If you never follow it, you will receive no reminders and no reminder about the reminders. The confirmation email contains no advertising.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR (and, for the sending itself, § 7(2) no. 2 UWG). To be able to demonstrate that consent as Article 7(1) GDPR requires, we store with your account: the email address the consent was given for, an identifier for the exact wording you agreed to, the times of your request and of your confirmation, and a keyed hash of the IP addresses those two actions came from. That record is kept for as long as the consent stands and for a limited period afterwards as evidence that it was validly obtained and honoured.

You can withdraw your consent at any time with effect for the future, with one click from the unsubscribe link in every reminder — no sign-in needed — or from your account. Withdrawal does not affect the lawfulness of processing carried out before it, and it does not affect service emails such as sign-in links or billing notices, which are part of the contract (Article 6(1)(b) GDPR) and are not advertising. Reminders are sent using Resend, as described in section 4b.

4b. Restoring access by email (legacy sign-in link)

Before user accounts were introduced, access could be restored by requesting a one-time sign-in link for the email address associated with a subscription. This function has been retired completely: no such links are created or accepted any more, and no email addresses are processed for it. Access to a subscription is now always obtained by signing in to your user account (section 4a) with the email address the subscription was paid with.

5. Fonts (served locally)

This website uses fonts that are served entirely locally from our own server. No connection to third-party servers (in particular not to Google) is established when the fonts are loaded, and no data is transmitted to third parties in the process.

6. Subscriptions and payment processing (Stripe)

Payment for GTO Academy is handled by Stripe (Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA / Stripe Payments Europe, Ltd. for EU customers). For subscriptions taken out through our checkout, Stripe acts as merchant of record: Stripe sells the subscription, takes the payment, determines and remits the applicable sales taxes, issues the invoice and receipt, and handles refunds and payment disputes (see the Legal Notice and the Terms). The training service itself is provided by the provider named in the Legal Notice.

When you subscribe, you provide your data (in particular your email address, billing details and payment information) directly to Stripe during checkout on Stripe’s systems. We do not receive or store your payment card data. From Stripe we receive only the information needed to grant and maintain access — in particular your Stripe customer id and your subscription’s status (for example whether it is active, trialing, cancelled or expired). The legal basis is Article 6(1)(b) GDPR (performance of the contract you enter into for the paid service).

So that we can tell which subscription belongs to which account, your user account and your Stripe customer record are linked to each other: your Stripe customer id is stored on your account (section 4a) and your account id is stored with your Stripe customer and subscription record. When your subscription changes (payment, renewal, cancellation, expiry), Stripe notifies our server and we update the access status stored on your account; where that information is missing or out of date, our server queries your subscription status from Stripe directly. Stripe’s own privacy policy governs the processing that takes place on Stripe’s systems (stripe.com/privacy). A transfer to the USA may occur; it is based on the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses. You can view and manage your subscription, invoices and cancellation at any time via the Stripe customer portal linked in the app.

6a. Training history and statistics

When you drill while signed in — in the paid trainer, and also in the free sample hands — each graded decision is stored so that the app can show you your own progress: the accuracy trend, the leak heatmap and comparable statistics. Free sample hands played without an account are not stored this way; there is no account to store them under, so they are counted (see section 6b) and kept on your own device instead. If you later create an account, the decisions held on your device are transferred into your history in the form described here, so that the chapter you were part-way through is still part-way through — this is the same data, moved at the moment there is finally somewhere to keep it, and it happens only because you registered. Each record contains only training data: the identifier of your user account, the spot drilled (game type, number of seats, stack size, position, situation), the hand class shown (for example “AKs”), the action you chose, the action the solver considers best, an assessment of your choice, the resulting score and the time of the decision. No card images, no free text and no other personal details are stored, and the data is not used to assess you as a person; it exists purely to feed your own statistics back to you.

The records are stored in a database on our server at our hosting provider Railway, in its EU region (see section 3), and covered by the same data processing agreement pursuant to Article 28 GDPR. They are not passed on to third parties and are not used for advertising. The legal basis is Article 6(1)(b) GDPR (performance of the contract — the statistics are part of the service you booked, and for a free account part of the free service you registered for). Your history is kept for as long as your account exists so that long-term trends remain meaningful; you can ask us to delete it at any time, and it is deleted with your account (see sections 4a and 9).

6b. Free sample hands (usage limit)

There is one limit on the free hands at /train and it applies to one group: visitors playing without a user account. Once you have registered, the first chapter of the guided path can be played as long as you like and nothing about it is counted; the paid content is then gated by your subscription rather than by an allowance.

Without an account. To stop the free limit being reset simply by clearing the browser or opening a private window, our server counts how many free hands have been played from your internet connection. We do not store your IP address for this. Instead the address is passed through a keyed cryptographic function (HMAC-SHA-256) using a secret key held only on our server, and only the resulting value, the number of hands played and the first and last time of use are stored in the database described in section 6a.

We should be precise about what that does and does not achieve. The stored value is pseudonymous, not anonymous: without the secret key it cannot practically be traced back to an IP address, but we hold that key, so the value remains personal data and we treat it as such. We do not use it to recognise you anywhere else on the site, and it is never combined with your account, your training history or any other record. Entries that have not been used for 90 days are deleted automatically.

With an account. Nothing is counted. There is no allowance to enforce for a signed-in visitor, so no usage counter is written against your account and the hashed value described above is no longer consulted either. Earlier versions of the service did keep a daily count per account; any such rows still present are deleted automatically after seven days, as they always were. What is stored while you are signed in is your training history, and that is described in section 6a.

In addition, while you have no account, your practice itself is kept in your browser’s local storage: the count, a summary shown back to you in the app, and the graded decisions behind it — which chapter, which hand class, what you chose and how it scored — because without an account there is nowhere else for a guided chapter to keep the progress it needs to work at all (see section 7). None of it is transmitted to us while you remain signed out, and none of it is used for analytics or advertising. It leaves your device in exactly one case: you create an account, and it is transferred into your history as described in section 6a.

The legal basis is Article 6(1)(f) GDPR (legitimate interest in offering a free tier without it being usable without limit); where the counting is tied to your account, it also serves the free service you asked us for, Article 6(1)(b) GDPR. You may object under Article 21 GDPR (see section 9).

6c. The solver (free, and calculated on your own device)

The solver at /solver is not a calculation we perform for you on our servers. The engine is downloaded with the page and runs in your browser, on your own device. The spots you build there — positions, stack sizes, board cards, bet sizes, the line you walk — are processed only on your device and are never sent to us. We hold no record of what you solve, because none reaches us.

The limit on free hands is counted in the same place: your browser’s local storage holds a short list of the hands you have already spent a free solve on, so that returning to one of them costs nothing a second time. That list stays on your device and has no counterpart in our database. Unlike the free sample hands at /train (section 6b), there is nothing here for our server to count — and we would rather say so than imply an enforcement we do not carry out. If you have consented to analytics (section 3a), the bare fact that a solve was run is included in the measurement events described there; what was solved is not.

7. Cookies and local storage on your device

Sign-in cookies (strictly necessary). When you sign in, Clerk (see section 4a) sets cookies on this domain — in particular a session cookie (“__session”) containing a short-lived, signed token that identifies your account, together with the technical cookies Clerk needs to renew that token and to protect the sign-in against abuse. Our server checks the signature of that token on every request to the protected part of the app. Two older cookies from before user accounts were introduced (“gto_session” and “gto_refresh”) are no longer set and no longer grant access; if your browser still holds one, our server ignores it and deletes it. None of these cookies contains a tracking identifier, and none is used for analytics or advertising. They are cleared when you sign out.

Because these cookies are strictly necessary to provide the service you explicitly requested (a signed-in session and access to the paid content), they do not require consent under § 25(2) no. 2 TDDDG; the legal basis for the associated processing is Article 6(1)(b) GDPR.

Consent cookie (strictly necessary). Your answer to the cookie banner is itself recorded in a cookie on this domain (“gto_consent”, currently 12 months), so that we do not ask again on every page and — more importantly — so that a refusal keeps being honoured on later visits. A cookie named “zaraz-consent” from an earlier version of the banner is deleted when found. Storing a decision is the only way a decision can have effect, which is why this one needs no consent of its own (§ 25(2) no. 2 TDDDG). You can change or withdraw the decision at any time via “Cookie settings” in the footer.

Opt-out cookie (strictly necessary). If you use our ?notrack=1 opt-out link, a cookie named “gto_no_track” (currently two years) is set in addition to the flag in local storage described below, because our server cannot read local storage and needs the cookie to leave this browser out of the page counts described in section 3c. It contains only the value “1”; ?notrack=0 deletes it. Remembering a refusal is the only way to honour it, which is why this cookie needs no consent of its own (§ 25(2) no. 2 TDDDG).

Local storage (strictly necessary). Independently of cookies, the app stores on your device: the number of free sample hands you have played, a short summary of that practice that is shown back to you in the app — the number of hands, the number answered correctly and your longest correct streak — and, for a visitor with no account, the graded decisions of the guided chapter they are working through, which is what lets that chapter keep its place (see section 6b); the list of hands you have already solved for free at /solver (see section 6c); and, if you have used our ?notrack=1 opt-out link, a flag recording that this browser is not to be measured at all. Each of these is needed to provide something you asked for — the free sample, the free solves, or the refusal to be counted — and none of them leaves your device, so they do not require consent under § 25(2) no. 2 TDDDG. No subscription or payment data is stored on your device.

Local storage (only with your consent). If you reach the website through an advertisement whose link carries a click identifier — rdt_cid for Reddit advertisements, gclid for Google advertisements — that identifier is read from the address and held in memory only. It is written to your browser’s local storage solely if you then consent via the cookie banner, so that a sign-up happening later can be attributed to the advertisement (see section 3b). Storing it is not necessary to provide the service, so the legal basis is your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG. A stored identifier is deleted automatically after 90 days at the latest. If you decline, nothing is written and any identifier stored on an earlier visit is deleted. For Google advertisements the consented identifier is additionally written to a cookie on this domain named “_gcl_aw”, in the format Google Ads expects, because that cookie is the one place Google’s conversion measurement (section 3a) looks for a click identifier; it is set by our own code and not by Google, carries the same 90-day lifetime, and is deleted along with everything else here if you decline or withdraw.

Session recording cookies (only with your consent). If you consent, Microsoft Clarity (section 3a) sets two cookies on this domain: “_clck”, which holds the identifier that lets several visits by the same browser be recognised as the same visitor (currently one year), and “_clsk”, which groups the page views of a single visit into one recording (currently one day). They are set only after you accept, and rejecting or withdrawing deletes them along with ending the recording. The legal basis is your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG.

Analytics and advertising cookies (only with your consent). If you consent, the tools described in section 3a set their own cookies on this domain: Google Analytics “_ga” and “_ga_” followed by an identifier of our property (each currently up to two years), which recognise your browser between visits; Google Ads “_gcl_au” (currently 90 days), which lets a conversion be linked to an earlier visit; and the Reddit pixel “_rdt_uuid” (and any further cookies beginning “_rdt_” that Reddit uses), which recognises your browser for Reddit’s conversion measurement. The two Clarity cookies are described above. None of these is set without your consent, and withdrawing via “Cookie settings” deletes them. The legal basis is your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG.

No other cookies are set.

8. Note for visitors from outside the EU

We apply the GDPR standard described in this policy to all visitors worldwide. We do not sell or share personal information within the meaning of US state privacy laws (such as the California Consumer Privacy Act, CCPA/CPRA). Advertising and analytics measurement happens only where you have actively consented to it (section 3a), with two exceptions that run on our own server: completed sign-ups are reported to Reddit for advertising measurement, which you can object to (section 3b), and page requests are counted without cookies and without recognising anyone (section 3c). Beyond the technical access data described in sections 3 and 3c, we process only the data needed to provide the service: your account data (section 4a), your Stripe customer id and the subscription status we receive from Stripe (section 6), your training history (section 6a) and the usage counters for the free sample hands (section 6b). What you do in the solver is not processed by us at all — it stays in your browser (section 6c). Your payment details are handled by Stripe, not by us.

9. Your rights as a data subject

You have the following rights vis-à-vis the controller:

  • the right to access the personal data processed (Article 15 GDPR)
  • the right to rectification of inaccurate data (Article 16 GDPR)
  • the right to erasure (Article 17 GDPR)
  • the right to restriction of processing (Article 18 GDPR)
  • the right to data portability (Article 20 GDPR)
  • the right to object to processing based on Article 6(1)(f) GDPR (Article 21 GDPR)
  • the right to withdraw consent at any time with effect for the future (Article 7(3) GDPR)

Note on the right to object: where we process data on the basis of a legitimate interest (Article 6(1)(f) GDPR), you have the right to object to such processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to assert, exercise or defend legal claims.

An informal message to support@gto-academy.com is sufficient to exercise your rights. If you have a user account, you can also ask us there to delete the account together with your training history; we will then delete both, save where statutory retention obligations (in particular for billing records) require otherwise; encrypted backups that still contain them are deleted within 30 days (section 3). Deleting your account does not by itself cancel a running subscription — please also cancel it via the customer portal (see section 6).

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other legal remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement (Article 77 GDPR). The authority responsible for the controller is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

11. Changes to this privacy policy

We will adapt this privacy policy whenever the data processing on this website changes. The version published on this page with the “last updated” date above applies.