Start free training

Privacy Policy

Last updated: 09.08.2026

This privacy policy informs you, in accordance with Article 13 of the General Data Protection Regulation (GDPR), which personal data is processed when you visit and subscribe to this website (“GTO Academy”).

1. Controller

The controller within the meaning of the GDPR is:

Sven Güttner

Walter-Hohmann-Str. 19

45128 Essen

Germany

Email: info@gto-academy.com

A data protection officer is not required under Article 37 GDPR and has not been appointed.

2. General information

GTO Academy is a subscription-based single-page application with a free, account-less preview. The parts of the site you can use without registering — the marketing and information pages including the glossary, the public range preview, a small number of free sample hands, and the solver at /solver — require no account; we only count how many free hands have been played from your internet connection so that the limit cannot simply be reset (see section 6b). The solver is a special case worth stating plainly: it calculates in your browser, on your device, and the spots you enter there are never sent to us or to anyone else (see section 6c). Creating an account removes that limit for the first chapter of the guided path, which can then be played without any count being kept at all (also section 6b). To drill in the full trainer or to subscribe, you create a user account; accounts are provided for us by Clerk (see section 4a). Access to the paid content additionally requires an active subscription, which is taken out via Stripe (see section 6).

Once you are signed in, each graded decision — in the paid trainer and in the free sample hands alike — is stored in our database under your account so that we can show you your own statistics and leak analysis (see section 6a). The training itself shows no advertising and loads no third-party advertising scripts.

Only if you actively consent via our cookie banner do we load marketing and analytics tools that measure the success of our advertising and how the website is used (in particular Google Analytics and the Reddit pixel; see section 3a). These are never loaded without your prior consent, and you can decline or withdraw at any time. Separately from those tools, we report completed sign-ups to Reddit from our own server so that we can tell which advertisements work; section 3b explains that processing and how to object to it.

Personal data is otherwise processed only to the extent necessary to provide the service, as described below. No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.

3. Hosting, server logs and reach measurement (Cloudflare)

This website is hosted on Cloudflare Workers (static assets), a service provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

When you access the website, your browser necessarily transmits data to the hosting provider’s server. The following data in particular is recorded in so-called server log files: the IP address of the requesting device; the date and time of access; the file or address (URL) requested; the amount of data transferred and the access status; the previously visited page (referrer), if transmitted; and the browser and operating system used (user agent).

The purpose of this processing is to deliver the website, to ensure stability and operational security, and to defend against attacks. The legal basis is Article 6(1)(f) GDPR (legitimate interest in a secure and functional website). The log data is not combined with other data sources and is not evaluated for marketing purposes. Connection data of this kind is retained by Cloudflare only for a short period (as a rule no longer than a few days) and is then deleted or anonymised, unless a specific security incident requires longer retention.

A data processing agreement pursuant to Article 28 GDPR is in place with the hosting provider. Cloudflare operates a global network and may process data, including in the USA. The transfer is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework; Cloudflare, Inc. is certified under that framework.

Beyond these server logs, we operate no analytics on the hosting layer: there is no cookieless reach-measurement product active on this website, and no measurement beacon is served with our pages.

3a. Consent management and marketing/analytics tools (Cloudflare Zaraz, Google Analytics, Google Ads, Reddit)

To measure the success of our advertising campaigns, we use marketing and analytics tools from third parties. These tools are managed and executed through Cloudflare Zaraz, a tag-management and consent tool provided by our hosting provider Cloudflare (see section 3). When you first visit the website, a consent banner asks whether you agree to them. They are blocked and receive nothing until you give your consent; if you decline, they are never activated and the website remains fully usable.

Current status, stated plainly because a privacy policy should describe what actually happens rather than what is merely configured: as at the date of this policy, the three tools described below — Google Analytics 4, Google Ads conversion measurement and the Reddit pixel — are active, and each receives data only from visitors who have consented. (An earlier version of this section said that none was running, and a later one named only two of the three. Each was true when it was written and had stopped being true; both are corrected here.)

How the tools are executed. Zaraz is an edge tag manager: instead of loading Google’s or Reddit’s own scripts into your browser, a small script served from our own domain collects the page views and the events described below and passes them to Cloudflare’s edge, which forwards them to the tools from there. This has two consequences worth knowing: no third-party advertising or analytics code runs on your device, and the measurement requests reaching Google Analytics and Reddit come from Cloudflare rather than directly from you. Google Ads conversion measurement is the exception to the second point — its requests are sent by your browser itself, for the reason given in its own paragraph below — and it is described separately rather than folded in, because a policy that averaged the two would be wrong about both. The Zaraz script itself does load on every page, because it is also what enforces your choice — but until you consent it forwards nothing; events occurring before you decide are held back and are discarded if you decline.

What is measured. If you consent, we measure page views plus a short, fixed list of named events describing progress through the site: whether a drill was started, that a certain number of hands has been answered (at set milestones such as the 1st, 5th and 10th), whether the leak report, the range charts or the solver were used, when a free allowance ran out, when the pricing page was shown, which plan was selected, when an account was created, and when a checkout was started, failed or turned into a subscription. Each event carries at most a handful of attributes from a deliberately small vocabulary: which tier you are on (visitor without an account / free account / subscriber), where in the interface the event came from, which trainer mode, which scenario was drilled as a single readable key (for example “mtt·6max·30bb·BTN·rfi”), a count of hands, the plan chosen, and which allowance was affected. Your email address, your name and your user account identifier are never transmitted to these tools, and the content of your training — the cards, your individual answers, your statistics — is not sent to them either; that stays in our own database (section 6a).

Reddit pixel (Reddit conversion tracking). If you consent, the events described above are forwarded to Reddit, Inc., 548 Market Street, San Francisco, CA 94104, USA. Identifiers needed to recognise your browser between visits are stored on your device — from our own domain rather than Reddit’s, because of the edge forwarding described above — and Reddit processes data such as your IP address, which is transmitted with the forwarded request, a pixel identifier, information about the pages you view and about conversion events (for example when you begin checkout or start a subscription), in order to measure and optimise the performance of our advertising on Reddit and, where applicable, to build advertising audiences. This may involve a transfer of data to the USA; Reddit relies on the European Commission’s Standard Contractual Clauses and/or the EU-US Data Privacy Framework. Reddit’s own privacy policy applies to the processing carried out by Reddit (reddit.com/policies/privacy-policy).

Google Analytics 4 (web analytics). If you consent, we activate Google Analytics 4, a web-analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for users in the EU/EEA, on behalf of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Analytics uses identifiers stored on your device — from our own domain, for the reason given above — to recognise your browser, and processes data such as the pages you view, the events listed above, the referrer, a coarse location and information about your device and browser, in order to help us understand how the website is used and to improve it. Your IP address is not transmitted to Google. Cloudflare Zaraz’s “hide originating IP address” option is switched on for this tool, so the measurement request reaches Google from a Cloudflare edge server without your address; the location Google derives is correspondingly coarse and is not derived from your own IP address. This is a real setting rather than the “IP anonymisation” that websites often claim: in Google Analytics 4 that older option no longer exists, and the only way to keep the address from Google is not to send it, which is what happens here. Data may be transferred to the USA; Google relies on the European Commission’s Standard Contractual Clauses and/or its certification under the EU-US Data Privacy Framework. Google’s own privacy policy applies to the processing carried out by Google (policies.google.com/privacy).

Google Ads (conversion measurement). If you consent, we report two of the events listed above — that an account was created, and that a checkout turned into a subscription — to Google Ads, provided for users in the EU/EEA by Google Ireland Limited on behalf of Google LLC (addresses as above). The sole purpose is to learn which advertisements actually lead to sign-ups. Sent with each report are the address and title of the page you are on, the referring address, your time zone and your window and screen dimensions, and — if you reached us through a Google advertisement and consented to the storage described in section 7 — the click identifier of that advertisement, which is what lets a sign-up be matched to the advertisement that caused it instead of merely counted. Your email address, your name, your account identifier and the content of your training are not transmitted.

Unlike the two tools above, these reports are sent by your browser directly to Google — to googleadservices.com, googleads.g.doubleclick.net and google.com — rather than being forwarded from Cloudflare’s edge. Google Ads is built that way: matching a conversion to a click requires the request to arrive from the same browser that made the click. Two things follow, and we would rather state them than let the section above imply otherwise: Google receives your IP address with these requests, and it can read and set cookies for its own domains while handling them. Neither happens unless you have consented, and both stop when you withdraw. Data may be transferred to the USA on the bases named above, and Google’s own privacy policy applies to its further processing.

The legal basis for activating these tools and for the associated storage of, and access to, information on your device is your consent pursuant to Article 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via the “Cookie settings” / “Cookie-Einstellungen” option in the consent banner; the withdrawal does not affect the lawfulness of processing carried out before it. Any further marketing or analytics tools we may activate in future will run in the same consent-first manner and be listed here.

3b. Server-side conversion measurement (Reddit Conversions API)

Independently of the browser-side tools described in section 3a, we report a single event to Reddit from our own server when a subscription is successfully started after a checkout: the fact that a sign-up occurred, a random identifier for that checkout (used to avoid double counting), your IP address, your browser identification (user agent) and your email address in irreversibly hashed form (SHA-256; Reddit can compare the hash with hashes of its own, but cannot read the address from it). If you reached us through a Reddit advertisement and you consented to the storage described in section 7, the click identifier of that advertisement is also transmitted; it is stored in your browser only in that case and is deleted after 90 days at the latest (see section 7). If you declined, no click identifier is stored on your device and none is transmitted here, with the result that the report cannot be linked to a particular advertisement.

The sole purpose is to measure which advertising campaigns actually lead to sign-ups. No profile of your use of the website is created for us in this way, and we do not receive any personal data back from Reddit. The recipient is Reddit, Inc. (see section 3a) in the USA; the transfer is based on Standard Contractual Clauses and/or the EU-US Data Privacy Framework, and Reddit’s own privacy policy applies to its further processing.

Because this reporting takes place on our server and does not store or read information on your device, it does not fall under § 25(1) TDDDG; the legal basis is Article 6(1)(f) GDPR (legitimate interest in measuring the effectiveness of our advertising and in not paying for ineffective campaigns). You have the right to object to this processing at any time on grounds relating to your particular situation (Article 21 GDPR) — an email to info@gto-academy.com is sufficient, and we will then exclude your sign-up from this reporting.

4. Contacting us by email

If you contact us by email (for example at the address given in the Legal Notice), we process the data you send (your email address, the content of your message and any other details you provide) solely to handle and respond to your enquiry. The legal basis is Article 6(1)(f) GDPR (legitimate interest in responding to enquiries); where your enquiry is aimed at concluding or performing a contract, the legal basis is Article 6(1)(b) GDPR.

Your data is deleted once your enquiry has been dealt with conclusively and no statutory retention obligations prevent deletion. Your data is not passed on to third parties.

4a. User accounts and sign-in (Clerk)

To drill in the trainer or to take out a subscription you need a user account. Accounts, sign-up, sign-in and session management are provided for us by Clerk, Inc., 660 King Street, Unit 345, San Francisco, CA 94107, USA (“Clerk”), acting as our processor under a data processing agreement pursuant to Article 28 GDPR.

Depending on how you register, the following data is processed: your email address; the verification codes sent to it; if you sign in with Google, the data your Google account releases for this purpose (in particular your email address, your name and, where available, your profile picture — the login is carried out by Google, and Google’s privacy policy applies to that step, policies.google.com/privacy); and technical sign-in data such as the time of registration and of the last sign-in, the IP address and the browser used, which Clerk also processes to detect and prevent abuse (for example brute-force sign-in attempts). Clerk stores this data on our behalf and issues the session token described in section 7.

We additionally store on your account the information needed to grant access: the status of your subscription (for example active, trialing or inactive), the plan booked, the end of the current billing period, and the identifier of your Stripe customer record (see section 6). We do not store a password — sign-in works with an emailed one-time code or with Google.

The legal basis is Article 6(1)(b) GDPR (creation and performance of the user relationship and of the contract for the paid service) and, for the abuse prevention described above, Article 6(1)(f) GDPR (legitimate interest in secure accounts). Clerk processes data in the USA; the transfer is based on the European Commission’s Standard Contractual Clauses and/or the EU-US Data Privacy Framework. Your account data is stored for as long as your account exists; if you delete your account (see section 9), it is deleted, save where statutory retention obligations — in particular commercial and tax law obligations relating to the billing data held by Stripe — require otherwise. We do not use your email address for advertising or newsletters.

4b. Restoring access by email (legacy sign-in link)

Before user accounts were introduced, access could be restored by requesting a one-time sign-in link for the email address associated with a subscription. The website no longer offers this; the interface has been removed and new links are not created. The corresponding endpoint remains available for a transitional period only so that links already sent out, and subscriptions taken out before the changeover, do not stop working. If it is used, the email address is processed solely to check with Stripe whether it has an active subscription and to send a one-time, time-limited link (15 minutes); the legal basis is Article 6(1)(b) GDPR. Any such emails are sent using Cloudflare Email Sending, provided by our hosting provider Cloudflare (see section 3) and covered by the same data processing agreement; no separate third-party email provider is used. To prevent the function being used to find out who is a customer, the request is answered the same way whether or not the address has a subscription.

5. Fonts (served locally)

This website uses fonts that are served entirely locally from our own server. No connection to third-party servers (in particular not to Google) is established when the fonts are loaded, and no data is transmitted to third parties in the process.

6. Subscriptions and payment processing (Stripe)

Subscriptions to GTO Academy are sold directly by the provider named in the Legal Notice; payment processing is handled by Stripe (Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA / Stripe Payments Europe, Ltd. for EU customers). Unlike a merchant-of-record model, we are the contracting party for the sale — Stripe only processes the payment on our behalf.

When you subscribe, you provide your data (in particular your email address, billing details and payment information) directly to Stripe during checkout on Stripe’s systems. We do not receive or store your payment card data. From Stripe we receive only the information needed to grant and maintain access — in particular your Stripe customer id and your subscription’s status (for example whether it is active, trialing, cancelled or expired). The legal basis is Article 6(1)(b) GDPR (performance of the contract you enter into for the paid service).

So that we can tell which subscription belongs to which account, your user account and your Stripe customer record are linked to each other: your Stripe customer id is stored on your account (section 4a) and your account id is stored with your Stripe customer and subscription record. When your subscription changes (payment, renewal, cancellation, expiry), Stripe notifies our server and we update the access status stored on your account; where that information is missing or out of date, our server queries your subscription status from Stripe directly. Stripe’s own privacy policy governs the processing that takes place on Stripe’s systems (stripe.com/privacy). A transfer to the USA may occur; it is based on the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses. You can view and manage your subscription, invoices and cancellation at any time via the Stripe customer portal linked in the app.

6a. Training history and statistics

When you drill while signed in — in the paid trainer, and also in the free sample hands — each graded decision is stored so that the app can show you your own progress: the accuracy trend, the leak heatmap and comparable statistics. Free sample hands played without an account are not stored this way; there is no account to store them under, so they are counted (see section 6b) and kept on your own device instead. If you later create an account, the decisions held on your device are transferred into your history in the form described here, so that the chapter you were part-way through is still part-way through — this is the same data, moved at the moment there is finally somewhere to keep it, and it happens only because you registered. Each record contains only training data: the identifier of your user account, the spot drilled (game type, number of seats, stack size, position, situation), the hand class shown (for example “AKs”), the action you chose, the action the solver considers best, an assessment of your choice, the resulting score and the time of the decision. No card images, no free text and no other personal details are stored, and the data is not used to assess you as a person; it exists purely to feed your own statistics back to you.

The records are stored in a Cloudflare D1 database operated for us by our hosting provider Cloudflare (see section 3) and covered by the same data processing agreement pursuant to Article 28 GDPR. They are not passed on to third parties and are not used for advertising. The legal basis is Article 6(1)(b) GDPR (performance of the contract — the statistics are part of the service you booked, and for a free account part of the free service you registered for). Your history is kept for as long as your account exists so that long-term trends remain meaningful; you can ask us to delete it at any time, and it is deleted with your account (see sections 4a and 9).

6b. Free sample hands (usage limit)

There is one limit on the free hands at /train and it applies to one group: visitors playing without a user account. Once you have registered, the first chapter of the guided path can be played as long as you like and nothing about it is counted; the paid content is then gated by your subscription rather than by an allowance.

Without an account. To stop the free limit being reset simply by clearing the browser or opening a private window, our server counts how many free hands have been played from your internet connection. We do not store your IP address for this. Instead the address is passed through a keyed cryptographic function (HMAC-SHA-256) using a secret key held only on our server, and only the resulting value, the number of hands played and the first and last time of use are stored in the database described in section 6a.

We should be precise about what that does and does not achieve. The stored value is pseudonymous, not anonymous: without the secret key it cannot practically be traced back to an IP address, but we hold that key, so the value remains personal data and we treat it as such. We do not use it to recognise you anywhere else on the site, and it is never combined with your account, your training history or any other record. Entries that have not been used for 90 days are deleted automatically.

With an account. Nothing is counted. There is no allowance to enforce for a signed-in visitor, so no usage counter is written against your account and the hashed value described above is no longer consulted either. Earlier versions of the service did keep a daily count per account; any such rows still present are deleted automatically after seven days, as they always were. What is stored while you are signed in is your training history, and that is described in section 6a.

In addition, while you have no account, your practice itself is kept in your browser’s local storage: the count, a summary shown back to you in the app, and the graded decisions behind it — which chapter, which hand class, what you chose and how it scored — because without an account there is nowhere else for a guided chapter to keep the progress it needs to work at all (see section 7). None of it is transmitted to us while you remain signed out, and none of it is used for analytics or advertising. It leaves your device in exactly one case: you create an account, and it is transferred into your history as described in section 6a.

The legal basis is Article 6(1)(f) GDPR (legitimate interest in offering a free tier without it being usable without limit); where the counting is tied to your account, it also serves the free service you asked us for, Article 6(1)(b) GDPR. You may object under Article 21 GDPR (see section 9).

6c. The solver (free, and calculated on your own device)

The solver at /solver is not a calculation we perform for you on our servers. The engine is downloaded with the page and runs in your browser, on your own device. The spots you build there — positions, stack sizes, board cards, bet sizes, the line you walk — are processed only on your device and are never sent to us. We hold no record of what you solve, because none reaches us.

The limit on free hands is counted in the same place: your browser’s local storage holds a short list of the hands you have already spent a free solve on, so that returning to one of them costs nothing a second time. That list stays on your device and has no counterpart in our database. Unlike the free sample hands at /train (section 6b), there is nothing here for our server to count — and we would rather say so than imply an enforcement we do not carry out. If you have consented to analytics (section 3a), the bare fact that a solve was run is included in the measurement events described there; what was solved is not.

7. Cookies and local storage on your device

Sign-in cookies (strictly necessary). When you sign in, Clerk (see section 4a) sets cookies on this domain — in particular a session cookie (“__session”) containing a short-lived, signed token that identifies your account, together with the technical cookies Clerk needs to renew that token and to protect the sign-in against abuse. Our server checks the signature of that token on every request to the protected part of the app. In addition, for subscriptions taken out before user accounts were introduced, two legacy cookies may still be present or be set (“gto_session”, currently 24 hours, and “gto_refresh”, currently 180 days); they contain only a signed, time-limited token identifying the Stripe customer record. None of these cookies contains a tracking identifier, and none is used for analytics or advertising. They are cleared when you sign out.

Because these cookies are strictly necessary to provide the service you explicitly requested (a signed-in session and access to the paid content), they do not require consent under § 25(2) no. 2 TDDDG; the legal basis for the associated processing is Article 6(1)(b) GDPR.

Consent cookie (strictly necessary). Your answer to the cookie banner is itself recorded in a cookie on this domain (“zaraz-consent”), so that we do not ask again on every page and — more importantly — so that a refusal keeps being honoured on later visits. Storing a decision is the only way a decision can have effect, which is why this one needs no consent of its own (§ 25(2) no. 2 TDDDG). You can change or withdraw the decision at any time via “Cookie settings” in the footer.

Local storage (strictly necessary). Independently of cookies, the app stores on your device: the number of free sample hands you have played, a short summary of that practice that is shown back to you in the app — the number of hands, the number answered correctly and your longest correct streak — and, for a visitor with no account, the graded decisions of the guided chapter they are working through, which is what lets that chapter keep its place (see section 6b); the list of hands you have already solved for free at /solver (see section 6c); and, if you have used our ?notrack=1 opt-out link, a flag recording that this browser is not to be measured at all. Each of these is needed to provide something you asked for — the free sample, the free solves, or the refusal to be counted — and none of them leaves your device, so they do not require consent under § 25(2) no. 2 TDDDG. No subscription or payment data is stored on your device.

Local storage (only with your consent). If you reach the website through an advertisement whose link carries a click identifier — rdt_cid for Reddit advertisements, gclid for Google advertisements — that identifier is read from the address and held in memory only. It is written to your browser’s local storage solely if you then consent via the cookie banner, so that a sign-up happening later can be attributed to the advertisement (see section 3b). Storing it is not necessary to provide the service, so the legal basis is your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG. A stored identifier is deleted automatically after 90 days at the latest. If you decline, nothing is written and any identifier stored on an earlier visit is deleted. For Google advertisements the consented identifier is additionally written to a cookie on this domain named “_gcl_aw”, in the format Google Ads expects, because that cookie is the one place Google’s conversion measurement (section 3a) looks for a click identifier; it is set by our own code and not by Google, carries the same 90-day lifetime, and is deleted along with everything else here if you decline or withdraw.

No other cookies are set for the operation of the service. Separately, if — and only if — you consent via our cookie banner, the marketing and analytics tools described in section 3a (in particular Google Analytics and the Reddit pixel) may set their own cookies or store identifiers on your device; these are not set without your consent and can be withdrawn at any time.

8. Note for visitors from outside the EU

We apply the GDPR standard described in this policy to all visitors worldwide. We do not sell or share personal information within the meaning of US state privacy laws (such as the California Consumer Privacy Act, CCPA/CPRA). Advertising and analytics measurement happens only where you have actively consented to it (section 3a); in addition, completed sign-ups are reported to Reddit from our server for advertising measurement, which you can object to (section 3b). Beyond the technical access data described in section 3, we process only the data needed to provide the service: your account data (section 4a), your Stripe customer id and the subscription status we receive from Stripe (section 6), your training history (section 6a) and the usage counters for the free sample hands (section 6b). What you do in the solver is not processed by us at all — it stays in your browser (section 6c). Your payment details are handled by Stripe, not by us.

9. Your rights as a data subject

You have the following rights vis-à-vis the controller:

  • the right to access the personal data processed (Article 15 GDPR)
  • the right to rectification of inaccurate data (Article 16 GDPR)
  • the right to erasure (Article 17 GDPR)
  • the right to restriction of processing (Article 18 GDPR)
  • the right to data portability (Article 20 GDPR)
  • the right to object to processing based on Article 6(1)(f) GDPR (Article 21 GDPR)
  • the right to withdraw consent at any time with effect for the future (Article 7(3) GDPR)

Note on the right to object: where we process data on the basis of a legitimate interest (Article 6(1)(f) GDPR), you have the right to object to such processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to assert, exercise or defend legal claims.

An informal message to info@gto-academy.com is sufficient to exercise your rights. If you have a user account, you can also ask us there to delete the account together with your training history; we will then delete both, save where statutory retention obligations (in particular for billing records) require otherwise. Deleting your account does not by itself cancel a running subscription — please also cancel it via the customer portal (see section 6).

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other legal remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement (Article 77 GDPR). The authority responsible for the controller is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

11. Changes to this privacy policy

We will adapt this privacy policy whenever the data processing on this website changes. The version published on this page with the “last updated” date above applies.