Privacy Policy — Poker Dealer

Last updated: 16 October 2026.

Poker Dealer is a free Telegram Mini App (and a web version at play.pokerdealer.vip) that deals cards for a live home Texas Hold'em game. It's built and run by one person, Aliaksandr Vabishchevich, not a company. This page explains what data the app touches, why, where it lives, and how long.

Written in plain language on purpose, straight from how the app's code actually works — not a template.

What we collect and why

Your name. Either your Telegram first name (read from Telegram when you open the app there) or a name you type yourself (if you join without Telegram, from play.pokerdealer.vip). Capped at 20 characters. It's shown to the other players at your table so they know who's who — that's the only reason we have it.

Telegram account info. When you open the app inside Telegram, Telegram hands the app your Telegram user id, first name, username and language — signed so we can verify it really came from Telegram, and no older than 24 hours. We use this to tell you apart from other players at the table and to reply in your language. Player names at a table live only in that table's memory and disappear with the room (see "Room and game state" below).

Guest login (no Telegram). If you join from a browser without Telegram, the server gives you a token — a random string plus a signature — instead of a Telegram id. We don't keep a record of this token on our side; it only proves "you're the same person who joined earlier" because the server can re-check the signature. Your browser stores the token and the name you typed (in localStorage, on your device). Practical effect: if our server restarts or redeploys, guest tokens normally stop working and you'd need to rejoin with a name (unless we've configured a server-side signing key to survive restarts, in which case tokens keep working for longer).

Analytics events. We log product events — a room was created or joined, a hand was played or finished, the app crashed, you saw a beginner tip, and similar — to PostHog (analytics tool), hosted in the EU (Frankfurt). Before sending, your Telegram/guest id (or, for the rare event tied to no account, your IP address) is run through a one-way scrambling function (HMAC) with a secret key only we hold, turning it into something like u_a1b2c3… or ip_a1b2c3…. We don't send PostHog your real Telegram id, name or IP. We've turned off PostHog's automatic page/click recording and session replay — only the specific events listed above are sent, each with the specific properties needed to understand that event (e.g. which error happened, which screen).

Feedback you send ("Send feedback"). The text you type, plus your name, the room code (if any) and the app build number, is forwarded as a Telegram message straight to the developer's own Telegram chat. It is not saved in any database on our side — once it's a Telegram message, it follows Telegram's own retention, same as any Telegram chat. Limited to 5 messages per person and 30 per IP address per hour, to stop spam.

"Share" images. The image you create with "Share" (your result, a hand, a bluff) is drawn on your own phone. If you're inside Telegram and want to share it to a Story or a chat, we need an https link for it, so the image is temporarily uploaded to the server's memory, given a random, hard-to-guess address, and automatically deleted after about an hour (sooner if the server restarts). If you're outside Telegram, sharing uses your phone's own share sheet and nothing is uploaded. Other players' hidden cards never appear in a share image.

Tips to the developer (Telegram Stars). Tipping is entirely handled by Telegram: Telegram takes the payment and tells our server "this charge happened," with an id. We never see your card or payment details — only that id, and that it's tied to your Telegram account. We keep no tip records in a database; the developer gets a Telegram message naming who tipped, how much, and the charge id. Refunds are manual: you ask (see "Your rights" below) and the developer runs a /refund command in Telegram referencing that charge id.

Awards (badges for milestones like hands played, bluffs pulled off, etc.). This is the one place where we store your actual Telegram id or guest id — not scrambled — because awards need to attach to a specific person across sessions. It's saved in a small database file on our hosting provider (Railway, EU West region), together with your running counts and the awards you've earned with timestamps. Unlike analytics, this isn't anonymized. It's kept until you ask us to delete it or the project shuts down.

Voice moves (if you turn this on). Your phone records a short voice clip (under 256KB) locally and sends it to our server, which forwards it to OpenRouter (a third-party AI service) to turn it into text using a speech-recognition model, so the app can hear "call" or "raise." We discard the audio right after; we don't save it anywhere. OpenRouter processes it to do the transcription — their own privacy policy covers what they do with it on their end, which we don't control.

Room and game state (who's at the table, the cards, the pot). This exists only in the server's working memory while the game is live — never written to a database — and is deleted automatically after an hour with nobody connected, or whenever the server restarts.

IP address, briefly, for abuse prevention (e.g. "don't open more than 10 rooms an hour from one connection"). It's checked against a short-lived in-memory counter and isn't logged or stored permanently.

Settings that never leave your device. Things like sound on/off, keep-screen-awake, the beginner-tips toggle, voice-moves on/off, and "seen this tutorial already" are saved in your browser's localStorage, or (for a couple of tutorial flags) in Telegram's own Cloud Storage so they follow your Telegram account across your devices. We never see these — they don't touch our server.

Where things live

App server and game memory: Railway, EU West region.
Awards database: same Railway hosting, EU West, on a persistent disk volume.
Analytics: PostHog, EU region (Frankfurt, Germany).
Voice transcription: sent to OpenRouter for processing (US-based service); not stored by us.
Telegram-side data (your Telegram account, messages to the bot, Stars payments): on Telegram's own infrastructure, governed by Telegram's privacy policy.

The landing page (pokerdealer.vip)

The marketing site at pokerdealer.vip uses the same PostHog EU project as the app, configured without cookies (in-memory only — nothing survives closing the tab). It logs: page views, button clicks (which language, which button) with no personal identifiers attached, and which short link (pokerdealer.vip/go/<source>/) brought you in, so we can tell which channels work. No name, account or IP-based profile is built from this.

The site itself is hosted on GitHub Pages. Serving any page means GitHub's servers see the standard technical details of that request — your IP address among them — and handle that under GitHub's own privacy policy, outside our control.

Your rights

You can ask us (contact below) to:

Tell you what we have — for most things, this document is a complete answer; for awards specifically, we can look up your exact record.
Delete your awards record — tell us your Telegram username or guest name plus roughly when you played, and we'll remove the row.
Delete your analytics trail — tell us your Telegram username or guest identity; since we hold the scrambling key, we can recompute your pseudonymous id and delete matching events in PostHog.
Get a tip refunded — see "Tips" above; message the bot and we'll refund the full amount.
Stop feedback forwarding you sent — ask and we'll delete the forwarded message from the developer's chat where still possible.

Contact: use the contact form, or message @PokerDealerAppBot directly on Telegram (those messages reach the developer the same way feedback does).

This is not legal advice — it's a plain description of what the code actually does, written for players, not lawyers.