Last updated: August 8, 2026

Privacy Policy

Your privacy matters to us. This document explains what data we collect, why we collect it, and how we protect it. You are solely responsible for the data you choose to publish or share with others on the platform.

1. Data Controller

The data controller is Poble Studio S.L., the company operating Tarok Online (referred to as “we”, “us”, or “our”), NIF B88925474, with registered office at Calle Vidal y Valenciano 7, 2-2, 08005 Barcelona, Spain. For any privacy-related questions, contact us at hello@tarokonline.com.

2. Data We Collect

When you register and use the platform, we collect the following data:

• Account data: email address, handle, display name, profile picture, login provider identifiers (Google, Facebook), language and timezone preferences, game settings, the timestamp and version of the terms you accepted, and your age-confirmation timestamp.
• Game data: game results, ELO rating, statistics, game history, and replay data including in-game chat messages.
• Social and club data: friend connections, club memberships and roles, club messages, blocked-player lists (PRO), and in-app notifications.
• Billing data: Stripe customer and subscription identifiers, webhook event identifiers, payment status, refund and dispute metadata, and entitlement flags (for example active subscription). We do not store payment card details - Stripe handles them directly.
• Technical data: limited technical data (IP address, browser type, access timestamps) processed in the server logs of our hosting, authentication, and payment providers (Supabase, Stripe) for security and performance. We do not maintain our own separate IP or access logs.

Video and voice calls are not recorded or stored on our servers. See the video and voice section below for details.

3. Purpose and Legal Basis

4. Sharing Data with Third Parties

We do not sell your personal data to third parties. We share data only with trusted service providers who help us operate the platform, and only to the extent necessary for those services:

• Supabase — database, authentication, and profile image storage.
• Stripe — payment processing and PRO subscriptions.
• Google — Google account sign-in; with your explicit consent, anonymised analytics (Google Analytics).
• Facebook — Facebook account sign-in when available.
• Google STUN servers — Google's public STUN servers (stun.l.google.com) help your browser discover its network address when setting up a WebRTC call. No media content is sent through them.
• TURN relay servers — used to relay encrypted video and voice when a direct peer connection is not possible. We do not store call content.
• Loopask — if you submit feedback via the “Feedback” link, Loopask receives the message you write and basic technical metadata. Use is strictly voluntary.

Your account, gameplay, and club data is stored by Supabase within the European Economic Area (EEA). Some providers (Stripe, Google, and the Loopask feedback tool) may process limited data outside the EEA, particularly in the United States. Where this happens, transfers rely on valid mechanisms: the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses (SCCs). Third-party providers process data under their own privacy policies — we are not liable for their practices.

5. Source of Data

Most personal data is collected directly from you when you enter it in the app (for example handle, display name, profile picture). When you sign in via Google (or via Facebook, if and when that option becomes available), the identity provider also shares your email address, name, profile picture, and provider identifier with us for authentication purposes. Stripe shares payment status, refund metadata, and dispute information with us for billing; we do not receive payment card details.

6. Video & Voice Calls

In-game video and voice calls are an optional feature transmitted directly between players (peer-to-peer) via WebRTC. Tarok Online does not record, store, or access audio or video from calls. When a direct connection is not possible, a TURN relay server may carry encrypted media — call content is still not stored on our systems. You are solely responsible for anything you share on calls.

7. Data Retention

We keep your data only as long as needed for the purposes set out in this policy and to comply with our legal obligations:

• Account and gameplay data: while your account is active. After account deletion we erase or anonymise them within 30 days.
• Club chat: older messages are automatically trimmed under the platform's club-chat policy.
• Billing and tax records (Stripe): retained for up to 10 years, in line with Slovenian tax law.
• Provider and billing logs: server logs are kept by our hosting, authentication, and payment providers under their own default retention policies; raw Stripe webhook payloads we store for billing diagnostics are pruned after about 90 days.
• Anonymised or aggregated statistics: retained indefinitely (no longer identifies an individual).

Deletion instructions are on the /data-deletion page.

8. Your Rights

Under the General Data Protection Regulation (GDPR) you have the following rights:

• Access: request a copy of your personal data at any time.
• Rectification: correct inaccurate or incomplete data in your account settings; for data you cannot edit yourself (for example your sign-in email or game history), email hello@tarokonline.com and we will correct it.
• Erasure: request permanent deletion of your account and data — see /data-deletion.
• Restriction: request restriction of processing in certain circumstances.
• Portability: request a copy of your data in a structured, machine-readable format by emailing hello@tarokonline.com.
• Object: object to processing carried out on the basis of our legitimate interests (for example fraud detection and security logging).
• Withdraw consent: withdraw any consent you previously gave (for example analytics cookies on the /cookies page). Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Lodge a complaint: you have the right to lodge a complaint with the Slovenian Information Commissioner (ip-rs.si) or with the supervisory authority in your country of habitual residence.

To exercise these rights, contact us at hello@tarokonline.com. We respond without undue delay and at the latest within one month of receipt.

9. Automated Decision-Making

We do not carry out solely automated decision-making that produces legal or similarly significant effects on you within the meaning of GDPR Art. 22. ELO rating, matchmaking, and automated safety checks support the operation of the service and do not produce binding decisions without human review.

10. Cookies

We use strictly necessary cookies for login, language preferences, and game functionality. With your explicit consent we may also use anonymised analytics (Google Analytics). You can review all cookies and manage your consent on the /cookies page.

11. Children and Minors

Tarok Online is intended for users aged 16 or older. At sign-up we ask you to confirm this. We do not knowingly create accounts for children under 16. If you are a parent or guardian and believe a minor has created an account without your consent, please contact us at hello@tarokonline.com and we will delete the account and its personal data without undue delay.

12. Policy Changes

If we make significant changes to this policy, the updated date at the top of this page will reflect them; where appropriate, we will also notify registered users by email or via a notice on the platform. The last-updated date is always shown at the top of this page.

13. Disclaimer

While we take reasonable steps to protect data, no transmission over the internet or electronic storage is completely secure. You use the platform at your own risk. You are solely responsible for the data you publish in your profile, chat, or clubs, and for your interactions with other users. Tarok Online is not liable for unauthorised access, data loss, other users' content, or the actions of third-party providers — to the fullest extent permitted by applicable law. Nothing in this policy limits any mandatory right you have under data-protection or consumer law that cannot be excluded.