Privacy Policy

Data handled by the app (Android / iOS)

The app can store the last selected hand and opponent range, saved ranges, ICM scenarios, drill history, and display settings in its app-private storage on the device. These local data are not automatically transmitted to the developer or any third party. For paid-plan purchase verification and free-tier usage tracking, the app sends a Firebase ID token to the developer API running on Vercel. The API verifies the token and determines the account identifier from the verified Firebase UID. Free-usage counts, subscription state, and links between purchase identifiers and accounts are stored in Upstash Redis.

The app includes no advertising, analytics, crash-reporting, cloud-sync, or remote-database SDK. Required account authentication uses Firebase Authentication (Google LLC). Sign-in supports email and password, Google, and Sign in with Apple in the native iOS and Android apps; new email registrations require email verification before access. The complete preflop enumeration table, ICM calculation logic, and saved data are processed on the device. Network access is nevertheless required for sign-in, free-tier authorization, and subscription purchase verification. On iOS, paid features remain available offline only when StoreKit reports a verified, unexpired subscription bound to the currently signed-in account; a local display cache alone never grants paid access. On Android, both free-tier and paid ICM access fail closed when the service cannot be reached. On iOS, purchases and subscriptions are managed with Apple's StoreKit (In-App Purchase), and purchase information is shared with Apple in the manner Apple defines.

On Android, with Google sign-in, the Google profile's display name, email address, user ID, and profile image may be provided to Firebase Authentication. The developer's server processes the authenticated Firebase ID token, free-usage type and count, and paid ICM-plan purchase token and purchase state for identity verification, free-tier management, purchase verification, carrying forward already-paid access, and fraud prevention. While an app account exists, free-usage counts and subscription state are associated with a randomly generated internal owner ID. The email address is used to verify sign-in, but it is not a key for looking up or automatically restoring a deleted account or subscription. A per-installation device ID is not used as server authority.

On Android, if Google Play starts a chargeback review, it sends the pending refund token, order ID, refund reason, and optional obfuscated account/profile IDs to the developer's server. The optional account/profile IDs are not stored for the review, and no owner, email address, or external account/profile ID is added to the retry queue. The raw token and order information are encrypted with a dedicated key, and the ciphertext is deleted when the response to Google Play succeeds or the 24-hour deadline from notification is reached. To prevent reprocessing the same transport delivery, only a one-way hash of the pending refund token and minimal processing state, associated with no app account, are retained for 31 days and automatically deleted. The hash is still treated as retained data; it is not described as anonymous or deleted merely because it is one-way. The 31-day period matches the configured maximum Pub/Sub and dead-letter queue redelivery window and supports transport deduplication and security investigation within that window; it is not a Google Play retention mandate. Operations monitoring uses non-correlatable aggregate counts and health state where possible. The response provides only a NEUTRAL preference and the fact that a free sample exists; it does not provide an IP address, location, individual usage event, or consumption percentage.

Export and deletion

Saved data can be exported and imported as JSON. On Android, export creates a temporary file in the app-private cache only when the user requests it and passes that file to the system share sheet. Import reads only the JSON file selected by the user in the system file picker. The user controls the share destination and storage of exported files; a selected destination app may transmit the file over a network under its own policy. Individual saved ranges and all local app data can be deleted. The sign-in account can be deleted with “Delete account” in the footer at the bottom of an Equity or ICM screen.

Account and sign-in

Sign-in is required to use the app. Sign-in uses an email address and password, your Google account, or your Apple account with Sign in with Apple in the native iOS and Android apps. New email registrations require email verification before access. Firebase Authentication (Google LLC) processes the email address and Firebase UID for authentication. The app sends a Firebase ID token to the subscription, usage, and account-deletion APIs to authenticate the user. This token contains the Firebase UID and authentication provider and, depending on the sign-in method, may contain account claims such as an email address. The developer API on Vercel verifies the token and uses the verified UID as the account identifier. Apple processes Apple sign-in credentials in accordance with Apple's privacy policy.

To delete your account, use “Delete account” in the footer at the bottom of an Equity or ICM screen. Identity is confirmed with the current password for email sign-in or provider reauthentication for Google and Apple. Deletion removes the Firebase Authentication account, Upstash Redis free-usage and subscription records and purchase-to-Firebase-UID links, plus saved ranges, ICM scenarios, history, settings, recovery data, and export caches on the device. Sign in with Apple access is also revoked when applicable. Short-lived rate-limit hashes are not individually removed by the account-deletion API and instead expire automatically after their configured limiting window. Transaction records retained by Apple or Google for legal and store-operation purposes remain with those stores. Account deletion does not cancel an Apple auto-renewable subscription, so cancel it in the App Store first. When the app changes to another Firebase UID, the previous UID's local data is deleted before authenticated content is shown.

On Android, to delete your account, the deletion process checks the purchase state and final paid expiry with Google Play and first asks Google Play as the developer to stop future payments for every nonterminal subscription that can recover or charge again, including paused and account-hold states, and confirms success. While a PENDING purchase, Publisher result, stop-payment result, or final paid expiry cannot be resolved, deletion remains retryable and Firebase credentials and identity data are not deleted first. Stopping future payments does not issue a refund, and the paid features remain available through the already-paid expiry. After confirmation, the Firebase credentials, internal owner ID, email-address and Play external account/profile-ID associations, free-usage counts, and ordinary subscription and purchase records are promptly deleted.

On Android, only when needed to carry forward an already-paid entitlement, the exact current purchase token at deletion is retained under a dedicated encryption key, with no owner, email address, or external account/profile ID association. It is retained only during the confirmed paid term and is deleted at the earlier of Google confirming an expired, revoked, or other terminal state or the last verified paid expiry. A failed Google query never extends retention past that expiry. A fresh account can attach only that entitlement when the server verifies with Google the exact current token obtained from Google Play on the device. The same email address alone restores nothing. A post-expiry sign-up is a new purchase and does not revive the deleted owner or any sibling token.

On Android, while a purchase is current, an account-unassociated integrity marker containing a one-way purchase-token hash and the last verified paid expiry is retained only alongside the corresponding raw token or ciphertext and expires at the same boundary; it is never left standalone. After Google confirms a terminal state or verified supersession, a separate security record retains only that hash plus non-account-linked terminal state, cause, boundary, and confirmation time to reject stale replay into another account. If the primary record cannot be written, the same information may remain in an account-unassociated repair record. Both are automatically deleted no later than 60 days after terminal expiry, matching the period in which Google can still return that terminal token. These records cannot restore an entitlement and are separate from the 31-day PendingRefundReview hash described above. Hashes and marker metadata remain retained data; they are not described as anonymous or deleted.

On Android, Firebase Admin rechecks the user and account creation time, so an old token for a deleted or recreated UID is rejected immediately. A versioned HMAC marker for the deleted authentication generation is retained only to reject writes from server requests that had already passed authentication when deletion completed. It contains no email address, internal owner ID, Play external ID, or purchase token, and is automatically deleted 330 seconds after deletion completes: the configured 300-second maximum Vercel request duration plus the server's 30-second clock-skew allowance. The HMAC marker remains retained data; it is not treated as anonymous or as deleted merely because it is hashed. An already received chargeback review follows the response-success/24-hour and 31-day deadlines described above. If you cannot use the app, use the browser deletion screen and complete sign-in and immediate reauthentication. Email is limited to procedural help; an email address alone is not accepted as reauthentication or deletion authorization.

Permissions and communication

The Android app requests the INTERNET permission, and both installed iOS and Android apps communicate over HTTPS (TLS) with Firebase and the developer API on Vercel for account authentication, paid-plan purchase verification, free-tier usage tracking, and account deletion. The subscription and usage APIs receive a Firebase ID token; Android purchase verification also receives the Google Play purchase token and product ID, while iOS purchase verification receives the product ID and an App Store transaction ID. The developer API checks the subscription through Apple's App Store Server API or Google Play mechanisms. To associate an Apple transaction with an account without disclosing the raw Firebase UID to Apple, the app also passes StoreKit an appAccountToken: a UUID-form value derived from the Firebase UID using namespaced SHA-256. When processing API requests, Vercel may process standard request information such as the IP address, User-Agent, timestamp, and requested URL. Upstash Redis stores an account identifier based on the verified UID, free-usage counts, subscription state, and purchase-identifier links. For abuse-prevention rate limits, only namespaced SHA-256 values derived from the IP address and account identifier are used as short-lived Upstash Redis keys. The app does not request location, contacts, photos, camera, microphone, advertising ID, broad storage, or similar permissions. Android passes an exported JSON file from the app-private cache to a destination selected by the user; the file is not sent to the developer. Import processes only a file selected by the user. Any processing or communication by the selected destination app is governed by that app's policy.

Retention and deletion

Saved ranges, ICM scenarios, history, settings, and recovery data on the device are retained until the user deletes local data, switches to a different Firebase UID, deletes the account, or uninstalls the app. Export and share caches may remain until the operating system clears the cache, a same-named file overwrites them, or the account is deleted. Firebase Authentication processes the email address, UID, and authentication data until account deletion. Upstash Redis free-usage counts, subscription state, and purchase-to-account links have no automatic TTL and are retained while the account exists or until account deletion. IP and account hashes used for rate limiting expire automatically after their configured short limiting window. Operational or security logs generated by Vercel follow Vercel's contract, project settings, and retention policy; Apple and Google transaction records follow each store's legal and operational retention policy.

On Android, as described above, the one-way hash of the answered chargeback review's pending refund token is automatically deleted after 31 days, the security record with the purchase-token hash and terminal state is automatically deleted no later than 60 days after terminal expiry, and the versioned HMAC marker of the deleted authentication generation is automatically deleted 330 seconds after deletion completes. All of these remain retained data; being one-way hashes does not make them anonymous or deleted.

Public Web pages

This page, an optional Web version, and the developer APIs used by the installed iOS and Android apps are hosted on Vercel. For requests from either a browser or an installed app, Vercel may process standard request information such as the IP address, User-Agent, timestamp, and requested URL to provide and secure the APIs and pages under its own policies. No first-party analytics cookies, advertising trackers, or behavioral analytics SDK are installed.

The app overview page (https://icm-ap.vercel.app/lp/) uses Vercel Web Analytics to measure page views and store-link clicks. This measurement uses no cookies and collects no personally identifying information such as names or email addresses.

Sharing, sale, and purpose

For required account authentication and ICM paid-plan management, the app processes the email address, Firebase UID and ID token, purchase token or transaction ID, appAccountToken, product ID, and subscription state described above. It never sells this data. Except when the user explicitly selects an export destination, the app does not transmit local data to a third party. This is an educational and analytical tool for poker mathematics. It does not offer real-money wagering, deposits or withdrawals, online matches, prizes, or referrals to gambling services.

Security and changes

Local data is stored in app-private storage managed by the operating system. The storage format has a schema version; unreadable data is not used for calculations, and the app recovers to a safe initial state. For processors and platforms such as Firebase, Vercel, Upstash, Apple, and Google, the developer reviews the provider's contracts, service terms, security information, and configuration and applies appropriate safeguards. Processing by each provider is also governed by that provider's contract and privacy policy. If a feature changes how data is handled, this policy and the Google Play Data safety answers will be updated before that feature is published.

Contact

Use the “Developer contact” shown in the Google Play listing, the “App Support” link in the App Store, or the support page.