Chipstack

Privacy Policy

Effective 6 October 2026 · Last updated 6 October 2026

Chipstack is a record-keeping app for private poker nights among friends. It keeps track of who bought in, who cashed out, and who owes whom at the end of the night. This page describes exactly what it stores, where, and for how long.

Who is responsible

Chipstack is operated by Batuhan Özalhan, an individual developer resident in Türkiye. For any question about this policy or your data, write to support@chipstackapp.com.

What Chipstack stores

Your account

Data	Why
Email address	To sign you in, verify the address, and send password resets. Stored twice: as you typed it, and in a normalised form used only for matching, so that two spellings of one mailbox are one account.
Display name	So other members of your communities can see who recorded what.
Password	Never stored. Only an Argon2id hash of it, which cannot be reversed back to your password.
Profile photo	Optional. Only if you upload one.
Apple or Google account identifier	Only if you choose "Continue with Apple" or "Continue with Google". Chipstack stores the opaque identifier that provider gives it, not your password with them.
Sign-in security data	Failed sign-in counts and lockout times, to slow down people guessing your password.

Your games

Data	Why
Communities and rooms you belong to	The structure of your game nights.
Buy-ins, cash-outs, tips and service entries	The ledger itself. Amounts, times, who recorded them, and any note you typed.
Settlements	Who owes whom at the end of a night, and whether it has been marked paid.
Badges and statistics	Derived from the above. Nothing extra is collected for them.

These amounts are a shared record. Everyone in a community can see the ledger for the nights they took part in. That is the purpose of the app.

Notifications

If you turn notifications on, Chipstack stores the push subscription your browser or device gives it, so it can deliver reminders. Turn notifications off and that subscription is removed.

Purchases

If you buy a Chipstack Pro pass, Chipstack stores which product you bought, when, the transaction identifier from Apple or Google, and which community the pass was applied to. Chipstack never sees your card, your bank details or your billing address. The payment is handled entirely by Apple or Google, and all Chipstack receives is a receipt to verify.

What Chipstack does not store

• No card numbers, bank details or billing addresses.
• No location data. The app never asks for your location.
• No contacts, photos library, camera roll or microphone access beyond a photo you choose to upload.
• No advertising identifiers, no device fingerprinting, no behavioural profile.
• No crash or usage analytics. (This also means a crash on your device produces no report — see Known limits.)

Where your data lives

Service	Role	Location
Neon	The database holding everything above	Frankfurt, Germany (EU)
Google Cloud Run	Runs the Chipstack server	Belgium (EU)
Firebase Hosting	Serves the web app and this page	Google global edge
Resend	Sends verification and password-reset email	Receives your email address and the message
Apple / Google	Sign-in, payments, push delivery	Only if you use those features

Your records are stored in the European Union. Chipstack is operated from Türkiye, so the operator accesses them from there.

Why Chipstack is allowed to store it

• To provide the service you asked for. You cannot have a shared ledger without storing the ledger.
• To keep accounts secure. Password hashing, lockouts and email verification.
• To keep other members' records intact. A night you played in is also their record, so it does not vanish when you leave.

Chipstack does not rely on consent for any of this except notifications, which you turn on and off yourself.

Deleting your account

You can delete your account from inside the app: Profile → Security → Delete account. You will be asked to re-enter your password, or to sign in again with Apple or Google, because deletion cannot be undone.

When you delete:

• Your name, email address and photo are replaced with a placeholder. Your row is kept but is no longer identifiable — it reads Deleted account with a number.
• Your memberships, push subscriptions, linked Apple or Google identities and password-reset tokens are deleted outright.
• If you own a community that has other members with accounts, it passes to another member so their history survives.
• A community where you are the only member with an account is deleted entirely, along with every game in it. The app tells you which ones before you confirm.
• The money records of nights you played with other people stay, under the anonymised name. They are those people's records too, and removing them would falsify what they are owed.

There is no waiting period and no way to restore the account afterwards.

Your rights

Depending on where you live — this includes the GDPR in the EU and the KVKK in Türkiye — you may have the right to ask what is held about you, to correct it, to have it deleted, or to object to how it is used. Deletion is built into the app and needs no request. For anything else, write to support@chipstackapp.com and you will get an answer.

Children

Chipstack is not designed for or directed at children, and accounts are not knowingly created for them.

Security

Passwords are hashed with Argon2id. Traffic is encrypted in transit. Sign-in tokens can be revoked. Stored Apple refresh tokens are encrypted at rest. No system is perfect, and Chipstack is maintained by one person — it is not a bank, and you should not treat it as one.

Changes

If this policy changes in a way that affects you, the effective date at the top changes and the app will say so.