Privacy Policy

This Policy explains which personal data Spotlib collects, what we use it for, who we share it with and what your rights are, under the Brazilian General Data Protection Law (Law No. 13,709/2018, "LGPD").

1. Data we collect

Data	Source
Name, username, email and password (stored encrypted)	Sign-up
Name, email and Google account identifier, if you sign in with Google	Google
Profile picture and Discord ID, if you provide them	Profile
Hands, images and tournament data sent, nodelock requests and comments	App use
Favorites, drill sessions and study history	App use
The team you belong to and your role in it	Team setup
Plan, subscription status, payment history and credit balance	Purchases
Date of last access, IP address and technical access logs	Automatic
Name, email and message sent through the contact form	Contact

We do not receive or store your full card details. They are entered directly with Stripe.

If you sign in with Google, we do not receive your Google password or access to your Gmail, Drive or other services. We only receive your name, email (already verified by Google) and account identifier, used to create your account and recognize you on later visits.

2. What we use it for and on what legal basis

• Creating and maintaining your account, granting plan access and providing the services you purchased (hand solving, nodelock, drills): performance of a contract (art. 7, V).
• Processing payments, billing and handling refunds: performance of a contract and compliance with a legal obligation (art. 7, II and V).
• Sending confirmation emails, password recovery and account notices: performance of a contract.
• Sending notifications through Discord, if you provide your ID: consent (art. 7, I). You can turn this off at any time in your profile.
• Including in the library, anonymously, the spots generated from the hands you send: performance of a contract, as set out in the Terms of Use. Name, username and nickname are removed before publication.
• Security, preventing fraud and account sharing, and access logs: legitimate interest (art. 7, IX) and the Brazilian Internet Civil Framework (Marco Civil da Internet).
• Replying to contact messages: legitimate interest.

We do not sell your data and do not use it for third-party advertising.

3. Who we share it with

We only share data with the providers needed for the Service to work:

• Stripe: payment and subscription processing.
• Google: authentication, only if you choose to sign in with Google. Google learns that you used your account to access Spotlib.
• Discord: sending notifications by direct message, only if you provide your ID.
• Your team administrator: on team plans, the administrator sees your name, username and your study activity in the Service (for example, drill sessions).
• Authorities: when there is a legal obligation or court order.

Some of these providers store data outside Brazil. In those cases, the transfer follows art. 33 of the LGPD and the contractual safeguards they offer.

4. What other users see

• Your username and picture appear on the comments you post.
• Spots generated from your hands appear in the library without any identification of you.

5. Cookies and local storage

We only use necessary cookies and local storage: the session cookie that keeps you signed in between the site and the app, the access token stored in the browser and display preferences (such as panels opened or closed). We do not use advertising cookies or third-party tracking tools.

6. How long we keep it

• Account data: for as long as the account exists.
• Access logs: at least 6 months, as required by the Marco Civil da Internet.
• Payment data and invoices: for the period required by tax law (usually 5 years).
• Hands imported into the Replayer on the free plan: 48 hours after import, together with their share links. After that they are permanently deleted.
• Anonymous library spots: remain published after the account is deleted, since they do not identify you.

After these periods, the data is deleted or anonymized.

7. Your rights

Under the LGPD (art. 18), you can request at any time:

• confirmation that we process your data, and access to it;
• correction of incomplete or outdated data;
• anonymization, blocking or deletion of unnecessary data;
• portability of your data;
• information about who we share your data with;
• withdrawal of consent, when that is the legal basis;
• deletion of your account and personal data, subject to the legal periods in section 6.

If you signed in with Google, you can remove Spotlib's access to your Google account at any time at myaccount.google.com/connections. This does not delete your Spotlib account. To delete it, use the contact below.

To exercise any right, use the contact form or write to spotlib.poker@gmail.com . We reply within 15 days. You can also file a complaint with the Brazilian National Data Protection Authority (ANPD).

8. Security

We use an encrypted connection (HTTPS), hashed passwords and restricted access to data. No system is completely immune to failures. If there is a security incident that may cause relevant risk or harm, we will notify you and the ANPD.

9. Minors

Spotlib is intended for people aged 18 or older. We do not knowingly collect data from minors. If we identify an account belonging to a minor, it will be deleted.

11. Changes to this Policy

We may update this Policy. Relevant changes will be announced by email or within the app. The date of the version in force appears at the top of this page.