TableRivals Privacy Policy

1. Who this covers

• Guests — people who scan a code at a Venue and play, order, or win rounds.
• Venue staff and owners — people who use the Venue dashboard or owner settings.
• Website visitors — people who visit tablerivals.com.

2. What we collect

From guests

• A display name and avatar you choose. You do not need to create an account or give us your email to play. Display names are shown to other guests, on the Venue's leaderboard, and on tickets Venue staff use to hand you a round.
• A device identifier. When you scan in, we create an anonymous account tied to your device so your seat, streak, and history persist for about 30 days. This is not linked to your name or email unless you choose to link an account.
• Gameplay data — matches, moves, results, timing, and which Venue and seat you played from.
• Payment information, handled by Stripe. If you pay for a round or open a tab, your card or wallet details go directly to Stripe, our payment processor. We never see or store your full card number. Stripe provides us a token, the last four digits, and a card fingerprint (a non-reversible identifier for the card) so we can recognize a returning guest and tell your rounds apart from someone else's.
• Orders and rounds — what was ordered, for whom, when it was picked up, and any refund.
• Optional account linking. If you choose "Save your streak" with Google or Apple, we receive your name and email from that provider and link it to your existing history. This is optional and never required to play.
• Technical data — IP address, browser type, approximate location derived from the Venue you scanned into, and error reports.

From Venue staff and owners

• Owner account email and password (or Google sign-in), Venue settings, menu items and prices, staff PIN (stored as a one-way hash), device sessions, and the actions staff take on the dashboard (for example, marking a round picked up), with a timestamp and device.

From website visitors

• Standard server logs (IP address, pages viewed, browser). We do not use advertising trackers on tablerivals.com.

3. Why we use it

• To run the games, match you with another table, and settle rounds.
• To process payments, holds, captures, and refunds through Stripe, and to prevent fraud and duplicate charges.
• To route a won round to the bar, print a ticket, and let staff hand it to the right person (which is why your display name and a claim word appear on the ticket).
• To keep a leaderboard and your streak, and to recognize you as the same person across nights.
• To keep names appropriate. Display names are checked automatically against a word list and, in unclear cases, by an automated classifier before they appear on a leaderboard or ticket. Venue staff can rename a display name they consider inappropriate.
• To give Venues reports about their own floor: rounds sold, revenue, busiest hours. Venues see aggregate and order-level data for their own Venue only.
• To fix bugs and keep the service running (error monitoring).
• To comply with law, enforce our terms, and respond to disputes such as "I never received my round."

4. Who we share it with

We do not sell personal information. We share it with:

• Venues — the Venue you played at sees your display name, the round you won or bought, pickup and payment status, and your last four card digits for dispute resolution. It does not see your full card number or your email unless you gave it to the Venue directly.
• Service providers that process data on our behalf: Stripe (payments), Supabase (database and authentication), Vercel (hosting), Sentry (error monitoring), and Anthropic (automated name moderation; only the proposed display name is sent). Each is bound to use data only to provide their service.
• Sign-in providers — Google or Apple, only if you choose to link an account.
• Law enforcement or regulators when required by law, and successors in a merger or acquisition, with notice.

5. How long we keep it

• Gameplay and order records: retained for 24 months for dispute resolution, reporting, and legal compliance, then deleted or anonymized.
• Anonymous device accounts with no activity: deleted after 12 months.
• Payment tokens and fingerprints: kept while you have an open tab, credit, or a dispute window, then deleted; Stripe retains records under its own policy.
• Venue owner accounts: retained while the Venue is a customer, then deleted within 90 days of closure.
• Error logs: 90 days.

6. Your choices and rights

• Play without an account. You never have to give us your email to play.
• Change or remove your name. Change it at your next seat; ask a Venue or email us to remove it from a leaderboard.
• Delete your data. Email privacy@tablerivals.com with the display name and Venue you played at, or the email you linked, and we will delete your data within 30 days, except records we must keep for payments, disputes, or law.
• California residents have the right to know what we collect, to delete it, to correct it, and to not be discriminated against for exercising those rights. We do not sell or share personal information for cross-context advertising. Contact privacy@tablerivals.com to exercise these rights.
• Payment data is governed by Stripe's privacy policy at stripe.com/privacy.

7. Age

The service is for guests aged 21 and over at Venues that serve alcohol, and 18 and over elsewhere. Any feature involving payment or prizes requires you to be at least 21. We do not knowingly collect information from anyone under 18.

8. Security

We use encryption in transit, restrict database access by role, store staff PINs as one-way hashes, and never store full card numbers. No system is perfectly secure; if we learn of a breach affecting you, we will notify you as required by law.

9. Changes

We will post changes here and update the date above. Material changes will be noted on the app's join screen.

10. Contact