Privacy policy

Account information may include your name, email address, sign-in provider, an internal user identifier and subscription status. If you use password sign-in, the service stores a one-way password hash rather than the readable password. Google sign-in supplies profile information that you authorise Google to share.

When you use member features, we may store study preferences, saved playbooks, trainer hands, decisions, accuracy and related product activity. If you join a waitlist or referral programme, we process the details submitted through that form.

Stripe processes checkout, payment methods and billing. GTO Central receives identifiers and subscription information needed to provide access and support billing, such as a Stripe customer identifier, subscription identifier, price, status and current period end. We do not receive or store full card numbers in the application database.

Google Analytics and PostHog are configured for authenticated product analytics and remain disabled until an eligible signed-in user is identified. Google Analytics receives an opaque user identifier and product events. PostHog may also receive the account email, name and subscription status as person properties. Session recording, when enabled, masks form inputs and designated private text and excludes request or response bodies.

The browser uses an HTTP-only session cookie for sign-in and local storage for selected preferences and application state. Embedded media or third-party sign-in and checkout components may set or read their own storage according to the provider's policies.

We use information to authenticate members, provide and personalise study features, save progress, administer subscriptions, respond to support, prevent abuse, diagnose failures, understand product usage and improve the service. We may also use information to comply with legal obligations and enforce our terms.

We do not sell personal information. We do not use account information to promise or calculate gambling outcomes.

We disclose information to vendors only as reasonably needed for them to provide services such as hosting and infrastructure, authentication, payment processing, analytics, content delivery, embedded video, security and support. Current integrations include Google, Stripe, PostHog, Sanity and YouTube's privacy-enhanced embed domain.

Information may also be disclosed when required by law, to protect users or the service, or as part of a corporate transaction subject to appropriate safeguards. Providers may process information in countries other than your own.

We retain information for as long as it is needed to operate the account and service, meet legal and accounting requirements, resolve disputes and protect against abuse. Retention periods differ by record type. Information that no longer needs to be retained may be deleted or de-identified.

We use technical and organisational safeguards intended to protect information, including secure session cookies and access controls. No online system can guarantee absolute security, so please use a unique password and tell us promptly if you believe an account has been compromised.

Depending on where you live, you may have rights to access, correct or delete personal information, object to or restrict certain processing, or receive a portable copy. You can also sign out, change available preferences and manage billing through the subscription portal.

Send a request from the email address associated with the account. We may need to verify identity and may retain information where the law or a legitimate operational need requires it. You may also complain to the privacy regulator in your jurisdiction.

GTO Central is not directed to children who cannot legally consent to the processing of their information. If you believe a child has provided personal information without appropriate permission, contact us.

We may update this policy as the service or legal requirements change. The date above identifies the latest version, and material changes may also be communicated through the service.