Privacy Policy

Last updated: September 25, 2026

The Stayman Whisperer ("Service", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your information.

1. Information We Collect

Account Information

Email address — used for authentication, email verification, password resets, and transactional notifications.
Name — used for display purposes within the application.
Password — stored as a one-way bcrypt hash (12 rounds). We never store or log plaintext passwords.
Invitations — an administrator may invite you by giving us your name and email address. We use them only to create your account and send the invitation. If you don't accept within 30 days, we delete them; you can also ask us to delete them sooner.

Bridge Hand Data

PBN (Portable Bridge Notation) data — hand deals, auctions, contracts, play records, and vulnerability.
Analysis results — AI-generated responses stored in your history.
Analysis metadata — advice type, model used, token counts, timestamps.

Usage Data

Daily query counts — tracked for rate limiting and billing.
API token usage — input/output token counts per query for cost monitoring.

Feedback Data

When you submit feedback through the application, we collect:

Your message and selected category.
Browser information (user agent, viewport size, language, platform, screen dimensions, online status) — collected automatically to help debug reported issues.
The page URL where feedback was submitted.
Your email address (if logged in, or if you optionally provide it).

Payment Information

Payment processing is handled entirely by Stripe. We store only:

Your Stripe customer ID and subscription ID.
Subscription status (active, canceled, past due).

We do not store credit card numbers, bank account details, or other payment credentials. See Stripe's Privacy Policy for how they handle your payment data.

2. How We Use Your Information

Provide the Service — send your bridge hand data to the AI for analysis and display results.
Authentication — verify your identity and manage your account.
Rate limiting — enforce daily usage limits based on your subscription tier.
Transactional emails — send email verification, password reset links, and access request notifications.
Improve the Service — analyze usage patterns (in aggregate) to improve features and performance.
Customer support — respond to feedback and bug reports.

We do not use your data for advertising, sell it to third parties, or use it to train AI models.

Shared Links and Public Analyses

Your saved hands and analyses are private by default. You can choose to make one visible to others in two ways:

Share link — anyone with the link can view that analysis, without signing in. It shows your name. You can revoke the link at any time.
Public (Community) — the analysis is listed for all signed-in users under Past Hands → Community. It shows the hand, auction, play, and analysis, with your name or, if you choose, "A player". Player names from the imported PBN file are removed. Your email address is never shown. You can make it private again at any time, and administrators may remove public analyses.

Lessons (Learn by Playing)

Your progress — which lessons you've started, the cards you chose, and your score are stored with your account and visible only to you (and administrators).
Hands you upload for a lesson are stored privately with your lesson. The coach built for a hand (the questions and explanations) is saved and reused if anyone else uploads the same played hand; it contains no names or account details.
Library hands are chosen by administrators, sometimes from public Community analyses. Player names are removed from them.

The Chrome Extension

Our extension for Chrome, The Stayman Whisperer: Bridge Hand Analyzer, works with Trickster Cards (trickstercards.com). Trickster Cards is not affiliated with us.

What it reads — only on Trickster Cards, and only a bridge hand. It reads a hand when one ends and you click Analyze (or press its keyboard shortcut), or when you export a hand yourself from Trickster's menu. It doesn't read other websites or your browsing history.
Player names — as soon as the extension reads a hand, it replaces the players' Trickster usernames and account numbers with "Player". Only the computer players' names (such as "Floyd (Auto)") are kept.
On your computer — the extension keeps your last 10 hands, its settings, and whether you chose the light or dark theme on this site, in Chrome's storage for the extension. "Forget these hands" in the extension clears the hands; removing the extension clears everything.
What it sends — when you click Analyze or Open, the extension opens this site in a new tab and passes the hand to that page. From there it's handled like any hand you import (see Bridge Hand Data above). The extension sends nothing anywhere else.

3. Third-Party Services

The Service relies on the following third-party providers:

Provider	Purpose	Data Shared
Anthropic	AI bridge analysis	Bridge hand data, prompts (no PII)
Stripe	Payment processing	Email, subscription details
Resend	Transactional email	Email address, email content
Supabase / PostgreSQL	Database hosting	All account and analysis data
Cloudflare Turnstile	Bot protection	Browser fingerprint (anonymized)
Render	Application hosting	Server logs, request metadata

Data Sent to Our AI Provider

When you request analysis, we send to Anthropic, our AI provider:

Bridge hand data (card distributions, auction, contract, play record).
Your selected convention system (SAYC or 2/1 Game Forcing).
A system prompt describing the analysis format.

We do not send your email, name, or any personal information to Anthropic. See Anthropic's Privacy Policy for how they handle API data.

4. Data Retention

Account data — retained until you request account deletion.
Analysis history — retained indefinitely unless you delete individual entries or clear your history.
Usage data — daily counts retained for 90 days for rate limiting and billing records.
Feedback — retained for service improvement until you ask us to delete your account.
Server logs — retained for 30 days for debugging and security monitoring.
Deleting your account — ask us (the Feedback form, or "Send us a message" on the sign-in page) and we delete your account with its analysis history, lessons, usage and feedback. Server logs are kept for up to 30 days, Stripe keeps its own record of any payments, and hands already added to the lesson library (with player names removed) stay there.

5. Cookies and Local Storage

We use minimal browser storage:

JWT authentication token — stored in localStorage. Used to keep you signed in. Expires after 7 days.
User profile data — stored in localStorage for display purposes.

We do not use tracking cookies, analytics cookies, or advertising cookies. The Cloudflare Turnstile widget may set its own cookies for bot detection purposes.

6. Your Rights

You have the right to:

Access — view all data associated with your account through the application.
Correction — update your account information.
Deletion — request deletion of your account and all associated data.
Data export — download your analysis history via the application's history feature.
Withdrawal of consent — cancel your account at any time.

To exercise these rights, use the Feedback form in the application or contact us via email.

7. Security Measures

We implement the following security measures:

Passwords hashed with bcrypt (12 rounds).
Security tokens (reset, verification) stored as SHA-256 hashes with expiration.
HTTPS encryption for all data in transit.
CORS restrictions limiting API access to authorized origins.
Cloudflare Turnstile bot protection on public forms.
Rate limiting to prevent abuse.
JWT authentication with 7-day expiration.

8. Children's Privacy

The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us so we can delete it.

9. International Data Transfers

Your data may be processed in the United States where our servers and third-party providers are located. By using the Service, you consent to this transfer.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do:

We will update the "Last updated" date at the top of this page.
For material changes, we will notify you via email.
Continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, please use the Feedback form in the application or contact us via email.