Privacy policy

Who is responsible

Donky is operated by Toni Ylitervo, Lönnrotinkatu 32 D 52, 00180 Helsinki, Finland. Toni Ylitervo is the controller of personal data processed through Donky.

For privacy questions or requests, email support@donky.gg.

Using Donky on your device

You can record and replay hands and track sessions without creating an account. Records kept only on your device are not uploaded by these local features. Camera and microphone access are requested when you record a hand story. The recording is processed on your device. Creating a hand-story video alone does not upload it. If you later choose to publish a photo or video as a public post, that selected file is uploaded to Donky. Saving a video to Photos or sharing it through another app creates a copy in the destination you choose.

Data used by online features

• Account: your email address, account ID, optional display name, handle, avatar, biography and profile links, verification status and account timestamps. A password hash is stored if you set a password; email-code accounts do not need one.
• Sign-in and security: device and session identifiers, token hashes, sign-in, verification, password-reset and account-deletion codes stored as hashes, request metadata and abuse-prevention counters. If you enable push notifications, we store the device push token and your notification preferences to deliver account activity notifications.
• Cloud backup and sharing: the sessions, tournaments, hands, reviews, settings and associated dates, venues, amounts and notes that the app sends when you use these features. Turning on backup allows supported records to sync automatically. Sharing a hand also sends the data needed to create that share.
• Social features: public hand snapshots, text/photo/video posts and their media files, captions, comments, replies, mentions, likes, follows, follower/following lists and counts, and any results graph you explicitly publish. We also store your private bookmarks, hidden-post and muted-account preferences, blocks, notifications and read state. Existing friend relationships, lists and legacy recipient-only shares may remain associated with your account.
• Support and moderation: the information you send in a support request or content report, its content reference and the handling of that report. Authorised moderators may review reported content and screen public posts and comments, including published photos. Administrative access and decisions are restricted and recorded. Only if you explicitly allow optional AI screening, your published text and photos (including any personal information in them) are sent to OpenAI; screening categories and review decisions are stored with content references. AI flags guide human review and do not automatically remove content. New photos and videos remain private until a moderator approves publication. Video footage, audio and captions require human review and are not sent to AI. You can decline or withdraw AI permission in account settings without losing posting access; withdrawal stops future checks but cannot recall prior disclosures. We store your current permission, notice version and change time. Private source hands, unlisted-link snapshots, private notes, seat labels and account email addresses are not sent by this screening tool.

Donky does not request access to your phone’s address book. Friend relationships are the social graph you create within Donky. Private saved-player identities, reads and tags are excluded from ordinary cloud sync. If you explicitly include seat display names in a share or a video, those names are visible in that shared copy.

Public profiles, posts and hand links

Your public profile can show your display name, handle, avatar, biography, links, published posts, follow relationships and counts. A results graph appears only when you explicitly publish it, and you can hide it again. Private session records and your full bankroll are not made public by publishing a graph.

Publishing to your profile or the feed makes that post public. New photo and video submissions first remain visible only to their author and authorised moderators until human approval. It may appear in Following or Discover and can be viewed or shared through a browser link. A public hand can include cards, actions, stacks, results, your caption and any seat display names you explicitly include. Posting does not publish your other private hands, sessions, saved-player notes or cloud backup.

“Share by link” creates a separate unlisted hand snapshot. It is not added to your public profile or feed. Anyone holding that link can view it, including someone it is forwarded to through WhatsApp or another service; it is not a recipient-authenticated private message. You can disable the link. Existing legacy recipient-only shares remain restricted to their authorised recipients.

You can unpublish your posts, hide your published graph and disable hand links. Blocks restrict in-service interaction, but public content is not made confidential by blocking an account. Donky cannot recall screenshots, downloaded videos or copies saved outside the service. Public avatars and post media are served through media URLs; cached copies may take time to expire after removal.

How feeds are ordered

Following uses your follows and your own publications. Discover can order public posts by recency or by signals such as publication age and likes and comments, with variety across authors. Your hidden posts, muted accounts and blocks affect what you see. Private bankroll amounts, private hand notes and inferred poker skill are not used by this ranking. Saved posts and feed preferences are private account features, not public profile lists.

Why we process data

We process account and feature data to provide the service you request, on the basis of performing our agreement with you. We process security, abuse-prevention and support information for our legitimate interests in keeping Donky safe and reliable, taking your rights into account. Where processing depends on consent, you may withdraw it, for example by changing camera or microphone permissions in iOS Settings. Information may also be retained or disclosed where a legal obligation requires it.

Donky does not sell personal data, use advertising trackers or make automated decisions that produce legal or similarly significant effects. Text filtering can refuse a post; you can contact support if you think this was a mistake.

Service providers

Donky uses Vercel for hosting and avatar/post-media storage, Neon for the database, and Resend for sign-in, verification, password-reset and account-deletion email. When AI moderation is enabled, OpenAI processes selected public post/comment text and published photos for safety screening. Apple Push Notification service delivers notifications when enabled. These providers process information needed for their services, including request metadata, stored account data, uploaded avatars and post media, or email addresses and delivery details. Resend does not receive your poker records through our email templates.

Apple and any services you choose for Photos, device backups or sharing handle information under their own policies. Service providers may process data outside your country or the European Economic Area. Where required, transfers must be covered by an applicable adequacy decision or contractual safeguards. Contact us for information about the safeguards applicable to your data.

Retention and deletion

Account and cloud records are kept while needed to provide your account and the features you use. In Donky Account in the app or on the website, choose Delete account, request a deletion code sent to your account email, enter it and confirm permanent deletion. You do not need to create a password. This erases your account from the active service, revokes all sessions and removes associated cloud records, published hands and social posts, photos, videos, comments, follows, account avatars and account-linked AI screening records. Existing clients may also offer password confirmation. Local poker records on your device remain available unless you separately remove them.

Support correspondence, security logs and moderation records are retained for handling the request, investigating abuse and meeting applicable legal obligations. Service-provider backups or logs may expire on a different schedule from the active database. Copies saved by other people or services are outside Donky’s control. If you cannot use the in-app deletion flow, contact support.

Your choices and rights

You can edit your profile, show or hide your results graph, unpublish posts, delete your comments, manage follows and blocks, change notification preferences, disable hand links and delete your account. You can choose whether to use cloud backup. Turning off backup stops future automatic uploads; it does not erase records already stored in the cloud.

Where applicable, you may request access, correction, erasure, restriction, data portability or object to processing based on legitimate interests. Email support with your request; we may need to verify your identity. You can also complain to your local data protection authority, including Finland’s Office of the Data Protection Ombudsman.

Changes and contact

We update this policy when Donky’s data practices change. The date above identifies this version. For questions about your account, shared content or this policy, contact support@donky.gg.