Privacy Policy

The short version

• Floorside is a social app about casino gambling: a feed for sharing sessions, a personal profit/loss log, a casino directory with community reviews, courses, and free-play simulators. No real-money gambling happens in the app.
• We collect what you give us (account, profile, posts, session log) and a small amount of technical data needed to run the Service. We do not run advertising, we do not sell your data, and we use no third-party analytics or ad SDKs.
• We never track your location. The casino map is browsed by place, not by where you are.
• Every session you log — shared or private, real or simulator — is stored on our servers and we have access to that information, both in aggregate and per account. Private sessions are never shown to other users.
• Your gambling activity is never shared with casinos, sportsbooks, or gambling operators, and never used to target you with gambling promotions.
• You can export your session log, make your account private, choose per session what to share, and delete your account (and everything in it) from Settings at any time.

1. Who we are and scope

Floorside is the data controller for the personal information described in this policy. This policy applies to the Floorside iOS and Android apps, the Floorside web app, our website at floorside.co, and any emails we send you. It does not apply to third-party sites or services you may reach through Floorside (for example Google Maps directions or a help resource); those have their own policies.

2. Information we collect

2.1 Information you provide directly

• Account information. Your email address and a password when you create an account. We confirm the email address with a code we send to it at sign-up, and we use it to confirm your account, to recover your password, and to send you security notices. Passwords are hashed by our authentication provider; we never see or store your plaintext password. When you sign in with your username instead of your email, we look up the email linked to that username on our servers to complete the sign-in. If someone requests a password reset using your username, the reset email goes only to you, and the requester sees just a masked form of your email address (its first letter and the domain’s ending, for example s•••@g•••.com).
• Age attestation. When you first open the app you confirm that you are at least 18 years old. We keep a record that this confirmation was made, when, and by which account, as an audit trail.
• Profile information. Your username, optional display name, avatar (a chosen emoji and color, or a photo you upload), bio, home city or region (typed by you, not detected), profile flair, and your settings such as whether your bankroll is shown and whether your account is private. Previous usernames you have released are kept, linked to your account, so a handle is held for 30 days after you change it or delete your account; after deletion only the handle itself is kept, unlinked, for 60 days.
• Posts and social content. Text, titles, photos, hashtags, @-mentions, and polls you post; your poll votes; comments and replies; reactions; posts you save; and stories (visible to others for about 24 hours; the photo is deleted from our servers within about three days, and the story record is removed when you delete your account).
• Session log. Each session you log: the date, game, venue (and the directory entry it maps to, if any), buy-in, cash-out, profit or loss, duration, an optional note and “vibe” tag, whether it is a real session or a simulator session, and whether you chose to share it. Shared sessions also create a post, which carries the game, venue, result, note and vibe tag, and may include a photo.
• Casino reviews and ratings you write.
• Social graph. The accounts you follow, follow requests you send or receive, and the accounts you block or mute.
• Reports you submit about content or accounts, including any description you add.
• Communications. Anything you send us when you contact support or give feedback, and our replies.
• Waitlist. If you join the waitlist on floorside.co, the email address you enter, when you entered it, and which of the two forms you used. We use it only to email you about the launch; reply to any such email and we will remove it.

2.2 Information collected automatically

• Usage information. Which posts appear in your feed and which you view (“impressions”), which stories you view (we record that you viewed it, and the story’s author can see that you did), and what you save and react to. We use this to run and rank the feed and to understand which features are used. The feed is ranked by how much engagement a post has drawn relative to how many people have seen it, how recent it is, whether it has a photo, the size of a winning result, whether you follow the author, and whether you have already seen it; the “Following only” filter shows the accounts you follow, newest first. We do not keep a search history; recent searches stay on your device. Search terms, like any request, may appear in our hosting provider’s request logs for up to 30 days.
• Progress and game state. Play-money chip balance, XP, level, streak, lessons and courses completed, badges, simulator results, a discipline score derived from your activity, your streak history and freezes, last-active date, and your most-played course, synced to your account so they follow you between devices.
• Device and technical information. Our hosting provider’s request logs record your IP address, request time, the requested URL, and browser/app user-agent string. We do not separately collect or store your device model, OS version, language, time zone, or screen size; the standard user-agent string in those logs may reveal your OS and app or browser version. These logs exist for security, abuse prevention, and debugging.
• Push token. If you turn on notifications, a push token issued by Expo’s notification service, which relays to Apple or Google, that lets us deliver notifications to that device. To issue it, Expo receives the platform, the device’s push token, our app id and an install id Expo generates; no hardware or advertising identifier.
• Local device storage. The app stores your progress, drafts, cached content, and preferences on your device so it works offline and starts quickly. The device also holds your account email, a sign-in session token, and queued actions (such as a report written offline).
• Device permissions. Camera (to take a photo for a post or story); Photos (to attach a photo — the system photo picker hands us only the photos you choose, never your whole library — and, if you choose Save Image on a share card, to add that one image to your library; that permission is add-only, so we still never read your library); Notifications (only if you turn them on). We never ask for microphone, contacts, or location access.
• What we do not collect. We do not use third-party analytics, crash-reporting, or advertising SDKs, and we do not collect advertising identifiers (IDFA / GAID). We do not request or collect precise or approximate device location.

2.3 Information from other sources

• App stores. When you subscribe to Pro, Apple or Google (and our subscription-management provider, if enabled) confirm whether your subscription is active; we do not receive your payment details.
• Other users. Other users may mention you, reply to you, react to your content, follow you, or report you. We receive that information as part of running the Service.
• Public casino data. Our casino directory is built from OpenStreetMap and similar public sources. This is information about venues, not about you.

3. Private sessions and our access

The share toggle on a session controls what other users see. It does not hide the session from us. Every session you log — shared or private, real or simulator — is stored on our servers, and we have access to that information too. We use it to keep your log in sync across your devices, to understand how the Service is used (for example, how many sessions are logged per day, per game, per venue, or per sign-up month), to support you when you ask for help, and to investigate accounts when needed for safety, fraud, or abuse prevention. We review this data both in aggregate and for individual accounts. Private sessions never appear on your profile, in the feed, on a casino page, or in any other user-facing place unless you turn sharing on. The statistics shown on your public profile (net profit/loss, win rate) are calculated from your shared sessions only.

4. How we use information

We use the information we collect to:

• Provide and operate the Service — create and secure your account, sync your data between devices, show your content to the audience you chose, deliver notifications, and process subscriptions.
• Personalize your experience — suggest accounts and remember your preferences.
• Keep the community safe — detect and prevent spam, abuse, fraud, and violations of our Terms and Community Guidelines; screen images posted to the feed and stories and profile photos, and check typed text (posts, comments, reviews, your profile name, bio, location and username) against a short fixed list of slurs; review reports; and enforce blocks and account restrictions.
• Support you — respond to questions, troubleshoot problems, and investigate issues you raise.
• Understand and improve the Service — measure how features are used, fix bugs, test changes, and decide what to build next. This includes reviewing session-log data in aggregate and, where needed, for individual accounts.
• Communicate with you — send transactional messages (for example the code that confirms your email at sign-up, a password-reset link, or a notice that your password was changed) and, if you opt in, reminders.
• Comply with law — meet legal, regulatory, tax, and accounting obligations, respond to lawful requests, and establish, exercise, or defend legal claims.

We do not use your information to decide whether you can gamble, to promote real-money gambling to you, or to build profiles that we sell or share with gambling operators, advertisers, data brokers, or credit, insurance, or employment services.

5. Legal bases (EEA, UK, Switzerland)

Where the GDPR, UK GDPR, or Swiss data-protection law applies, we rely on the following legal bases:

• Performance of a contract — to provide the Service you signed up for, including your account, content, session log, sync, and subscriptions.
• Legitimate interests — to secure the Service, prevent abuse, understand usage, improve features, and communicate about the Service, where those interests are not overridden by your rights. You can object at any time (see “Your rights”).
• Consent — for optional things such as push notifications. You can withdraw it at any time in your device’s notification settings, without affecting processing that happened before.
• Legal obligation — where we must retain or disclose information to comply with the law.

Information about gambling activity may be treated as sensitive in some jurisdictions. We process it only to provide the features you use, on the basis that you have deliberately chosen to record it and, unless you turn sharing off for a session, to make its result public.

6. How we share information

6.1 With other users and the public

• Your profile (username, display name, avatar, bio, location, flair, badges, level, streak, Pro status, and the month you joined) is visible to other users. If your account is public, it and your posts may be visible to anyone, including people who are not signed in where the web version allows it, and may be indexed by search engines.
• Content you post — posts, comments, reactions, stories, and shared sessions — is visible to the audience you chose: everyone for a public account, or approved followers for a private account. Casino reviews you write are visible to everyone if your account is public; if your account is private, only you can see them, and they are not counted in the casino’s rating. Comments and reactions you leave on other people’s public posts are visible wherever that post is.
• Photos are served from a direct link. Someone who already has that link — for example a follower you later remove or block — can keep opening it until you delete the post, story or photo; story photos are deleted within about three days.
• Your public profile statistics (net profit/loss and win rate from shared sessions) are shown only if you turn on “Show bankroll on my profile.” It is off by default.
• When you view someone’s story, we record that you did. When you follow, mention, or reply to someone, they are told.
• Other people can screenshot, copy, or re-share what you make public. Once content is public we cannot control what others do with it.

6.2 With service providers

We share information with companies that process it on our behalf, under contracts that limit their use to providing services to us:

• Supabase — database hosting, authentication, file storage, serverless functions, and auth-related email. This is where your account, content, and session log live.
• Expo (via Apple Push Notification service and Firebase Cloud Messaging) — push-notification delivery.
• Resend — transactional email delivery (for example the sign-up confirmation code, password-reset and security emails), and the alert email we send ourselves when a report is filed (see “Reports” below).
• OpenAI — automated moderation of images you post to the feed and stories, and of your profile photo. The image is sent to OpenAI’s moderation API, which returns a safety classification; OpenAI does not use moderation-API inputs to train its models.
• Apple App Store and Google Play, and RevenueCat if enabled — subscription billing and management.
• Google Maps Platform — the map on Android and the maps hand-off on every platform; Google receives your IP address and the venue you looked up, under Google’s privacy policy. On iOS the in-app map is Apple Maps.
• OpenStreetMap and CARTO — map tiles on the web version. Loading tiles reveals your IP address to the tile server, as with any web image.
• Google Workspace — hosts our support inbox, so email you send us, and the report alert emails described below, are processed by Google.

We may add or change providers; we will update this policy when a change matters to you.

6.3 For legal, safety, and business reasons

• Legal requests. We may disclose information to comply with a subpoena, court order, or other lawful request from public authorities, including to meet national-security or law-enforcement requirements. Where legally permitted and reasonable, we will try to notify you before we produce your information.
• Safety and enforcement. To investigate or prevent fraud, abuse, security incidents, or violations of our Terms; to protect the rights, property, or safety of Floorside, our users, or the public; and to enforce our agreements.
• Business transfers. If Floorside is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, your information may be transferred as part of that transaction. We will notify you (for example by a notice in the app) of any change in ownership or in how your information is used.
• With your direction. When you ask us to share information, or when you use a feature that by design shares it (for example opening a casino’s address in Google Maps).

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not share your gambling activity with casinos, sportsbooks, gambling operators, or their affiliates.

7. Your choices and controls

• Profile and content. Edit your profile and delete any post, comment, story, review, or session at any time from within the app.
• Per-session sharing. Every session has its own share toggle. Sharing creates a post; unsharing removes it.
• Show bankroll. Your public profit/loss and win rate are hidden unless you turn this on (Settings).
• Private account. Limits your posts and shared sessions to approved followers. Existing followers stay unless you block them.
• Blocking and muting. Blocked accounts cannot see your content or interact with you; muted accounts’ posts and reviews are hidden from you without their knowledge. Manage them in Settings → Blocked accounts.
• Reporting. Report content or accounts from any post or profile.
• Notifications. Turn push notifications off in your device’s notification settings, and streak reminders off in the app. Transactional emails about your account’s security cannot be turned off while your account exists.
• Export. Download your session log as a CSV (date, game, venue, buy-in, cash-out, result, duration) from the Bankroll tab at any time — one file for real sessions and one for simulator sessions.
• Delete your account. Settings → Delete account permanently deletes your account, profile, posts, comments, reactions, stories, reviews, session log, uploaded images, and progress. This cannot be undone.
• Local data. Signing out or uninstalling the app removes cached data from that device; it does not delete your account.

8. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy.
• Correct inaccurate or incomplete information.
• Delete your information (you can do most of this yourself, see above).
• Port your information — receive it in a structured, machine-readable format (the CSV export covers your session log — date, game, venue, buy-in, cash-out, result, duration — one file for real sessions and one for simulator sessions; contact us for the rest).
• Restrict or object to certain processing, including processing based on legitimate interests.
• Withdraw consent where processing is based on consent.
• Opt out of “sale” or “sharing” of personal information and of targeted advertising. We do none of these, so there is nothing to opt out of. Because we do not sell or share personal information, a Global Privacy Control signal requires no action from us.
• Not be discriminated against for exercising your rights.
• Complain to a data-protection authority (for the EEA, your local supervisory authority; for the UK, the Information Commissioner’s Office).

To exercise a right, email hello@floorside.co from the email address on your account, or use the in-app tools. We may ask you to verify your identity before acting on a request, and we will respond within the time required by applicable law (generally 30 days in the EEA/UK and 45 days in U.S. states, extendable once where permitted). You may designate an authorized agent to make a request on your behalf; we will still need to verify your identity and the agent’s authority.

9. Additional information for U.S. residents

This section supplements the rest of the policy for residents of California and other U.S. states with comprehensive privacy laws (including Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, and Virginia).

Categories of personal information we have collected in the past 12 months, with the sources and purposes described in sections 2 and 4:

• Identifiers — email address, username, user ID, device token, IP address.
• Personal records — display name, city/region.
• Commercial information — subscription status.
• Internet or network activity — feed impressions, in-app interactions, request logs.
• Audio/visual information — photos you upload, including your avatar.
• Inferences — a discipline score derived from your in-app activity, used only inside the Service. The feed-ranking signals described in Section 2.2 (your follows, and which posts you have already seen) are derived from your activity and used only inside the Service to order your feed.
• Sensitive personal information — account credentials; and, to the extent gambling records are treated as sensitive, your session log. We use sensitive information only to provide the Service and for security, and not to infer characteristics about you.

We disclose these categories to the service providers listed in section 6.2 for business purposes. We have not sold or shared personal information for cross-context behavioral advertising in the past 12 months, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.

California residents may also request, once a year, a list of third parties to whom we disclosed personal information for their own direct-marketing purposes (“Shine the Light”); we do not do this. Nevada residents may submit an opt-out request even though we do not sell personal information as Nevada defines it. To make any request, email hello@floorside.co. If we deny a request, you may appeal by replying to our decision.

10. Data retention

We keep personal information for as long as your account exists and as needed to provide the Service. Specifically:

• Account, profile, content, and session log — until you delete the item or your account.
• Stories — visible to others for about 24 hours; the photo is deleted from our servers within about three days; the story record is removed when you delete your account.
• Previous usernames — kept, linked to your account, until you delete your account.
• Released usernames — when you delete your account, the handle you held (and any handle you had renamed away from within the previous 30 days) is kept on its own, not linked to you or any other data, so nobody can take it for 30 days; the record is discarded within 60 days.
• Deleted account — removed from our live systems immediately upon deletion, except the bare username hold described above, and from backups within 30 days as they roll over.
• Image-moderation results — the classification (not the image) is kept with the post for as long as the post exists. If a profile photo is flagged, the classification and a record of which photo it was are kept for as long as your account exists, so the same photo can’t be set again; the photo itself is deleted after 30 days.
• Reports — reports you file are deleted with your account; reports about you are retained so we can handle repeat abuse and appeals. When a report is filed, one alert email carrying the reporter’s username and account id, the reported account’s username and display name, the reason, the description (up to 500 characters) and the text of the reported post, comment or review (up to 1,000 characters) is sent to our support inbox so a person can review it; that email copy is not deleted with your account. We delete it when the case is closed, and no later than one year after the report.
• Hosting request logs (including IP addresses) — kept by our hosting provider for up to 30 days.
• Sign-in, password-recovery, and account-deletion attempts — to slow down password guessing and reset flooding, we keep a keyed hash (never the readable values) of the username or email you typed — for account deletion, the email on your account — and of your IP address, for each sign-in attempt made with a username (email sign-ins are rate-limited by our authentication provider instead), each password-recovery request, and each account-deletion attempt. A successful sign-in or deletion drops its own entry; failed attempts and every recovery request stay counted. These hashes are used only to enforce attempt limits and are deleted within about half an hour.
• Notification and upload throttles — to cap how many notifications we send you and how many images you upload in a day, we keep your account id and a timestamp for each notification delivered and each upload link issued; entries are deleted nightly once older than a day, so none lives more than about 48 hours.
• Age-attestation record — kept for as long as your account exists, and as required by law.

We may keep information longer where required to comply with a legal obligation, resolve disputes, enforce our agreements, or protect the Service, and we may keep de-identified or aggregated data (which cannot identify you) indefinitely.

11. Security

We use technical and organizational measures designed to protect your information, including encryption in transit (TLS), encryption of stored data by our hosting provider, hashed passwords, row-level access controls in our database so that users can only read what they are allowed to see, signed short-lived upload links for images, and restricted internal access to production data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a breach that affects your personal information, we will notify you and the relevant authorities as required by law. You can help by using a strong, unique password and by telling us promptly at hello@floorside.co if you suspect your account has been accessed without permission.

12. International transfers

Floorside is operated from the United States and your information is stored in the United States (Supabase on AWS, East US (Ohio) region). Our service providers may process information in the United States and other countries whose laws may differ from those of your country. Where we transfer information from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum), adequacy decisions, or certification under the EU-U.S. Data Privacy Framework where a provider participates. You can request a copy of the safeguards we rely on by contacting us.

13. Automated decision-making

We use automated systems in a few places:

• Image moderation. Images in posts and stories are scanned automatically shortly after posting. Anything classified as unsafe is hidden from everyone, including you, pending review, and deleted after 30 days unless it is restored. Profile photos are scanned the same way: your new photo shows right away, and if it is flagged it is replaced with your default emoji avatar and deleted after 30 days unless it is restored. If a post disappears or your profile photo changes back to an emoji after you upload it, it may have been flagged; contact us and a person will review it.
• Text filter. When you save a post, comment, review, or profile field (name, bio, location, username), the text is checked against a short fixed list of slurs. A match is refused on the spot with a message telling you why, and the text is not stored. Nothing else about the text is analyzed and no record of the attempt is kept.
• Rate limits and abuse detection. Automated rules may temporarily restrict actions (for example posting or signing in) when activity looks automated or abusive.
• Feed order. The feed is ranked automatically, using only the signals listed in Section 2.2: engagement relative to views, recency, a photo, the size of a winning result, whether you follow the author, and whether you have already seen the post. There is no profiling beyond that, nothing is inferred about you from it, and the “Following only” filter is always newest first.

None of these produce legal or similarly significant effects about you on their own; enforcement actions that materially affect your account are reviewed by a person, and you can appeal any enforcement decision by emailing hello@floorside.co.

14. Children

Floorside is intended only for adults. You must be at least 18 years old (or older where the law of your location requires a higher age to use a service about gambling) to create an account, and we ask you to confirm this when you first open the app. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it and close the account. If you believe a minor has provided us information, contact hello@floorside.co.

15. Third-party links and services

The Service includes links and hand-offs to services we do not control, such as Google Maps directions or a help resource, your photo library, and the Apple App Store or Google Play. Using those services is governed by their own terms and privacy policies. Opening directions to a casino hands the venue’s address — never your location — to Google Maps (the Google Maps app if installed, otherwise google.com in your browser), which may then use your location under its own policy.

16. Cookies and similar technologies

The mobile apps do not use cookies. The web version uses browser local storage to keep you signed in, remember preferences, and cache content; this is strictly necessary and is not used for advertising or cross-site tracking. We do not respond to browser “Do Not Track” signals because there is no tracking to turn off. Because we do not sell or share personal information, a Global Privacy Control signal requires no action from us.

17. Data attributions

• Casino directory: © OpenStreetMap contributors, licensed under the Open Database License (ODbL) — openstreetmap.org/copyright.
• City names: GeoNames (geonames.org), CC BY 4.0 — creativecommons.org/licenses/by/4.0.
• Map data on Android © Google; on iOS Apple Maps; on the web OpenStreetMap / CARTO.

18. Changes to this policy

We may update this policy from time to time. When we do, we will change the effective date at the top. If a change materially reduces your rights or changes how we use information you have already given us, we will post the updated policy in the app with a new effective date and, where the law requires it, ask for your consent. Your continued use of the Service after the effective date means you accept the updated policy.

19. Contact us

Questions, requests, or complaints about privacy:
Email: hello@floorside.co
Mail: Floorside LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702