The short version. The Simulator runs entirely in your browser. Your bankroll, your hands and your settings are stored on your own device and are never sent anywhere. This site has no accounts and no login. What we do collect is ordinary website analytics, and only with your consent where the law requires it.
1. Who we are
This site is published by Keith Adler, an individual, as the companion to the book Win at 3 Card Poker. For anything in this policy, contact contact@winat3card.com.
Where the UK GDPR or EU GDPR applies, Keith Adler is the data controller.
Contact for anything in this policy, including every data-protection request: contact@winat3card.com. Requests are answered by the author personally.
No representative has been appointed under Article 27 of the EU or UK GDPR. Article 27 applies to controllers not established in the EU or UK who target people there or monitor their behaviour. This site sells nothing, is not directed at the EU or UK, and processes only anonymised analytics from visitors who have consented, so we take the view that Article 27 is not engaged. If that changes, a representative will be appointed and named here.
2. What is stored on your own device
The Simulator keeps its state in your browser's local storage. That includes your chip balance, cash, any marker, your session and lifetime hand counts, your table, and your settings for sound, music, effects and the advisor.
This never leaves your device. It is not transmitted to us, it is not a cookie, and we cannot read it. Clearing your browser data deletes it, and RESET in The Simulator's settings clears it deliberately.
2a. Notice at collection
Required by the California Consumer Privacy Act as amended by the CPRA. This is everything.
| Category | What, exactly | Source | Why | Disclosed to | Kept for |
|---|---|---|---|---|---|
| Identifiers | IP address, abbreviated for analytics | Your browser, automatically | Security, keeping the site up, and counting visits if you consent | Our hosting provider; Google Analytics if you consent | Logs: up to 30 days. Analytics: 14 months. |
| Internet activity | Pages viewed, referring page, approximate country, browser and device type | Your browser, if you consent to analytics | Understanding which pages are read | Google Analytics | 14 months |
| Communications | Whatever you put in an email to us | You, if you write to us | Answering you | Nobody, beyond our email provider | Up to 24 months from the last message |
We do not collect any other category - no name unless you put one in an email, no postal address, no payment details, no account, no biometric, geolocation, health, or precise location data, and nothing about your finances. We do not sell or share personal information, and we do not use it for profiling or automated decision-making.
3. What we collect
Analytics. We use Google Analytics to understand which pages people read and roughly where visitors come from. It sets cookies and processes an abbreviated version of your IP address. We have IP anonymisation enabled and we have not enabled advertising features or demographic reporting.
Advertising. If The Simulator ever attracts enough traffic to carry advertising, this page will say so before any advertising script runs, and advertising cookies will be set only for visitors who consent to them. Nothing is served today.
Server logs. Our host records requests, including IP address, in the ordinary way, for security and to keep the site up.
We do not collect names, payment details or any account information. There is nowhere on this site to create an account or enter payment details, and no form of any kind.
If you email us. Four addresses are published on this site - contact@, privacy@, press@ and the accessibility address. If you write to one of them we hold what you sent: your email address, your name if you signed it, and whatever is in the message. The lawful basis is our legitimate interest in answering you (Art. 6(1)(f)). We do not add you to any mailing list, we do not market to you, and we do not pass it to anybody. Correspondence is kept for up to 24 months from the last message so we can follow up on a query or a correction, and then deleted. Ask us to delete it sooner and we will.
4. Why we are allowed to do that
Under the GDPR we rely on:
- Consent (Art. 6(1)(a)) for analytics and any future advertising cookies. You can withdraw it at any time from the cookie settings link in the footer, and withdrawing it is as easy as giving it.
- Legitimate interests (Art. 6(1)(f)) for server logs and security - keeping a website available is a legitimate interest that does not override your rights.
Analytics and advertising cookies are not set at all unless and until you accept them. If you decline, the site works exactly the same.
5. Who else sees it
Google Ireland Limited / Google LLC, as our analytics provider and processor. Our hosting provider, as a processor. Nobody else. We do not sell personal information and we have never shared it for cross-context behavioural advertising.
Analytics data may be processed in the United States. Where that happens it is covered by Google's Standard Contractual Clauses and its certification under the EU-US Data Privacy Framework.
6. How long it is kept
Analytics data is retained for 14 months and then deleted automatically. Server logs are kept for up to 30 days. Anything in your browser's local storage is kept until you clear it.
7. Your rights in the EU and UK
You have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time. To exercise any of them, email contact@winat3card.com - we will respond within one month.
You also have the right to complain to your supervisory authority: in the UK the Information Commissioner's Office, and in the EU your national data protection authority.
8. Your rights in California
Under the CCPA as amended by the CPRA you have the right to know what is collected, to delete it, to correct it, to opt out of sale or sharing, and not to be discriminated against for asking.
We do not sell or share personal information as those terms are defined by the CPRA, and we do not use it for cross-context behavioural advertising. See Do Not Sell or Share.
Other US states with comparable laws - Colorado, Connecticut, Virginia, Utah and others - are handled the same way. Where a state recognises the Global Privacy Control signal, we honour it.
9. Children
This site is about a casino game and is intended for adults. It is not directed at children and we do not knowingly collect personal information from any child. The applicable standard differs by jurisdiction, so all three apply here:
- United States - under 13. Under COPPA we do not knowingly collect personal information from a child under 13.
- EU and UK - under 16. Consent to information-society services cannot be given by a child under 16 (some member states set this as low as 13; we apply 16 throughout).
- California - 13 to 16. California requires opt-in consent before selling or sharing the personal information of anyone aged 13 to 16. We never sell or share personal information at any age, so this does not arise - but the standard is stated so it is clear we have not overlooked it.
If you believe a child has provided information, email contact@winat3card.com and it will be deleted.
10. Security
The site is served over HTTPS. Since we hold no accounts, no payment details and no personal records, there is very little to lose - which is deliberate.
11. Changes
If this policy changes materially - in particular if advertising is introduced - the date at the top will change and the consent banner will ask again rather than assuming your previous answer still applies.
12. Contact
contact@winat3card.com for anything at all, including anything in this policy. Advance copies, interviews and permissions go to press@winat3card.com.
What changed in this version
25 July 2026 - added a CPRA notice-at-collection table covering every category, source, purpose, recipient and retention period; added what happens if you email us, on what basis and for how long; added a postal address for the controller (outstanding) and a note on why no Article 27 representative is appointed; aligned the children's standard to state COPPA under 13, EU and UK under 16, and the California 13-to-16 opt-in rule; and removed an unverified trademark registrant.