In short
Chip Rank organises poker championships among friends: who played, who paid what, who won and how the ranking stands. To do that we keep your account details and your history inside the rooms you take part in.
It is a note-keeping app — it does for the group what a spreadsheet would do. There is no game inside it, there is no betting and no money passes through here: the amounts are numbers on record, and people settle up between themselves, outside the app.
We do not sell your data, we show no advertising and we use no tracking or ad-profiling tools.
1.Who is responsible for your data
Chip Rank is published under the name Cury App Labs, a trading name used by Ulisses Jamil Cury Neto for his personal projects.
Cury App Labs is not a legal entity. The person answerable for the processing of the personal data described here — the “controller”, in the language of Brazil's General Data Protection Law (LGPD, Law 13.709/2018) — is Ulisses Jamil Cury Neto, a natural person, with a postal address at Av. Bady Bassit, 4920 — São José do Rio Preto/SP — postcode 15025-000, Brazil.
Contact for anything in this policy, including the requests set out in section 10: curyapplabs@gmail.com.
2.What data we collect
2.1 Account details
First and last name, nickname, username (@), email, password (stored hashed by the authentication service and never visible to us), phone, date of birth, city/state and profile photo. Phone, date of birth, city/state and photo are optional.
PIX key (optional). In your profile you may register a PIX key (PIX is Brazil's instant payment system) so that you can receive prize money from the room. That is its only purpose. If you fill it in, the administrator and the treasurer of your rooms can see it, because they are the ones who pay the winners. If you leave it blank, nothing is stored. Note that a PIX key may be your CPF, your phone number or your email — you choose which, and whatever you type is stored as you typed it.
If you sign in with Apple or Google, all we receive from them is the account identifier and the email address — never your password.
2.2 Activity inside rooms
For each room you belong to: attendance confirmed for rounds, finishing position, points, rebuys, add-ons, entry amounts, amounts owed and paid, prizes, penalties and notes entered by the room administrator. These records make up the room's ranking and its accounts.
The amounts are notes: the app records what the group agreed, who has already paid and what each person owes. It does not charge, collect or transfer anything.
2.3 Guests
Whoever invites someone to a round enters that guest's name. The name is visible to the room that invited them and forms part of that round's records.
2.4 Dealer registration (optional)
Only for people who choose to register as a dealer, and always with your explicit consent on screen: full name, CPF (the Brazilian taxpayer ID), a photo of your face, a photo of an official ID document, a selfie holding that document, phone, and the city and state where you work. These confirm that you are who you say you are and prevent false registrations.
Of that data, only name, phone and working city are visible to room owners and in the dealer directory. CPF, ID document and selfie are restricted to verification and never appear to other users. The selfie is deleted as soon as the registration is approved.
If a registration is refused, you may ask for its deletion through the contact in section 1, and we carry it out. If a registration is banned for fraud, we keep the CPF so that the ban cannot be sidestepped with a fresh registration — that is its only purpose, and the legal basis is the anti-fraud legitimate interest set out in section 3.
2.5 Device data
To send notifications we store the device token issued by Apple or Google and the platform (iOS or Android) and the language you chose, so the notification arrives in the right one. It is a device identifier used for delivering notifications — it reads nothing on your phone, and it disappears when you sign out or uninstall the app.
The app also stores the time you were last active, so it can show other members of the room who is online. It is a timestamp, not a browsing history: we do not record which screens you opened or for how long.
2.6 Audit records
Actions that touch amounts, results or how the room is run (recording a rebuy, marking a payment, editing a closed round, applying a penalty, changing the timer, handing operation to someone else, promoting or removing a member, transferring the room) are logged with the name, the email and the date of whoever did it. This is what lets the room administrator work out afterwards what happened and who to ask. When someone deletes their account, that record loses the name and the email and points to an anonymous identifier instead (see section 6).
2.7 What we do NOT collect
- Location. The city shown in your profile or in a dealer registration is typed by you. The app never turns on GPS and never asks for the system's location permission.
- Calendar, contacts, photo library and files. Only the image you choose to upload reaches us.
- Cards, bank accounts and transactions. We store no card number and no banking details, and no payment passes through Chip Rank. There are two PIX keys in the app (PIX is Brazil's instant payment system) and both are only text displayed on screen for someone to copy into their own bank: the room's key, entered by its owner, which you use to pay the room; and your personal key, from section 2.1, which the room uses to pay you. The app does not read, initiate or verify any transfer. For paid modules, billing goes through the App Store or Google Play, who likewise do not pass your card details on to us.
- Advertising and tracking. No ad network, no behavioural analytics tool, no advertising profile.
2.8 Camera
The camera is used at three moments, always started by you: reading the QR code to pair the TV screen — that image is processed on the device itself and is neither uploaded nor stored —, photographing the ID document for dealer registration, and taking the selfie holding that document. Changing your profile photo or the room's logo opens the camera or the gallery, as you prefer. You may refuse the permission: pairing also works by typing the code.
2.9 Messages you send us
When you use the suggestions and problems box, or request a paid module, we store the text you wrote together with your name, your email and the name of the room you were in. It lets us reply and understand the request. If you delete your account, those messages stop pointing to you.
2.10 Subscriptions
If you subscribe to one of the paid plans, the charge is made by the App Store or by Google Play. We neither see nor store card numbers, bank accounts or billing addresses — the store passes us none of that.
What the store does return to us, and what we keep, is the receipt: the transaction identifier, the identifier of the plan subscribed to, which of the two stores it was, and the next renewal date. Alongside it we keep which room is using the subscription and since when. That is how the app knows what to unlock, and how we can help you with a billing question.
Cancelling, asking for a refund or switching plans happens in the store itself, through your Apple or Google account — we have no access to those controls.
3.What we use it for, and on what legal basis
| Purpose | Data | Legal basis (LGPD, art. 7) |
|---|---|---|
| Creating and maintaining your account | Account details (2.1) | Performance of a contract (item V) |
| Running rounds, ranking and accounts | Activity (2.2, 2.3) | Performance of a contract (item V) |
| Notifying you about rounds, invites and confirmations | Device token (2.5) | Performance of a contract (item V) |
| Verifying a dealer's identity | Dealer registration (2.4) | Consent (item I) |
| Preventing fraud and duplicate registrations | CPF, email, records (2.4, 2.6) | Legitimate interest (item IX) |
| Investigating disputes over amounts and results | Audit records (2.6) | Legitimate interest (item IX) |
| Paying prize money to winners | Personal PIX key (2.1) | Performance of a contract (item V) |
| Answering suggestions and module requests | Messages (2.9) | Performance of a contract (item V) |
| Keeping your subscription and supporting you on billing | Store receipt (2.10) | Performance of a contract (item V) |
| Handling access, correction and deletion requests | Account details and contact | Legal obligation (item II) |
The consent given for dealer registration can be withdrawn at any time, through the contact in section 1 — in that case the dealer registration is closed and the verification data is deleted.
4.Who else sees your data
4.1 Other people inside the app
- Members of the same room see your name (or @username), your profile photo and your part in the rounds: attendance, placings, points and ranking.
- Room administrators, supervisors and treasurers also see the amounts owed and paid and the penalties in that room.
- Administrators and treasurers can open each member's card, which shows the full name, the @username, the nickname, the email, the phone and the PIX key if there is one. That is what they need in order to collect the entry fee and pay the winners.
- The dealer directory can be searched by anyone with an account in the app, and shows, for anyone who is a verified dealer, the name, the phone, the working city and that city's approximate coordinates, which are used to order the list by proximity.
Each room's history and money do not cross between rooms: someone who is not in that room does not see its rounds, its amounts or its penalties.
Account details — name, @username, photo, contact — work differently: they are visible to other people with an account in the app, because that is how an administrator finds you in order to invite you and how the app shows who is online. Do not treat them as private. If you would rather something did not appear, the optional fields in section 2.1 can be left blank.
4.2 Companies that provide services to us
- Supabase — database, authentication and file storage.
- Vercel — hosting for the web app.
- Apple (APNs) and Google (Firebase Cloud Messaging) — notification delivery. They receive the device token and the text of the notification.
These companies process the data only to provide their service to us, under contract. There is no sale, rental or transfer of data to third parties.
4.3 Lookups against public services
Two screens in the app query open services on the internet. Neither one carries your name, your email or any identifier of your account — but, as with any web request, your device's IP address reaches the service being queried:
- IBGE (Brazil's statistics institute) — to list the municipalities of a state. This happens whenever you pick a state: in your profile, in dealer registration and in the dealer directory search. It receives only the state code you picked.
- OpenStreetMap (Nominatim) — to turn the city you typed into approximate coordinates of its centre, so the directory can order dealers by proximity. It receives the city and the state. That is the centre of the municipality, not your position: the app does not use the device's GPS. In a dealer registration those coordinates are stored alongside the registration, so the list does not have to query the service again on every search.
The TV pairing QR code and the room access QR code are drawn inside the app. No external service receives your room's code.
4.4 International transfer
Those providers' servers may sit outside Brazil, which amounts to an international transfer of data under art. 33 of the LGPD. We choose providers who contractually commit to protection standards equivalent to those the Brazilian law requires.
4.5 Authorities
We may hand over data where there is a court order or a lawful request from a competent authority, limited to what is asked for.
5.How long we keep it
- Account and game history: for as long as your account exists.
- Selfie with the document: deleted as soon as the dealer registration is approved.
- CPF and ID document: while the dealer registration is active. The CPF of a registration banned for fraud is kept solely to prevent a fresh registration (see section 2.4).
- Device token: gone when you sign out or uninstall the app. Turning notifications off in the phone's settings stops them appearing, but does not delete the token — sign out for that.
- Audit records: stay with the room, already stripped of anything identifying whoever deleted their account (see section 6).
- Backups: the server keeps periodic copies of the database, and a room may keep copies of its own history. A deletion erases your data from inside the room's copies too. Server copies taken before the deletion still contain your data until they are replaced by newer ones.
6.Deleting your account
You can delete your account yourself, without having to talk to anyone, straight from the app: Profile → My account → Delete my account. We ask you to type your @username — or the word APAGAR, if you have not chosen a @username yet — and, if your account has a password, the password as well. That is a confirmation, so that nobody deletes your account with a stray tap. People who sign in with Apple or Google have no password in Chip Rank, so in that case the app asks only for the @username.
Once you confirm, we immediately erase: your login, your email, your phone, your date of birth, your profile photo, your dealer data (including CPF, ID document and selfie), your devices' tokens, your membership of the rooms and your attendance confirmations.
The history of the rounds you have played stays with the rooms, because it is the collective result of that championship and of other people's accounts — erasing it would change the ranking and the settling-up of everyone who remains. On the deletion screen you choose how that looks:
- The box starts unticked: by default your name is replaced by an anonymous identifier. The placings and amounts stay there, but they stop pointing to you.
- If you tick the box, you authorise your name to remain in the old results, so the room knows who played.
7.Security
Database access is controlled row by row (RLS), on the server: a room's history, amounts and penalties are returned only to people who belong to that room. The account details in section 2.1 are readable by other people with an account in the app, as explained in section 4.1. Traffic is always encrypted (HTTPS). Passwords are stored hashed by the authentication service and are not accessible even to us. A dealer's ID document and selfie can be read only by that dealer and by verification, never by another user, and there is no public link to them.
No system is completely immune. If an incident happens that could pose a relevant risk to you, we will notify you and Brazil's National Data Protection Authority, as art. 48 of the LGPD requires.
8.Minimum age
The minimum age for a Chip Rank account is 18. The app is published with an adult rating in both stores.
The reason is the context, not the content. What the summary says still holds — there is no game here, no betting and no money passing through the app —, but Chip Rank organises poker tournaments and records the amounts players owe one another, and that is an adult matter. Add to it the LGPD rule on children's and adolescents' data (art. 14), which requires verifiable consent from a parent or guardian: Chip Rank has no such mechanism, and so it does not accept minors.
We do not ask for proof of age — what counts is your declaration when you create the account. The date of birth in section 2.1 is optional and is not used to check your age.
If we identify an account belonging to someone under 18, it will be deleted. If you are a guardian and believe that has happened, write to the contact in section 1 — we will delete it and confirm.
9.Cookies
We use only the browser's and the app's local storage, to keep you signed in and to remember screen preferences (the last room opened, the font size, the chosen mode). There are no advertising cookies and no cross-site tracking cookies.
10.Your rights
The LGPD gives you the right, at any time and free of charge, to:
- confirm whether we process data about you, and access it;
- correct incomplete, inaccurate or out-of-date data;
- request anonymisation, blocking or deletion of unnecessary or excessive data;
- request portability of your data;
- know who we share your data with;
- withdraw the consent given during dealer registration;
- object to processing carried out on the basis of legitimate interest.
Most of this you handle yourself in the app — editing your profile corrects the data, and section 6 deletes the account. For the rest, write to curyapplabs@gmail.com: we reply within 15 days.
11.Changes to this policy
If we change anything material, we update the date at the top of this page and give notice inside the app before the change takes effect. The version published here is always the one that applies.