← Botflop
Privacy Policy
Last updated: November 2, 2026
Botflop ("we", "us"), at botflop.com, is a free, play-money game where you build poker bots by describing them and watch
them battle. This policy explains what data we collect, why, who else sees it, and the choices you have.
Botflop is for people aged 18 or older.
What we collect
- Account details: your email address, used to sign you in. If you choose "Continue with Google",
we receive your Google account's email address, name and profile identifier (the basic
openid,
email and profile permissions only). We never see your Google password and we
don't access your Gmail, Drive, contacts or anything else in your Google account. See
"Google user data" below.
- Your content: your bots, the descriptions you write for them, saved games and battle results.
- Game records: your token history and PvP rank points.
- Anti-abuse signals: a hashed (scrambled, not reversible) form of your IP address and a random
device identifier. We use them only to stop people farming free tokens with many accounts.
- Technical data: standard server and security logs (such as IP address, browser type and
request time), kept briefly to run and protect the service.
How we use it
- To sign you in and keep your account secure.
- To build and run your bots, run battles and show leaderboards.
- To prevent fraud, abuse and multiple-account farming.
- To send sign-in emails and essential service messages. We don't send marketing email.
- To fix problems and improve the game.
We don't sell your data, we don't share it for advertising, and we don't use advertising trackers.
Who else handles your data
| Service | What it receives | Why |
|---|
| Anthropic | The bot description you type into the Bot Lab (not your email) | AI that builds your bot |
| Resend | Your email address and the sign-in email | Sending sign-in emails |
| Google | The sign-in request, if you use Google sign-in. Google sends us your email, name and profile details (see Google user data) | Authentication |
| Cloudflare | Your IP address and request data, as our proxy | Security, delivery and cookie-free analytics |
| Amazon Web Services (AWS) | All stored account and game data | Hosting and database |
These providers process data on our behalf under their own privacy terms. We may also disclose
information if the law requires it, or to protect the service and its users.
Google user data
This section applies if you choose "Continue with Google" (Google Sign-In). It describes exactly how
Botflop accesses, uses, stores, shares and protects information received from your Google Account.
- What we access: through the
openid, email and profile
scopes only, we receive your Google account's email address (and whether Google has verified it),
your name, your profile picture URL and your unique Google account identifier. We do not
request any other Google user data, and we do not use any Google Workspace APIs (such as Gmail, Drive,
Calendar or Contacts).
- What we store: your email address, your name (up to 80 characters) and your Google account
identifier, so we can recognise you the next time you sign in. We do not store your profile picture. We
never see or store your Google password.
- How we use it: only to create your Botflop account, sign you in and operate your account. This is
the only purpose. Your Google name is not shown to other players; leaderboards show only a public name you
choose yourself.
- Who we share it with: we do not sell, rent or disclose Google user data to third parties.
It is processed only by the infrastructure that runs Botflop: Amazon Web Services (hosting and database) and Cloudflare
(which carries traffic to our servers). They process it on our behalf and may not use it for their own
purposes. We may also disclose it if required by law. We do not send Google user data to our AI provider,
and we do not use it for emails.
- What we never do: we do not use Google user data for targeted, personalised, retargeted or
interest-based advertising or any advertisements; sell it to data brokers or information resellers; use it
to determine creditworthiness or for lending; or use it to build databases or for any purpose other than
providing the sign-in and account features described here. We do not use Google user data, or any Google
APIs or Google Workspace APIs, to develop, improve or train any generalised or non-personalised AI or
machine-learning model. Human access to it is limited to the small team that runs Botflop and only where
needed for support, security or abuse investigation, or where the law requires it.
- How we protect it: all connections use HTTPS (encrypted in transit). Data is kept in an
access-controlled database, and the credentials that guard it are held as protected server secrets, not in
our code. Sessions are stored as hashes and expire after 30 days.
- Retention and deletion: we keep it only while your account is open. If you delete your account
(Account › Delete account), we delete your email address, name and Google account identifier
straight away; copies in routine backups are overwritten on a rolling schedule. You can also email
[email protected] to request deletion, and you can revoke Botflop's
access to your Google account at any time at
myaccount.google.com/permissions.
Botflop's use and transfer of information received from Google APIs adheres to the
Google API Services User Data
Policy, including the Limited Use requirements.
Cookies
We use two small, strictly necessary cookies: one keeps you signed in and the other protects your
account from forged requests. Because they're essential, there is no cookie banner. Our analytics, if
enabled, don't use cookies.
How long we keep it
We keep your data while your account is open. If you delete your account, we remove your email, bots,
saved games and sessions. We keep token and battle records without your name or email, because they're
needed to keep the game's records correct. Backups are overwritten on a rolling schedule.
Your choices and rights
- Delete your account any time: Account › Delete account.
- Ask us for a copy of your data, or to correct or erase it, by emailing us. Depending on where you
live (for example the EU, UK or California) you may have additional legal rights, and we'll honour them.
- Revoke Botflop's access to your Google account any time at
myaccount.google.com/permissions.
Security
All traffic uses HTTPS. Sessions are stored as hashes and expire after 30 days. No system is perfectly
secure, but we work to protect your data and will tell you if a breach affects you.
Children
Botflop isn't for anyone under 18, and we don't knowingly collect their data. If you think a child has
given us information, email us and we'll delete it.
Changes
We keep this policy current. If we change this policy, or change how Botflop uses Google user data, we'll
update the date above and tell you in the app before the change takes effect.
Contact
[email protected] · Botflop, https://botflop.com
See also our Terms of Service. Botflop is not affiliated with any poker site, casino or AI company. Play money only.