Privacy policy

Who we are

This policy covers the website sixmax.app and the practice table on it, both operated by sixmax.app (“we”). Questions go to privacy@sixmax.app.

This website

This website has no analytics and no advertising. It sets cookies only if you sign in with GitHub (below). Our hosting provider, Cloudflare, processes standard request data (such as IP addresses) to deliver and protect the site, under its own privacy policy. If you email us, we use your message and address only to reply. We use AI tools, including Anthropic’s Claude, to help sort and answer email. We keep email for up to two years after it is sent or received, then delete it; to have yours deleted sooner, write to privacy@sixmax.app.

Signing in with GitHub

The practice table is open only to people we have invited. They sign in with their GitHub account. The front page and this policy work without signing in.

What we collect

When you sign in, GitHub tells us your public GitHub username, your numeric GitHub user id and the web address of your public profile picture. We ask GitHub for no permissions beyond your public profile.

What we don’t collect

We do not receive your email address, your password, or access to your repositories, organizations or any other GitHub data. GitHub gives us a temporary access token so that we can read your public profile once; we use it for that single request and do not store it.

Cookies

Signing in sets two cookies, both marked HttpOnly and Secure: a sign-in check cookie, which protects the sign-in against forgery and expires after 10 minutes or when sign-in finishes; and a session cookie holding your GitHub username, user id, profile picture address and an expiry time, signed so that it cannot be altered. It lasts 30 days. We use them only to recognize you and decide whether you have been invited. We use no tracking or advertising cookies.

Where it is kept and for how long

Your sign-in details are kept only in the session cookie in your browser; we don’t keep a record of the people who sign in. The list of invited people holds the GitHub username and user id of each person we have invited, for as long as they have access. The session ends after 30 days, when you sign out, or when you clear your cookies.

Requesting access

If you sign in but have not been invited, you can request access with a form. Nothing is stored unless you send it. When you do, we store your GitHub username, user id and profile picture address, the note you write (if any) and the date, so that we can decide on your request. We use AI tools, including Anthropic’s Claude, to help review requests. If we approve your request, your username and user id are added to the list of invited people. We delete a request 90 days after we decide on it, or 90 days after you last sent it if we haven’t answered. To have yours deleted sooner, write to privacy@sixmax.app.

Signing out

Use “Sign out” on the home page, or clear this site’s cookies in your browser. To remove the app from your GitHub account entirely, revoke “Sixmax” under Settings → Applications → Authorized OAuth Apps on GitHub. Your use of GitHub itself is covered by GitHub’s privacy statement.

The practice table

What our server keeps

The table runs on a server we operate, reached through Cloudflare. When you first open it, our server makes a random session code and keeps a file for it. After every change it saves in that file:

• your settings: hints, the guide, sandbox mode and any practice focus you chose;
• your progress: the number of hands played (and of sandbox hands), your play-chip result, the concept cards you have seen, and up to your 2,000 most recent decisions, each with your cards, the board, your position, the action you took, the recommended action, the EV you gave up, the reasons shown and the time;
• your 50 most recent finished hands, with every card, action and result, and the feedback you were shown;
• the hand in play, and when the session was created and last saved.

The file is keyed only by the session code. It holds no name, email address or GitHub username, and our sign-in service does not pass your GitHub details or your cookies to the table. Anyone who has your session code can open that session, so keep it to yourself.

How long we keep it

There is no automatic expiry yet: a session file is kept until it is deleted. “Start a fresh session” in Settings gives you a new session code but does not delete the old file.

Deleting it

The app has no delete button yet. To have your table data deleted, email privacy@sixmax.app with your session code (shown in Settings in the app), and we will delete that session’s file.

Logs

We have turned off request logging for the sign-in service on Cloudflare. Our table server writes one short line per request to its own log: the kind of request, the page or action name, the result code and how long it took. It does not log your IP address, your session code, or the content of what you send.

What stays in your browser

Your browser’s local storage on your device keeps your session code, so that the table can resume where you left off, and your choice of light or dark theme. To remove them, clear this site’s data in your browser; that does not delete the session file on our server (see above).

Sharing

We do not sell or rent your data. We share it only with the service providers that process it to run this website: Cloudflare, which hosts it, carries traffic to our server and stores the email we send and receive, the access requests and the list of invited people; GitHub, for signing in; and Anthropic, whose AI tools help us sort and answer email and review access requests.

Changes

If what we collect or how we use it changes, we will update this page and its effective date first.