Truth GTO is operated by KUO ("we"). This policy explains what personal data we collect, why, who we share it with, how long we keep it, and your rights. Contact: support@truthgto.com.
2. Data we collect
Account data: email, nickname (optional), a hash of your password (we cannot see your password); if you sign in with Google, the Google account identifier, email and name. The terms version and time you accepted at sign-up.
Content: the solves you configure (board, ranges, bet sizes), your library list and the results (stored on our server; results for identical settings are shared across users, but only owners see them in their library).
Usage and billing: time, type and funding source of each new solve and AI question, AI token counts; points balance and changes; subscription status and period; payment-provider customer/order IDs and amounts. No card numbers (handled by Lemon Squeezy).
AI questions: your question and the node's strategy data are sent to the AI provider to generate an answer; our server logs only counts and token usage and does not store the text of questions or answers.
Technical data: IP address, browser information, requested URLs and times (server and reverse-proxy access logs); IP is also used for sign-in/sign-up rate limiting.
Cookies: one strictly necessary sign-in cookie ("session", HttpOnly, up to 30 days). No advertising or analytics cookies.
3. Purposes and legal bases
Providing and maintaining the Service, authenticating you, computing quotas and billing, processing payments and refunds (contract);
preventing abuse, security and debugging (legitimate interests);
complying with law and handling disputes;
important account notices (e.g. terms changes, payment problems). We do not currently send marketing email.
4. Who we share data with (processors)
Hetzner Online GmbH (hosting; server in Helsinki, Finland): database, solve cache and logs.
Cloudflare, Inc. (domain and DNS, possibly proxy and protection): sees connecting IPs and requests.
Google LLC: if you sign in with Google it authenticates you and provides email/name; web fonts are loaded from Google Fonts, so your browser requests them from Google (which may receive your IP).
Lemon Squeezy, LLC (payments, Merchant of Record): processes payments, invoices, taxes and refunds and receives your payment details and email.
Anthropic, PBC (AI assistant): receives your AI question and node data to generate answers, under its own retention and usage policies.
We may disclose data where required by law or to protect rights and safety. We do not sell personal data.
5. International transfers
Our server is in the EU (Finland); the providers above operate in the US, EU and elsewhere. By using the Service you understand that data is processed outside your country; each provider applies its own safeguards.
6. Retention
Account and billing records: kept while your account exists; after a deletion request we delete or anonymise within 30 days, except billing records we must keep by law.
Backups: daily, kept up to 30 days, then deleted automatically; deletions fully take effect once backups rotate.
Access logs: kept for weeks to months according to rotation settings.
Shared solve cache: person-independent results may be kept until nobody owns them and then removed by cache rotation.
7. Your rights
Under Taiwan's Personal Data Protection Act (and the GDPR where it applies) you may request access, copies, correction, restriction or deletion of your personal data and withdraw consent at any time. Email support@truthgto.com; we reply within a reasonable time (normally 30 days) and may ask you to verify from your registered email. You may also complain to the supervisory authority. There is no self-service account deletion yet — please request it by email.
8. Security
Passwords are stored as irreversible hashes, connections use HTTPS, admin access is restricted and the database is backed up daily. No system is perfectly secure; if a breach affects you we will notify you as required by law.
9. Children
The Service is not for people under 18 and we do not knowingly collect their data; if we learn of it we delete it.
10. Changes
We may update this policy; material changes will be announced on the site or by email. The current version and effective date are at the top of this page.