Privacy policy: what we keep, and what we don’t.

This website

This site sets no cookies and has no ad trackers. We count visits with Vercel Web Analytics, which records the page you looked at, the site that sent you, and your country, browser, operating system and device type. It doesn’t use cookies and doesn’t ask for your name or email. It also counts clicks on a few buttons (Start free and the buttons that open the apps, Buy, Talk to us, Floor sign-in and our email address; on our contact card page, Save contact, Call, Email and the website link), and, if the link that brought you carries a campaign tag, which campaign or source tag it was. These counts never include your name or email, and the site may keep a note in your open browser tab that your visit was already counted. If you arrive from a link with a tag, for example from a newsletter or a partner, the site keeps the tag for that visit only, in your browser’s session storage, and closing the tab clears it. If you buy, the tag is sent with your purchase to Stripe so we know which link led to the sale. That uses no cookie and no tracking across sites, and when a link has no tag, nothing is kept. If you use the contact form, what you type there (your name, email, room or school, how many dealers, and your message) is saved in our database so we can reply, and Slack tells us a message arrived, with only your name, room and how many dealers. We keep it, with any notes we add, until we delete it. Ask and we’ll delete it. If you fill in our pilot setup form, the company name, owner and contact names, emails and phone, dashboard admin names and emails, and your answers about your dealers and games are saved in our database so we can set up your room, and Slack tells us one arrived with only the company name. We keep it until we delete it. Ask and we’ll delete it. If you sign up for the launch email, we keep your email, the apps you picked and where you signed up (the page or link tag) until you unsubscribe. Every email has a one-click unsubscribe link, and we send them from Google Workspace. Signing up sets no cookies and adds no trackers.

Practicing in the apps

You don’t need an account to practice. Your practice, settings and progress stay on your device. We don’t collect your location or contacts.

If you join a room or school

If your card room or school gives you a code and you sign in, we keep:

• your email address, to sign you in with a one-time code;
• a display name or employee ID, if you or your room add one;
• your graded exercises and gauntlets: which ones, when, how many you got right and how long they took.

Your room or school can see these, and only its admins and instructors. Your ungraded practice is never sent. We don’t collect your date of birth, phone number or address.

A room admin can also add you to the roster before you have ever signed in, with your name, employee ID and email. We then send that address an invitation email, and your room’s admin can resend it. If you decline, the roster row keeps your name and email until an admin removes it or your data is erased. You can remove a waiting invitation yourself in the app, and it is deleted outright. Your room’s admins are told that someone with your role removed one, without a name, for 30 days.

Result codes

After a proctored gauntlet you can ask for a result code. It is your choice, and nothing is shared until you share the code. Anyone who has the code can look it up and will see your display name, the name of the room that proctored it, the game, the score, the date and how you did on each part. They won’t see your email, employee ID or any other result. A code stops working after a year, or sooner if a newer proctored result replaces it or the code is revoked. We count how often a code is looked up. We don’t keep a record of who looked.

Send feedback

Anyone with an account can use Send feedback in the apps, whether or not they are in a room. We keep what you write, an optional screenshot you attach, the app version and device type, and the drill, level and seed if you sent it from a results screen. Only Riffle and Box staff can read it, never your room. A daily summary email goes to staff. It is deleted when you delete your account, and screenshots with it. A daily summary email to staff, and anything staff copied into our task tracker, is not recalled.

Live demos

If a room shares a live demo link with you, you can type a first name (or leave it blank) and try a few questions without an account. We keep the first name and your score for 30 days, and the room that made the link can see them. Then we delete them.

The speed study

The craps app can offer a short, anonymous speed test to working dealers. We keep a random id made on your device, your answers (years dealing, games, kind of venue, how fast you rate yourself), your timings and device type. We keep no name, email, room or IP address, so we can’t tell which result is yours and can’t delete one on request. We use the results to set speed goals.

Purchases

When you buy a track or a bundle, Link, LLC sells it to you, using Stripe. Link and Stripe handle the payment, sales tax and your receipt, and Stripe collects your card details on its own page; we never see or keep them. We keep your email, what you bought, and Stripe’s payment ids, so your purchase stays unlocked and we can refund it. Room and school invoices are different: Riffle & Box sends those. To ask for a refund, write to us; the refund itself is paid back by Link. If you delete your account, we keep the purchase record for refunds and accounting.

Who handles data for us

• Supabase hosts the accounts database, contact form messages, pilot setup answers, feedback and its screenshots (in the United States).
• Postmark sends sign-in emails, room invitation emails and the daily feedback summary to our staff.
• Slack tells us when a contact form message arrives (your name, room and how many dealers, nothing else) or a pilot setup form does (company name only).
• Vercel hosts this website and counts its visits.
• Link, LLC (the seller of record) and Stripe handle payment, tax and receipts for individual tracks and bundles, and Link pays refunds.

We don’t sell your data or share it for advertising.

Deleting your data

You can do this yourself in the app. Leaving a room and deleting your data from it is one action: it erases your results in that room. Deleting your Riffle and Box account is a separate one, allowed once you are in no room. It erases your sign-in account, results, roster rows that name your email, and any feedback and screenshots you sent. It asks you to sign in again first if your last sign-in was more than 10 minutes ago. You can also write to hello@riffleandbox.com or ask your room’s admin. If you wrote to us through the contact form, we also delete your messages, our notes on them and the Slack heads-up about them. Purchase records are kept for refunds and accounting.

Questions

Write to hello@riffleandbox.com or by mail to Riffle and Box LLC, 1800 Sutter St, Ste 500 PMB 8042, Concord, CA 94520.