Privacy

Privacy Policy

Effective October 18, 2026

This policy covers the PaintBrush desktop app, PaintBrush On the Go (the phone app), the website at paintbrushdb.com, shared-hand links and cloud backup. PaintBrush is run by PaintBrush (paintbrushdb.com), based in Gilbertsville, PA, United States ("we", "us"). Questions and requests: owner@paintbrushdb.com.

The short version

• Your hands stay on your PC. Your database lives on your computer, not on our servers. Only you can send hands out: as an encrypted cloud backup, or as one anonymised hand you share.
• Phone sync and cloud backup are end-to-end encrypted. We store them, and we can't read them.
• Claude requests go to Anthropic. When you ask Claude, your question and the data Claude reads to answer it are sent to Anthropic.
• Licences carry hashed screen names, never the names.
• No ads, no analytics, no tracking, no selling or sharing of your data.

What stays on your PC

Your hand database, the hand-history folders you point PaintBrush to, notes, tags, live sessions, Claude's saved reports, your settings (including your licence key and any Claude API key) and the app's log files. None of it is uploaded, except as this policy describes. We don't collect crash reports or usage analytics.

• To hide features that inform play while you're at the tables, PaintBrush looks at the list of programs running on your PC for known poker clients. That check never leaves your PC.
• The microphone button uses your computer's own voice typing (Windows voice typing). PaintBrush never receives the audio; Microsoft's privacy terms cover that feature.

What leaves your PC, and when

Licence checks

Free needs no licence. Paid plans check in with our licence server when activated and about twice a day while online.

• What the app sends: the licence key; a device ID, which is a one-way hash of your computer's own ID; the operating system and version (for example "Windows 11"); whether the database has hands; and a salted hash of each of your screen names that has hands in your database.
• The screen-name hashes: each one is made on your PC with PBKDF2 (100,000 rounds), salted with your licence key. The same name makes a different hash under a different licence, so we can't match you across licences, and the names themselves never leave your PC. They only show that each of a licence's computers belongs to the same player.
• What we keep: the licence key, plan, the end of the paid period, the email address from your purchase, your computers (device ID, operating system, first and last check-in), the screen-name hashes, and your Claude credit balance.
• The free licence for phone sync: our relay only accepts accounts tied to a licence, so that we can switch off abuse. When you turn on phone sync in PaintBrush Free, the app asks for a free licence for that computer by itself. It sends only the device ID and operating system. No email, no name. To limit sign-ups (5 per connection per day), we keep a short hash of your IP address for 24 hours.
• Paid features: when a paid licence is activated, the app downloads that plan's features from the same server, using its licence.

Claude (Pro and Artist)

• On the desktop: when you ask Claude something, the app sends Anthropic your question, the conversation so far, PaintBrush's instructions, and the results of the queries Claude runs on your database to answer you. Those results can include hand details, results, your notes and tags, and players' screen names, yours and opponents', as far as the question needs them. Your hand-history files and your whole database are never uploaded.
• Session reviews (Artist): the reviewed hands' cards, actions and solver figures, with you named "Hero".
• From the phone: the phone sends your question to our credits server, with the data it needs from the phone itself: your live sessions (dates, stakes, game, venue and location, buy-ins, cash-outs, costs, hours), the position and result of hands you noted (never their cards or your notes), and the online results by day your phone page holds. For the calendar it sends what the calendar holds and asks Claude to search the web. It goes over HTTPS, not through your PC or the relay; the phone uses a short-lived token your PC gets for it, never your licence key, and never talks to Anthropic directly. What comes back is a widget or a list of events, drawn on the phone.
• The route: with your PaintBrush licence, requests pass through our credits server, which forwards them to Anthropic. It doesn't store what you ask or what Claude answers. It keeps the licence, the time, the model, the token counts and the cost, to bill your allowance. With your own Claude API key, requests go straight from your PC to Anthropic, and we see nothing.
• Anthropic handles requests under its commercial terms and privacy policy. Under those terms, Anthropic doesn't use API requests to train its models.

Phone sync (PaintBrush On the Go)

Your phone and PC don't talk directly. They leave each other sealed messages on our relay server.

• The encryption: AES-256-GCM, with a key made on your PC. The key reaches your phone only through the QR code on your PC's screen. It is never sent to us.
• What is synced, sealed: live sessions (stakes, venue, the location you type, buy-ins, cash-outs, times, hands you note), live player notes, your phone page's layout and time zone. On Pro and Artist, also the results your phone page shows, Claude's charts made on the PC, and the short-lived token the phone asks Claude with.
• What never goes to the phone: your online hands, the notes and tags on online players, and solver output.
• What the relay can see: that an account exists (a random ID, tied to its licence's ID and plan), its devices (random IDs, the name you gave each, when added and last seen), how many sealed messages wait, their size and time, and which kinds of data an account holds. Not their contents.
• How long: your phone's edits are deleted once your PC takes them in. Your PC's latest copy replaces the last. The account stays until you delete it.
• Camera: used only to scan the pairing code. Nothing is stored or sent.
• Exchange rates: the phone asks our relay for currency rates by date and currency code, and the relay gets them from Frankfurter, which publishes the European Central Bank's rates. The desktop asks Frankfurter directly. Only dates and currency codes are sent.
• Updates (Android): Check for updates asks our server for the latest version.
• The honest limit: the web version of the phone app is served by our relay, so you trust us to serve unchanged code. The Android app's code comes from the installed build.

Cloud backup (Artist)

• The encryption: your PC makes a key for your database and seals it under your passphrase and your recovery key. Neither ever reaches us.
• What we hold: your database and files as encrypted chunks (your licence key and Claude API key are removed before upload), encrypted version lists, the sealed keys, your email (your sign-in name; not verified), a hash of a sign-in key derived from your passphrase (it can't decrypt anything), sizes, counts, times, and which browsers are signed in.
• The web version decrypts the copy inside your browser. The keys stay in that tab's memory, it locks after 30 minutes idle, and a session lasts 12 hours at most.
• How long: until you delete it. We keep the last 10 versions and every version from the last 7 days, and delete unused chunks after a day. After an Artist plan ends, we keep the copy for 90 days, then delete it, with notice.
• Where: on our servers' storage, in the United States.
• The honest limit: as with any encrypted web app, you trust us to serve an unchanged web page. The desktop app can check the page against the version it was built with.

Shared hands

• What a shared hand holds: the game, site, stakes, table size, stacks, actions, board, results in big blinds, your cards, opponents' cards only where shown, your theme's colours and, on Artist, the solve if you include it. Players are only "Hero" and "Villain". No screen names.
• Who sees it: anyone with the link. Links aren't listed, and search engines are told to stay out.
• What else we keep: the time it was shared, a view count and, for 30 days, a hash of your IP address, to limit abuse. The hash is keyed with a secret only our server holds, so it can't be turned back into your address.
• How long: until you take the link down in the app.

Feedback and the contact form

• Send feedback (PaintBrush menu) sends your message, a screenshot if you add one (redrawn as a plain image, with its metadata removed), your email if you give one, the screen you sent it from and your language, with the app's version, edition and plan.
• The contact form on our website sends your message, its topic, your email and your language.
• For both, we keep a keyed hash of your IP address for 30 days, to limit abuse.
• A screenshot of the PaintBrush window can show your hands, results and screen names. Check it before you send.
• How long: 12 months, or until you ask us to delete it.

Custom theme requests (Artist)

Your description, whether you chose Public or Private, your licence key and the email on your licence. If you chose Public, the description may be shown with the theme in the library. A public theme shows how many players wear it, as a count only.

Payments

Payments are processed by our payment provider, the merchant of record. It collects your name, email, billing address, payment details and tax information under its own privacy policy, which you see at checkout. We receive your email, the order and subscription IDs, the plan, its status and renewal dates, and your licence key. We never see your card details.

The website

No cookies, no analytics. Your browser remembers the language you pick. The website and shared-hand pages load everything, fonts included, from our own server: your browser asks no other site for anything.

Who else handles data

Our servers keep no request logs. Railway, which hosts them, keeps its own short request logs: the IP address, the time, the address requested, the browser's name and the result. They never hold what you sent. We can see them for up to 30 days.

We don't sell personal data, and we don't share it for advertising.

Why we use it (for the EU and UK)

Under the GDPR and the UK GDPR, we rely on these legal bases:

• To provide what you asked for (contract): licences, Claude, sync, cloud backup, shared hands.
• Legitimate interests: security, preventing abuse, and enforcing licences.
• Consent: your optional email and screenshots in feedback. You can withdraw it by asking us to delete them.
• Legal duties: records the law requires, mostly kept by our payment provider.

How long we keep it

Your rights

Under the GDPR, the UK GDPR and similar laws, you can ask to see, correct, export or delete your data, to restrict how we use it, and to object to how we use it. Write to owner@paintbrushdb.com. We'll answer within 30 days. Much of it you can delete yourself: see the Contact page.

• EU and UK: you can also complain to your data protection authority (in the UK, the Information Commissioner's Office).
• US states with privacy laws, including California: we don't sell or share your personal information, and you won't be treated differently for using your rights.

Security

Sync and backup are end-to-end encrypted. The relay keeps licence keys and sign-in tokens only as hashes, and never receives your backup passphrase. On your PC, the sync and backup keys are sealed by Windows to your user account. Every connection uses HTTPS. No system is perfectly secure. If a breach affects you, we'll tell you as the law requires.

Transfers

Our servers are in the United States. Anthropic and our payment provider may process data in the United States and elsewhere. Where the law requires it, we rely on safeguards such as the EU's standard contractual clauses and the UK's addendum to them.

Children

PaintBrush is for adults, 18 and over. It isn't directed at children, and we don't knowingly hold their data.

Changes

We'll post any change here with a new effective date. If what leaves your PC changes, we'll also say so in the app.