CountLab has no ad network, no third-party trackers, and doesn’t sell or share your data. It does have accounts (so your training history can follow you across devices) and it does track what you do in the app, so the sections below explain exactly what is collected, where it’s stored, and who can see it.

Accounts and guest mode

You can sign in with an email and password, sign in with Google, or skip accounts entirely and continue as a guest.

• • Email/password: handled by Supabase Auth. CountLab stores your email address and an encrypted password hash; the plaintext password is never stored or visible to CountLab.
• • Google sign-in: Google shares your name, email, and profile photo with CountLab (via Supabase) to create your account. CountLab does not receive your Google password. Google’s own privacy policy governs what Google itself collects when you use this option.
• • Guest mode: no account is created. Training records and settings stay on your device unless you later sign in. First-party usage analytics are sent under a random device identifier as described below.

Your training data

If you’re signed in, the following is stored in CountLab’s database (hosted on Supabase), scoped to your account with row-level security so only you can read or write it, and cached in your browser for instant reads:

• • Table-rule and drill settings.
• • Training session history, drill progress, and mistake logs.
• • Bankroll/session journal entries and transactions you choose to log.

In guest mode, this same data is kept only in your browser’s local storage and is never sent anywhere unless you export it yourself, or later sign in. Saved simulation runs and reusable setups are always kept locally in your browser, signed in or not.

Analytics: what’s tracked

CountLab records the actions you take in the app — things like which pages you visit, signing in or out, hands played and decisions made at the casino-game tables, drill questions answered, simulations run, journal/settings changes, and general clicks and taps on buttons and links across the site (including scroll depth on longer pages and outbound link clicks) — to a first-party analytics table so the site’s owner can see how the app is actually used. Each event is tagged with either your account’s internal ID (if signed in) or your device’s random local ID (if a guest), plus the page path and a few relevant details about the action (for example, a drill answer’s correctness or a clicked button’s visible label, not full page content, keystrokes, or anything you type into a form field).

Events also include coarse device/browser information, app release, performance measurements, referring domain and allow-listed campaign tags. When the hosting edge provides it, country and region are added coarsely while the request is processed; raw IP addresses are one-way hashed only for short-lived abuse prevention and are never stored in analytics. CountLab does not store precise location, authentication tokens, exact bankroll values, email addresses, or free-form answers in analytics. Detailed events are retained for up to 400 days and normalized error records for up to 180 days under the current, administrator-configurable retention policy.

This data is not sold, shared with advertisers, or used for anything beyond understanding and improving CountLab. It’s readable only by accounts the site owner has explicitly granted admin access to — row-level security in the database blocks everyone else, including other signed-in users, from reading it back. There is no cross-site tracking: nothing here follows you to other websites, and no advertising or marketing pixels are embedded in this site.

Infrastructure

CountLab’s static files are hosted on GitHub Pages; accounts, the database, and analytics are hosted on Supabase. Both are third-party infrastructure providers acting as data processors for CountLab — they run the servers, but CountLab controls what’s stored and who can read it. Like any web host, GitHub Pages may automatically log standard technical request data (such as IP address and timestamps) as part of normal server operation; that logging happens at the hosting layer, is outside CountLab’s control, and is governed by GitHub’s own privacy practices.

Deleting your data

Use Delete analytics history in Settings to remove this device’s analytics and, when signed in, analytics linked to your account. Clearing browser site data also removes the local copy, but cannot retract events already delivered to the server. For a full account deletion request, email privacy@countlab.ca to request deletion; deleting the account removes your settings, drill history, journal, and the link between your account and its analytics history. You may also request full deletion of associated analytics events and sessions. Export anything you want to keep first, using the export tools provided.

Children’s privacy

CountLab does not knowingly collect personal information from children and is not directed at them.

Changes

If this policy changes, the date at the top of this page will be updated.

Contact

Questions can be sent to privacy@countlab.ca.