Privacy policy
Last updated 15 October 2026
The short version: GTO Drill keeps your training progress on your own device. An account is optional: if you sign in with your email, your progress and Pro are saved to that account so they follow you to other devices, and you can delete the account in the app at any time. There are no analytics and no advertising.
What the app stores
Your drill results, lesson stars, XP, settings, imported ranges, the trial start date and your Pro status are saved in the app's local storage on your device (and, in the iOS and Android apps, in the app's own preferences). If you don't sign in, nothing is sent to us. Erasing the app's data, or tapping "Reset progress" in Stats, removes it.
Accounts (optional)
You can sign in under More → Account with your email address and a one-time code we email you. No password is stored. When you are signed in we keep:
- your email address and the account's id, to sign you in;
- a copy of the progress listed above (and your web Pro licence, if you subscribed on the web), so another device can pick it up;
- whether your account has Pro from an App Store or Google Play subscription, and whether Pro was granted to your email address for free.
Accounts are hosted by Supabase (supabase.com) on servers in the United States, and sign-in emails are sent through Resend (resend.com). We use this data only to run your account and never sell or share it. Delete account on the Account screen permanently deletes the account and everything saved to it straight away; the progress on your device stays until you erase it. You can also sign in at gto-drill.vercel.app and delete it there, or ask us by email.
Android beta (optional)
If you sign up on the Android beta page, we store the email you enter and when you signed up, to add you to the Google Play test, email you its link and grant you Pro. Google Play receives the address because it manages the test's testers. Email support@gtodrill.xyz to be removed.
Purchases
GTO Drill Pro is an auto-renewing subscription.
- App Store and Google Play: the subscription is handled by Apple or Google under their terms and privacy policies. The app uses RevenueCat to check whether your store account has an active Pro subscription; RevenueCat receives the purchase receipt and an app-user id (anonymous, or your account's id when you are signed in), not your name or email.
- Web: payment is handled by Stripe on Stripe's checkout page, and the sale is made by Link (part of Stripe) as merchant of record, under Stripe's and Link's terms and privacy policies. Link uses your billing address to work out sales tax or VAT. Our server sees the Stripe session id and asks Stripe for that checkout and its subscription (which include the email you gave Stripe) to check the subscription's status, both when it issues your licence and each time the app renews it. It does not store any of this. When you are signed in, the checkout also carries your account's id, which Stripe keeps with the payment. The licence is a signed token kept on your device (and in your account, if you are signed in).
What we do not do
- No passwords, public profiles or social features.
- No analytics, tracking pixels, crash reporters or advertising SDKs.
- No selling or sharing of data: there is nothing to sell.
Network requests
The app's fonts ship with the app, so loading them contacts no one else. The iOS and Android apps contact RevenueCat and the stores to check subscriptions. If you subscribe on the web, the app asks our server for a fresh licence from time to time (usually no more than twice a day), sending only the Stripe session id. When you are signed in, the app talks to Supabase to sign you in and sync your progress. Nothing else leaves your device.
Children
GTO Drill is a study tool for a card game and does not knowingly collect any data from anyone, children included.
Contact
Questions about privacy: support@gtodrill.xyz.