Last updated August 20, 2026.
The short version: PKWAT stores your email address, a name you choose, an avatar if you upload one, and the hands you play. There is no advertising, no analytics, and nothing is sold or shared beyond the services listed below that are needed to run it.
The controller is Nendo, 66 Boulevard Garibaldi, 75015 Paris, France — the company described in the legal notice. Write to hello@nendo.fr about anything on this page.
There is no data protection officer. PKWAT does not monitor anybody at scale and holds no special category of data, so the law does not require one — and naming somebody who does not exist would be worse than saying this.
Two. One holds your session, without which you would be signed out on every page; the other remembers which language you read, so you are not asked again. Both are strictly necessary, neither is shared with anybody, and there is no analytics or advertising cookie — which is why you have not been asked to consent to anything.
The session cookie lasts thirty days and is cleared when you sign out. The language cookie lasts a year and holds nothing but a two-letter code.
Each of them acts on our instructions and for no purpose of their own. Nobody else receives your data, and none of it is sold — to anybody, for anything, ever.
The database and everything in it stay in France. Cloudflare, Sentry and GitHub are American companies whose processing can reach servers outside the European Union; each is engaged under the European Commission's standard contractual clauses, which is the mechanism the law provides for exactly that. If you want the current set, ask and we will send it.
A hand is not yours alone. Eight other people sat through it, one of them called you down, and the record of it is as much theirs as it is yours — so deleting your account does not delete the hands you played, and your display name stays on them.
A record in which one seat has become anonymous is not a record of what happened; it is a version of the evening that never took place, handed to eight people who were there and remember otherwise. That is why this is a legitimate interest rather than something you are asked to consent to, and it is the one place on this page where what you can ask for is limited.
What stays is a pseudonym you chose and that the table already saw. It is not your name unless you made it your name, it is not linked to your address once the account is gone, and there is nothing left here to connect it back to you. You can object to it on grounds particular to your situation, and we will weigh it — the address for that is below.
There is no password and nothing to reset: signing in means reading a code we email you. That means whoever can read your email can reach your account. It is the standard trade for a free product with no support desk, and it is better than an account nobody can ever get back into — but it is a choice, and you should know it before you rely on it.
Traffic is encrypted in transit, the database is not reachable from the internet, and no password is stored because there is none. A sign-in code lives ten minutes, works only alongside the address it was sent to, and dies after five wrong guesses. Images are decoded in a separate process from the one running live tables, so a malformed upload cannot reach a game. None of that is a promise nothing will ever go wrong; if something does and it affects you, we will tell you and the CNIL, which is what the law requires and what we would want told to us.
Nothing here scores you, ranks you outside your club's own leaderboard, or decides anything about you automatically. There is no advertising, no tracking across other sites, and no analytics of any kind.
PKWAT is for adults and no account should belong to anybody under 18. Nothing on the site is aimed at children and no data is knowingly collected from one. If you believe a child has an account here, tell us and it will be closed and its data deleted.
You can ask for a copy of everything held about you, have it corrected, have it deleted, have its use restricted, take it elsewhere in a portable form, object to the uses that rest on a legitimate interest, and withdraw a consent you gave — the avatar being the one thing that rests on consent.
Two of those need no request at all: export everything and delete your account from your account settings, immediately and with nothing held back. For the rest, write to hello@nendo.fr. We answer within a month, which is the deadline the law sets and not an ambition.
If you are the only owner of a club, you have to hand it over or close it before deleting your account. A club with no owner is a club nobody can run.
You can also lodge a complaint with the CNIL, the French supervisory authority — cnil.fr, 3 place de Fontenoy, 75007 Paris — or with the authority for the country you live in. You do not have to come to us first, though we would rather you did.
For anything about your data, write to hello@nendo.fr. To report something happening on PKWAT, use the abuse page — it reaches the people who can act on it faster.
This notice will change as the service does. The date at the top says when it last did, and a change that affects what is held about you or why will be announced in the app before it takes effect.