Privacy notice

Last updated 17 October 2026

1. Who we are.

Bridge Unlocked is run by NJM Marketing Ltd, registered in Ireland with company number 778104, the data controller for everything described here. Our business address is 77 Camden Street Lower, Dublin, D02 XE80, Ireland. You can reach us by email at hello@bridgeunlocked.com or through the contact page; a person reads everything. The platform is built and run for us by Loco Digital, who act as our processor: they handle your data only on our written instructions and never for their own purposes.

2. What we collect and why.

Your account. Your email address, an optional name, your chosen bidding system, and your locale and timezone. We need these to run your account and to keep your streak honest across time zones.

If you sign up with a code from a teacher or club, or follow a link that carries one, we keep that code with your account so Bridge Unlocked can thank the teacher or club. We also keep where you came from when you signed up (for example a newsletter or a partner’s website), as shown in the link you followed.

Your learning progress. Lessons completed, hands played, scores and streaks. This is the product’s core function: it is how the app knows where you are and what comes next.

Your answers. Each answer you give in a quiz, a topic test or Your Call is kept with your account: the question, the answer you chose, whether it was right, how long you took and when. We keep them to show you your progress and to improve the questions. If we ever show other learners how people answered, it is only ever as anonymous totals. Answers given without an account are not kept. Answers given during our free launch period are marked as given then, so that they can be counted in those totals or left out later. Your answers are kept for as long as Bridge Unlocked runs, and they are in your data export. If you delete your account, they stay in our anonymous totals, with nothing that identifies you.

Playing without an account. You can try part of Bridge Unlocked without an account (the pricing page lists what). While you do, your progress stays in your browser, not with us, and it goes when you close the page. We cannot see it and cannot recover it for you. If you then save it, by creating an account or signing in, it comes into your account and is kept like the rest of your progress. If the account already has progress of its own, we ask first. If you ask for a sign-in link to save what you’ve done without an account, we keep that progress with your request until you open a link sent to that address, or for a day if you don’t, and then delete it. If you report a hand while playing without an account, we keep your note for 90 days, like any other.

Payments. During our free launch period nothing is sold and we take no payments. From the day paid plans switch on, payments are handled by Stripe. We never see or store card numbers; we store your subscription status and your receipts. When you pay, Stripe also asks for your billing address, which it uses to work out the VAT. If you use Cancel contract here, we keep your cancellation: the name and email address you gave, which contract it was, your statement, when we received it and any refund.

Support. Whatever you send us via the contact form. If you use Report a problem in the app, we also receive the small diagnostic bundle sent with your report: the screen you were on, the app version, your browser type and recent error summaries. The dialog shows you exactly what travels before you send it. If you use Report a hand, we receive the hand, the category you picked and any note you write.

Email. A record of the emails we send you: which email, its subject, whether it was delivered, and, for emails with an Unsubscribe link at the bottom, clicks on links inside it. We keep this so we can answer “did my sign-in link arrive”, stop sending to addresses that bounce, and see whether our emails are worth your time.

What you must give us. You need an email address to have an account, and a level and bidding system so the app knows what to teach you. To take Plus you pay through Stripe. Without these we cannot provide that part of the service. Everything else we ask for, such as your name, is optional.

Age. Bridge Unlocked is for adults, whether or not you have an account. You need to be 18 or over to have an account, and we do not knowingly collect personal data from anyone under 18. We never ask for your date of birth: you confirm your age when you sign up. If we learn that an account belongs to someone under 18, we close it and delete its data as we would for any deleted account (section 6 lists the few records we keep for longer). If you think someone under 18 has given us their details, tell us through the contact page.

Technical. Server logs and error reports, kept short-term for reliability. Each signed-in session also records the IP address and browser it was created from, for security and for your active-sessions list; that record is deleted with the session.

3. Analytics, honestly.

Our website and app analytics are first-party only: they run on the servers that host Bridge Unlocked, not on anyone else’s analytics service. The public site is measured without cookies at all: a daily-rotating hash, no cross-site tracking, no ad networks. The app records product events (like “lesson completed”) under your account once you are signed in; before that, under a random id kept only while the tab is open. This includes what you do while playing without an account. While you play that way we do not know who you are, so unless you then create an account or sign in in that tab, we cannot find that record for you later. If you create an account or sign in in that tab, we link that id to your account, so the steps you took just before count as yours. If your browser sends a Global Privacy Control or Do Not Track signal, or you have asked us not to count your visits (on the cookies page), the app does not create the id at all. Nothing is sold or shared for advertising, ever.

Email measurement works like this. Our email is sent by Amazon Web Services, through its Amazon SES service in its Europe (Ireland) region. Our emails carry no tracking image, and Amazon does not redirect our links or count clicks. Our own systems do not keep a record of whether you opened an email. We keep a record of the links you click only in our emails with an Unsubscribe link at the bottom, such as the newsletter: links there pass through our own server so that we can count which links are clicked, as section 2 says. When such a link opens the app, the page it opens notes which email brought you there; nothing about it is kept in your browser.

Before launch day, our email was sent by Brevo instead. Brevo adds a small tracking image to each email and sends each link through its own address first, so that it can count opens and clicks, and when either happens it can see your IP address and some details of your device and email app. We did not keep Brevo’s reports of opens or clicks. Brevo keeps its own record of the emails it sent for us in our account’s logs for 1 month, then deletes it.

4. Legal bases.

Contract, for running your account and subscription. That includes bringing in the progress you made before you had an account, and holding it with your sign-in request until you open the link, which you ask us to do before your account exists. Legitimate interest, for first-party analytics, security, the welcome email and the getting-started and progress emails described below. Consent, for the newsletter, which you can withdraw at any time. Legal obligation, for keeping payment and tax records.

For email specifically, here is what we send and why.

Account and billing notices (sign-in links, receipts, trial and renewal warnings, and our notices about the end of the free launch period) are sent under contract: we have to be able to reach you about your own account. They carry no unsubscribe link for that reason.
A welcome email, once, when you create an account. We send it under legitimate interest, and it carries a working unsubscribe link.
Getting started and progress emails are off until you turn them on in your email settings: a few short emails in your first weeks (your first lesson, the Daily Deal, a look back at your first week), a note if you have been away a while, and one when you finish a course. We send these under legitimate interest, and only once you have turned them on. Every one carries a working unsubscribe link, one click stops its kind straight away, and you can turn each kind off again in your email settings.
Halfway through a free trial, one email that tells you the date and amount of the first charge (or that nothing will be charged). We send it under legitimate interest. Its unsubscribe link stops all our emails except account and billing notices.
Practice reminders and the weekly progress summary are off until you turn them on in your email settings, and you can turn them off the same way.
The newsletter is sent only if you ask for it. The box is never ticked for you, and withdrawal is one click.
After a free trial or a paid subscription ends, we may send a short series about it, but only if you have said yes to our newsletter. The same one-click stop applies.

5. Where your data lives, and who else handles it.

Our servers are hosted with DigitalOcean in their Amsterdam data centre, which is inside the EU. Backups stay in Amsterdam too: DigitalOcean take a weekly copy of the server, and one encrypted copy of the database is sent every night to separate storage there.

Until 29 September 2026 our servers were in DigitalOcean’s data centre in London. That server was switched off that day and deleted on 15 October 2026, with its backups.

Moving from the test site. Until launch day, Bridge Unlocked ran on a private test site. On launch day the accounts there, with their progress and saved answers, are copied to bridgeunlocked.com, and the accounts we used to check the service are removed from the copy, with everything they made. We keep a copy of the database as it was just before that clean-up on the live server for 30 days, then delete it. Once the move is checked, the test site is reset so that it holds only our own test data.

These companies handle parts of your data for us:

DigitalOcean, who host the servers and backups described above.
Amazon Web Services (Amazon Web Services EMEA SARL), who deliver our email through their Amazon SES service, from their Europe (Ireland) region. They see your email address and the message we asked them to send, and tell us whether it was delivered. They add no tracking image and do not redirect our links, as described in section 3.
Google Ireland Limited (Google Workspace): the hello@ and reportadeal@ mailboxes, where support and hand-report emails arrive. When you use the contact form, your message is emailed to one of them.
Stripe, who take your payment. They see your card details and we never do; we see your subscription status and your receipts.

Before launch day, Brevo (Sendinblue SAS) delivered our email, as section 3 describes. It sent none of our email after that, and it keeps its logs of the emails it sent for 1 month, then deletes them.

Each of them works for us under a contract and may use your data only to provide their service to us. If that list changes, this page changes with it.

Stripe is different in one respect. As well as taking your payment for us, Stripe uses your payment details for its own legal duties, such as preventing fraud and meeting anti-money-laundering rules. For that part Stripe decides for itself how your data is used, and Stripe’s own privacy policy applies.

Transfers outside the EU. Stripe may transfer payment data to Stripe in the United States, which is certified under the EU-US Data Privacy Framework. The Commission’s decision approving that framework was upheld by the EU General Court in September 2025 and is under appeal to the Court of Justice, so Stripe also relies on the standard contractual clauses approved by the European Commission. DigitalOcean and Amazon Web Services keep our data in the EU, but each belongs to a group based in the United States. Where any of our providers, or a company working for them, can reach your data from outside the EU, they do so under the safeguards the law requires, such as the standard contractual clauses or the Data Privacy Framework. You can ask us for a copy of these safeguards through the contact page.

6. How long we keep it.

Your account and progress: until you delete your account.
Progress you make without an account: in your browser only, until you close the page. We hold none of it unless you save it to an account. If you ask for a sign-in link to save it, we keep it with your request until you open a link sent to that address, or for a day if you don’t, and then delete it.
Your sign-in sessions, with the IP address and browser they were created from: deleted when you sign out, once they expire, or with your account.
Analytics events: deleted after 24 months, and anonymised sooner if you delete your account.
Your answers in quizzes, topic tests and Your Call: for as long as Bridge Unlocked runs. If you delete your account, they stay only in our anonymous totals, with nothing that identifies you.
Error reports and Report a hand notes: 90 days. If you delete your account sooner, the words you wrote are removed straight away.
Daily play counts: 90 days. Payment notices from Stripe: 90 days.
Server logs: kept in size-limited files that are overwritten as new entries arrive, so the oldest lines go first.
Support messages and bug reports: the attached diagnostic context is removed after 90 days, closed messages are deleted after 12 months, and every message is deleted after 24 months whatever its state.
Email history: full detail for 90 days (support and deliverability). After that we remove the address, the subject and the links, keeping which email it was, when it went, whether it was delivered or clicked, and a scrambled copy of the address (so an unsubscribe link in an older email still works). We delete the record at 12 months. Click records: 12 months.
Notes our staff write about you: until you delete your account.
Cancellation statements (Cancel contract here): until you delete your account, as the record of the cancellation and any refund.
Our record of what staff do on accounts (which account, what changed, when, who made the change and from which connection), including the record of a deletion made at your request: kept as our security record for 24 months, then deleted.
Consent records: for the life of your account, and deleted with it. If our staff delete an account at your request, the record of that deletion keeps a short note of which consents you had given, without the wording and with your address scrambled.
If you unsubscribe or an address hard-bounces, we keep a scrambled copy of the address (a hash) indefinitely, so we can honour your objection even after everything else about you is deleted. It is a scrambled copy used only to recognise the address if it returns. Anyone who already knows the address could match it, so we treat it as personal data and keep nothing else with it.
Payment and invoice records: kept for as long as tax law requires us to keep them.
Backups: 30 days, and never more than 35. The copy of the database taken on launch day, before the clean-up described in section 5: 30 days.

7. Your rights.

You have the right to:

see the data we hold about you (access), and take a copy with you (portability);
have it corrected (rectification);
have it deleted (erasure);
ask us to pause using it while a question about it is settled (restriction);
object to how we use it (see below);
withdraw any consent you have given, at any time. Withdrawing does not make unlawful what we did before you withdrew.

The right to object. You can object at any time to anything we do under legitimate interest. For email, the link at the foot of each one does it in one click. For anything else, tell us and we will stop, unless we have a compelling reason that outweighs yours, which we will explain to you.

Doing it yourself. Export and deletion are self-serve in your account page. The export is one file with your account, progress, subscriptions, the activity we record, your messages and hand reports, your consent records, your sign-ins, your email history, your answers in quizzes, topic tests and Your Call, and any notes our staff have written about you; if you want anything it does not cover, ask us and we will send it. Deletion erases your sign-in, hard-deletes your progress and anonymises analytics events and your answers, which stay only in our anonymous totals, with nothing that identifies you. Deletion is real and permanent.

Asking us. For anything else, write to us through the contact page. We answer within one month. If a request is complex we may need up to two more months, and if so we tell you within the first month. There is no charge.

Complaints. If you are unhappy with how we handle your data, tell us first: choose “Data protection question or complaint” on the contact page. We confirm we have it, look into it and reply. You can also complain to the Data Protection Commission (Ireland) at dataprotection.ie, or to the data protection authority where you live. If you live in the UK, you can complain to the Information Commissioner’s Office at ico.org.uk.

You can subscribe to Bridge Tips by email, our newsletter, from the site footer without creating an account. We send a confirmation link first (double opt-in), and nothing else reaches you until you click it; an unconfirmed address is deleted after 7 days. Every issue carries a one-click unsubscribe, and when you unsubscribe we delete your address and keep only the scrambled copy described in section 6.

9. Cookies.

Short version: this site sets no cookies unless you ask it not to count your visits, and the app sets only what keeps you signed in. The cookies page carries the full list, and beside it every key the app keeps in your own browser, what each one holds and how long it lasts.

10. Changes.

We date every revision of this notice at the top of this page. If a change is material, we email you about it.

Privacy notice.