The display name you type when you sit down, the chips and hands you play at that table, and a random id generated on your own device so that refreshing the page gives you your seat back instead of a fresh stack. No account, no email, no password, no location.
All of it is scoped to one table and is deleted with the table.
A pub name, an email address, and a hashed password (bcrypt — the password itself is never
stored). Sessions are a signed token in a httpOnly cookie, which the web app
itself never reads.
Deleting a pub account deletes every table, player row and hand it ever created. See Delete account.
Nobody. There is no analytics, no advertising, and no third-party service in the request path. This runs on whatever server the pub points it at.
Your hole cards are only ever sent to your own device. The pub's screen and every other player receive the table without them — that's enforced on the server, not by the page you're looking at.