Before dealing each hand, the club seals every one of the 52 cards. After the hand it opens only the cards that were actually shown, each with the proof that it was sealed at that position beforehand. Paste that proof here to check it yourself — no account needed. The cards nobody showed are never opened, by anyone, so a hand you mucked stays yours.
The recipe is public. Each card is sealed as SHA-256("longstroke-card-v2:" + position + card + salt), where salt = HMAC-SHA256(server seed, "longstroke-salt-v2:" + position); the hand's commitment is SHA-256("longstroke-deck-v2:" + all 52 sealed cards joined by colons). Opening a card means publishing it with its salt, so anyone can re-do the hash and get the same seal — while a card left sealed cannot be guessed without the server seed, which is never published. Hands played before this scheme used a single commitment over the whole deck: SHA-256("longstroke-deck-v1:" + server seed), with the deck itself from Fisher–Yates driven by HMAC-SHA256(server seed, player seed : hand number : counter) and rejection sampling.
What this proves, and what it does not. The seal is published with the deal, so no card can be changed after it is dealt, and every card shown to the table is exactly the card that was sealed. The player seed is drawn by each player's own browser and joined into the seal, so the deck depends on randomness the club did not choose. What the seal cannot show is HOW the server seed was chosen: the server seed is never published (publishing it would open every mucked hand), so nobody outside the club can check that it was drawn at random rather than picked. The club's own daily fairness sweep checks the shuffles for bias, and an outside auditor can be given read access to do the same.