Version: (auto-assigned at deploy — short content hash of this file)
Effective: (stamped at deploy)
This Policy explains what personal data the service collects, why, how long it is kept, and the choices you have. It is incorporated into the Terms of Service and uses the same defined terms.
1. What we collect
Account data — your username and a one-way hash of your password. We never store your password itself and cannot read it.
Contact detail for verification and two-factor authentication — the email address you supply, and whether it has been verified.
Agreement record — the version of the Terms you accepted, the date and time, and the IP address the acceptance came from. This is kept because it is the proof that consent was given.
Marketing consent record — if you tick the optional email box at registration, we store that you opted in, when, and the IP address it came from. If you leave it unticked, we store only that no consent was given.
Play records — for each game you play: the game, the amount staked, the amount returned, the outcome, your balance, and a server timestamp, linked to your account.
Technical data — IP address, approximate request time and, where relevant, sign-in events. Session cookies are used to keep you signed in; they are strictly necessary and are not used for advertising.
We do not collect phone numbers, and we do not ask for payment card details, government identifiers, or precise location.
2. Why we use it
To create and operate your account, sign you in, and keep it secure (including two-factor authentication).
To run the games, maintain your credit balance, and keep an accurate record of play so that a query or dispute about a result can be answered.
To detect and prevent abuse — shared or stolen credentials, automated play, and attempts to manipulate game results.
To meet legal and record-keeping obligations.
To send you offers and updates only if you opted in. You can withdraw that consent at any time (see §6), and withdrawing it does not affect your account or your ability to play.
3. Legal grounds
Where data protection law requires a legal basis, we rely on: performance of the contract with you (operating your account and the games); our legitimate interests (security, abuse prevention, and keeping accurate play records); your consent (marketing email only); and compliance with legal obligations.
4. Sharing
We do not sell your personal data, and we do not share it for advertising. We use a small number of service providers who process data only on our instructions: hosting and network protection, database and storage, and email delivery for verification and, if you opted in, marketing. Providers may process data outside your country. We may also disclose data where we are legally required to, or to protect our rights, safety, or property.
5. How long we keep it
Account records — while your account exists, and for a limited period afterwards where we need them for security, dispute, or legal reasons.
Detailed play records — retained in full for 90 days, which covers the period in which a result may realistically be queried.
Summarised play history — totals by day and game, retained indefinitely. These summaries are what we use for reporting and for verifying that games pay as designed.
Agreement and consent records — retained for as long as needed to evidence the consent, which may outlast the account.
Where the law imposes a longer minimum retention period on any of the above, that period applies instead.
6. Your choices and rights
Marketing email — opt in or out at any time; every marketing message includes an unsubscribe option.
Access, correction, deletion — you may ask for a copy of your data, ask us to correct it, or ask us to delete your account. On deletion we remove or irreversibly anonymise the personal fields (username, contact, IP) and keep the financial and play records in anonymised form, because those records are the audit trail and must remain intact.
Password — you can change it at any time from your account page.
Depending on where you live you may have further rights, including to object to certain processing, to restrict it, to data portability, and to complain to your local data protection authority.
To make a request, write to [email protected] from the address on your account. We may need to verify your identity before acting.
7. Security
Passwords are stored only as hashes; traffic is encrypted in transit; two-factor authentication is available and is required for administrative accounts. No system is perfectly secure, so please use a password you do not use anywhere else and do not share your account.
8. Children
The service is for adults aged 18 or over (or the age of majority where you live, if higher). We do not knowingly collect data from anyone under that age. If you believe a minor has registered, contact us and the account will be closed and its data deleted.
9. Changes
We may update this Policy. The current version is identified by the content hash above; material changes take effect when posted, and we retain prior versions.
10. Contact
Questions about this Policy, or about the operator's identity and registered details, go to [email protected]. Operator details are set out in the Terms of Service.