Privacy Policy

We collect the minimum needed to run a real-money platform. Here is exactly what, why, and how to control it.

What we collect
  1. Account info
    Email (or Steam ID if you sign in with Steam), display name, hashed password, and your profile preferences. Passwords are bcrypt-hashed — we never see the plaintext.
  2. Wallet and gameplay
    Every bet, win, deposit, withdrawal, tip, and balance change is written to a ledger. Crypto deposits and withdrawals include on-chain transaction hashes.
  3. Chat messages
    Stored with a snapshot of your display name, level, and role at send time so history renders correctly even after you change your profile.
  4. KYC info (only when required)
    For licensing thresholds or large withdrawals we may ask for ID. This data is collected only when needed and retained only as long as legally required.
How we use it
  1. Run the service
    Log you in, settle wagers, render history, push live balance and chat updates. Without this data the site cannot function.
  2. Detect abuse
    Multi-account detection, reward-farming detection, chargeback fraud, bot play — all forbidden under our Rules. We use a combination of signals to enforce.
  3. Legal compliance
    Anti-money-laundering checks, tax reporting where the operator is subject to it, and lawful responses to authorities.
  4. Improve the platform
    Aggregated, anonymised gameplay stats help us fix bugs and tune game math. Personal identifiers are stripped before this analysis.
Cookies and tracking
  1. Session cookie
    A single httpOnly cookie (gr_session) keeps you logged in. SameSite=Lax, Secure in production, 1-day lifetime. Required for the site to work.
  2. Browser fingerprint
    Computed in the browser as a one-way hash, used only for alt-account detection on this site. Never shared with advertisers or third parties.
  3. No ad tracking
    We do not run advertising pixels, retargeting trackers, or behavioural profiling. There is no third-party analytics SDK loading on these pages.
Who we share with
  1. The blockchain
    Crypto deposits and withdrawals are public on the chain they settle on (Tron, Ethereum, Solana). We do not publish links between on-chain addresses and your account identity.
  2. Service providers
    Crypto RPC providers, transactional email senders, and hosting infrastructure — strictly on a need-to-know basis. Vendors are bound by contract to handle data securely.
  3. Law enforcement
    Only when compelled by a lawful order. We do not voluntarily share user data with authorities or any other party.
  4. Never sold
    We do not sell, rent, or barter user data. Ever.
Your rights
  1. Access your data
    Request a copy of the information we hold on you. Contact support and we will respond within a reasonable window.
  2. Correct it
    Display name, email, and profile preferences can be edited from your account settings at any time.
  3. Close your account
    You can close your account at any time. Financial-ledger rows (deposits, bets, withdrawals) are retained for the legally-required period; everything else is removed.
  4. Self-exclude
    Request a cooling-off period or permanent self-exclusion via support. Once set, we will not re-open the account inside the window.
Retention and security
  1. Retention
    Account data is kept while your account is active and deleted on request. Financial ledger rows are retained as long as law requires (typically 5+ years for financial records).
  2. Password storage
    Bcrypt cost-12. We compare hashes even when the email is unknown to prevent account-enumeration via timing.
  3. Transport and storage
    HTTPS in production, httpOnly + Secure cookies, JWT pinned to HS256, request bodies size-capped, input sanitised against NoSQL injection and HTTP parameter pollution.
  4. Server-authoritative gameplay
    Outcomes are computed and signed server-side via HMAC-SHA256 commit-reveal. The client never decides who wins. See the Provably Fair page for the full algorithm.

Privacy questions? Contact support from the footer. We treat privacy requests as moderation-priority tickets.