Privacy Policy

DRAFT — must be reviewed by an attorney before launch. Bracketed items are placeholders. Nothing on this page is legal advice or a binding commitment until counsel has approved it.

Draft last updated November 2026.

1. What we collect

Account data: email, display name, password hash, state of residence, age confirmation.
Identity verification data: handled by our verification provider [PROVIDER NAME]; we store the outcome (approved / rejected), a provider reference and the reason, not your documents.
Activity data: spins (including provably fair seeds), vault decisions, orders and shipping addresses, balances and transactions, limit and self-exclusion settings.
Location signals: your IP address and the country/state derived from it, recorded with each spin to enforce state restrictions. [GEO PROVIDER NAME] performs the lookup.
Technical data: browser and device information, cookies required to keep you signed in, and a local flag remembering that you passed the age gate.

2. How we use it

To operate the Service, verify eligibility and identity, prevent fraud and multiple accounts, fulfil shipping, enforce responsible-play tools, respond to support requests, and comply with law. We do not sell personal information. [ADVERTISING / ANALYTICS DISCLOSURES IF ANY.]

3. Sharing

With service providers acting on our behalf: hosting ([HOSTING PROVIDER]), database ([DATABASE PROVIDER]), file storage ([STORAGE PROVIDER]), email ([EMAIL PROVIDER]), identity verification, geolocation, payment processing (when enabled) and shipping carriers. With authorities when required by law.

4. Retention

Spin and transaction records are retained for [RETENTION PERIOD] because they form an audit trail that cannot be edited. Account data is retained while your account is open and for [PERIOD] after closure. Self-exclusion records are retained for the duration of the exclusion plus [PERIOD].

5. Your choices and rights

You can view and update profile details, set limits, and request a copy or deletion of your data at [PRIVACY EMAIL], subject to records we must keep. [STATE PRIVACY LAW DISCLOSURES, e.g. CCPA/CPRA, TO BE COMPLETED BY COUNSEL.]

6. Security

Passwords are hashed, transport is encrypted, administrative actions are logged, and money and spin records are append-only at the database level. No system is perfectly secure; report concerns to [SECURITY EMAIL].

7. Children

The Service is for adults 18+. We do not knowingly collect data from anyone under 18 and will delete it if discovered.

8. Contact

[LEGAL ENTITY NAME], [ADDRESS], [PRIVACY EMAIL].