Privacy

What we keep and why

Minimal data. Email, nickname, password (scrypt hash), language, optional country and TRC20 payout address. IP addresses are stored only as salted hashes to detect multi-accounting and abuse.

API keys. Sealed for the engine with its public key (RSA-OAEP + AES-GCM); only the engine can open them. We show just the last 4 characters. Deleting a key deletes the sealed envelope: the secret is gone.

Game data. Equity reads, trades and account movements during tables, needed for the ranking and anti-cheat detection. While a table is live no amounts or symbols are published; when it ends, traded pairs are published.

Providers. Crypto payment processor (gets the amount and an order id), transactional email service (gets your email and the notice), exchanges (get read-only queries with your key). We don’t sell or share data for advertising.

Retention. Financial and audit records as long as the law requires; sessions 12 hours; single-use tokens up to 24 hours. You can request account deletion: the profile is anonymized and financial records are kept.

Security. TLS, HttpOnly/SameSite cookies, optional two-factor (mandatory for the administrator), separation between the web server and the engine, encrypted backups and an append-only audit log.