Privacy policy

Who is responsible for your data

[TO BE COMPLETED] (trading as Major Casino), registered in [TO BE COMPLETED] under number [TO BE COMPLETED], is the data controller for the information described here.

Write to [TO BE COMPLETED] for account and payment questions, or to [TO BE COMPLETED] for anything about your personal data.

What we collect

We collect only what an account needs in order to work. This list is the complete set of personal data stored in our database.

• Email address — your login identifier and the address we send one-time codes to.
• Password — stored only as an Argon2 hash. We never hold the password itself and cannot recover it for you.
• Telegram ID — only if you link a Telegram account.
• Wallet addresses you submit for deposits and withdrawals.
• Transaction and balance history — every stake, win, deposit, withdrawal and bonus, held as an append-only ledger.
• Gameplay records — the game, stake, outcome and multiplier of each round you play.
• Provably fair seeds — the server seed, its hash, your client seed and the nonce for each round.
• Referral relationships — the code you signed up with and the codes you hand out.
• Support messages — anything you write to us through the in-app support chat.
• Account status — whether an account is frozen, and the reason recorded by staff.

What we do not collect

We do not store your IP address, your browser user-agent, your device identifiers, your location, or any advertising or cross-site tracking identifier. There is no such field in our database.

We do not sell personal data, and we do not share it with advertisers or data brokers.

Why we are allowed to hold it

• Performance of a contract — running your account, settling bets and processing payments. Without this data there is no account.
• Legal obligation — anti-money-laundering, financial record-keeping and age verification duties, where they apply to us.
• Legitimate interests — preventing fraud, abuse and multi-accounting, and keeping the platform secure. We balance this against your interests and use the minimum data that achieves it.
• Consent — optional analytics only, and only if you accept it in the cookie banner. You can withdraw consent at any time and nothing about your account changes.

Cookies and local storage

We use as little browser storage as the site can function with.

• Strictly necessary — a session cookie that keeps you signed in, and a session token in local storage. Without these you cannot stay logged in, so they are set without asking and cannot be turned off.
• Preferences — your chosen language and colour theme, kept in local storage on your own device. They never reach our servers.
• Analytics — set only after you accept them. If you decline, no analytics storage is written and no analytics script is loaded at all.

Third parties that see your data

We keep the list short and we do not embed anything we do not need.

• Cloudflare Turnstile — the anti-bot check on the sign-in, registration and password-reset forms. Cloudflare receives your IP address and browser signals in order to tell a human from a script. We do not receive or store your IP from it.
• Our email provider — delivers one-time codes and account notices. It processes your email address for that purpose only.
• Our hosting and database provider — stores the data described above on our behalf under a processing agreement.

How long we keep it

Account and financial records are kept for as long as your account is open, and afterwards for the period our anti-money-laundering and accounting obligations require — commonly five years from the end of the relationship, but confirm the exact period for your jurisdiction.

One-time codes expire within minutes and are deleted. Support conversations are kept while a dispute could still be raised.

Your rights

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider in a portable form.

Deletion has a limit worth stating plainly: we cannot erase financial records we are legally required to retain, and we cannot erase the seed and outcome history that makes past rounds independently verifiable — removing it would destroy the evidence that the games were fair.

Write to [TO BE COMPLETED] and we will respond within one month. If you are not satisfied, you can complain to the data protection authority where you live.

How we protect it

• Passwords are hashed with Argon2 and are never stored or logged in plain text.
• The whole site is served over HTTPS and instructs browsers never to connect over plain HTTP.
• Sessions are signed and versioned, so changing your password immediately invalidates every token issued before it.
• Administrative actions against an account are written to an audit log.

Age

This service is not for anyone under 18. We do not knowingly collect data from children, and an account found to belong to someone underage is closed and its data deleted except where we must retain records.

Changes to this policy

If we change how we use your data we will update this page and change the date shown at the top. Material changes will also be announced in the product.