Privacy
To log in, you use the e-mail and password of your account with the operator. They travel from our server to the operator; we never store or log your password, and the e-mail is kept as explained below.
To create an account here, you give your name, e-mail, phone number, date of birth and password; the operator requires this information to create your account and verify your identity. Your password, date of birth and any identity document only pass through our server on the way to the operator — we never store or log any of them. Your name, e-mail and phone are kept as explained below. Signing up this way tells the operator you came through Cassino Stats, its partner.
Data we keep to contact you
When you create an account here, we keep your name, e-mail and phone number and the ID of your account with the operator, which lets us confirm with the operator that the account came through our partner link. When you log in, we keep your e-mail, the date of your last visit and that account ID (plus your name and phone, if the operator supplies them in the session). Alongside this we record the page or game you arrived through, the games you open here, how long you use the site, your operator account balance at a few moments (on login and at most every 10 minutes of use), and any deposits made through the site (amount, date and whether it went through). We use this to contact you about Cassino Stats and the operator (updates, livestreams, offers) and to understand how the site is used. We don't sell this data. To ask for your data to be corrected or deleted, write to contato@cassinostats.com.
Your session lives in an encrypted cookie that only our server can read (httpOnly) and that expires together with your session at the operator. The cookie holds the operator's access token and a masked version of your e-mail, for display. It's deleted when you log out.
In your browser we keep only interface preferences (which side the quick-access button sits on, panel height, hidden balance, your age confirmation and any card you've dismissed) and the date of your last visit (see “Visit counting”, below).
If you turn on alerts, we store the notification endpoint your browser creates for our site (one per device, labelled with its browser and system, like “Chrome · Android”) and the alerts you chose, only to send you those notices. Turning alerts off for a device removes its endpoint.
Inbox notifications (your alerts, livestreams, confirmed deposits and messages from the team) are kept for up to 90 days, only for you to read. We don't keep your e-mail, phone or operator account ID in them.
Duda’s Tip. If you take part in a tip (a prize draw), we keep the name, phone number and e-mail you type, the country you accessed from, the partner casino you signed up at, your acceptance of the rules, a personal invite code, how many friends joined through your link, whether you opened the site from the installed app and, if you ask for it, the device or account we use to tell you about the next tips. We use this data only to check your entry with the partner casino, add the extra chance from invites and the app to the draw, run the draw and contact you about it. Your name and details are never shown to the people you invite or to the person who invited you. To prevent fraud we also keep keyed, scrambled codes (never the address itself) of the internet connection and the device. The data is kept while the tip is open and for 12 more months, then deleted. You can delete it whenever you like with the button on the page itself, with the Delete my data button below, or by writing to the contact above. We do not sell this data. Profile screenshot. When the tip asks for it, you send a screenshot of your profile at the partner casino, showing your account’s name and e-mail: only our team sees it, to check that the details match, and it is deleted 30 days after the tip ends (or sooner, if you delete your data). We also confirm your e-mail with a 6-digit code, which signs you in to the live chat on this device, and we keep a draft of what you filled in only on this device, for up to 24 hours. ID number for the payout. When the tip asks for it, people taking part from Brazil enter their ID number, which is the key used to pay the prize. It is stored encrypted (never in plain text); only our team sees the full number, and only for winners, to make the payment. Each number can enter once per tip. It is deleted 30 days after the tip ends (a winner’s, 30 days after the prize is marked as paid) or sooner, if you delete your data. We never keep this number in the draft on your device.
When you report a problem or send a suggestion, we keep what you wrote, the option you picked and technical details of the page (which game, which error, device and browser type, site version) — never a game link, password, e-mail or balance. A screenshot you send is kept for 30 days and seen only by our team; it shows whatever was on your screen, so cover your balance and any personal data before sending one. If something slips through, our team deletes it. Suggestions stay on the board for as long as it runs; your name never shows next to one. To ask us to delete everything you've sent us, write to the same address above.
Live chat. To write in the chat on the Live page, you sign in with the partner casino’s login, with Google or with a 6-digit code sent by email, and pick a nickname; just reading the chat doesn’t require signing in. We keep your nickname, an internal identifier for your access (never your password), your email (when you use Google or the email code) and the messages you write. Messages in our chat are deleted after 7 days; the ones that arrive from the Kick chat appear here and are deleted within 24 hours. The chat uses a cookie of its own, holding only the identifier of your chat access, valid for up to 180 days and removed when you sign out of the chat. We use your email only to send the access code and, if you tick the option, to let you know when there is a live. When you watch the live here, the Kick player is loaded inside the site: Kick receives your IP address and may use its own cookies.
Visit counting
To know how many people use the site and which pages help the most, we count visits ourselves, with no Google Analytics, no other company and no cookie. When you open a page, your browser tells our server which page it was, where you came from (for example, Google or Instagram, without the full address), your device, system and browser type, and whether the site was opened as an installed app. At that moment, the server uses your IP address and browser signature to: (1) work out an approximate country, region and city; and (2) build a scrambled code that changes every day at midnight, to count different people without knowing who they are. The IP address itself is never stored, and the key that scrambles the code is deleted the next day: after that, there's no way to tell which address a visit came from, or to join visits from different days. With that day's code we also count whether, during that visit, someone created an account, logged in, made a deposit, opened a game or turned alerts on; if you're logged in, the record says only “logged in”, never which account. Each visit's record is deleted within 14 days; after that, only daily totals remain. To know if it's your first visit, the site keeps only the date of your last visit in your browser, with no code that identifies you; if your browser sends “Do Not Track” or the “Global Privacy Control” signal, that date isn't stored either. We also measure how long pages take to appear, with nothing that identifies you.
Cookies and personalisation
On your first visit we show a cookie notice with two buttons of the same size: Accept and Only essential. Your choice is kept in a cookie of ours, _cc, which only says “accepted” or “only essential” (it holds no personal identifier) and lasts 180 days; after that, or if we change what we do with the data, we ask again. If your browser sends the “Global Privacy Control” signal (or “Do Not Track”), we treat it as “Only essential” and do not even show the notice; you can still choose Accept with the “Cookie preferences” link in the footer.
Only essential: nothing is recorded about you as a person. The visit counting described above stays the same for everyone (no cookie, and your days are not linked), and alerts exist only if you turn them on yourself.
Accept: we create a cookie on your device with a random code, _pd (400 days; only our server reads it), and start recording, linked to that code: the pages you open (table, slot, partner house, live page) and how long they stay on screen; your clicks on “Play”, on opening a partner house, on installing the app and on turning on alerts, and the alerts you create; when you open a game or a house from here and how long the game screen stays open and in use (never what you bet, your balance or what happens inside the game); whether there is a balance at the integrated partner house (only yes or no, never the amount) and the stage of a deposit (created, paid, expired), without the amount; how long you watch the live and how many chat messages you send (the count, never the text); your visits (day and time, approximate country and region, time zone, language, device type, whether the site is the installed app and where you came from); and, from that, a summary of what you like most (games, types of game, times of day). We use this to show you the games you like most first, to notify you when something happens in them and to understand what helps people who use the site. We do not store your IP address.
For how long: for as long as you keep your consent; we delete it when you ask. Each action recorded, your visits, your play sessions and the notifications you were sent (and what you did with them) stay in our database for 13 months and then move to monthly archive files that hold only a code number that does not say who you are, never your name, e-mail, phone number, IP address or the text of any message. The summaries (per day, of what you like and of your profile) stay in the database, also for as long as you keep your consent. The device code lasts as long as the cookie exists (400 days), and its link to the device is deleted after 400 days without a visit: what is left of the history is then anonymous and cannot lead back to you. We use this history, in that form, to understand what works and what does not, and the site owner can export it for analysis, including with artificial intelligence tools.
Accounts: if you are signed in and have not yet chosen in the notice, only three kinds of action are recorded, linked to the account: opening a game at the integrated partner house, seeing a deposit (the stage, never the amount) and play time at that house. If you accepted, the record of your device is joined to that of your account and of every device you signed in on with it; a device used by two accounts never joins the two. These records are kept only for a short time and then deleted: each action for 30 days, play sessions for 90 days, the daily summary for 120 days and the summary of tastes for up to 180 days without a visit. They never move to the monthly archive files.
To change your choice, use “Cookie preferences” in the footer or the buttons below: choosing “Only essential” after accepting deletes what was recorded about you. The Delete my data button deletes, on this device and on your account (and on the devices linked to it), everything described above, in the database and in the monthly archive files, and leaves only a “deleted” mark on the device code so that nothing is recorded again until you accept again. Backup copies stop holding your data within 14 days on our server and within 30 days in the copies kept elsewhere. It does not delete your account registration, the alerts you turned on on the device or the notifications already received: those have their own controls and, to delete your registration, write to the contact given above. We keep only anonymous counts, with no link to you: how many people chose each button, how many asked for deletion and how many notifications were sent.
Some links on the site — our Telegram community, for instance — lead to a third-party service outside our control; once you're there, that service's own privacy policy applies, not this one.
Depending on the data protection law where you live, you may have rights such as access, correction, deletion or portability over the data we hold about you; write to the same address and we'll handle your request under that law.
Provisional text: the final version depends on legal review for each jurisdiction.