1. What we process
| Category | Current data | Where it lives |
|---|---|---|
| Account and eligibility | Email address, screen name, password hash where email sign-in is selected, date of birth, Canada residence confirmation, and acceptance timestamps for the Terms and Privacy Notice. | Server-side account storage. |
| Session and play security | Session identifier, CSRF token, account-bound fictional-credit balance, idempotent spin references, virtual-credit activity, cookie-choice state, and Player Care setting. | Essential cookies and server-side storage. |
| Google sign-in, if activated | Verified email, provider subject identifier, and basic profile name required to complete registration. Google does not replace the Canada 19+ eligibility confirmation. | Google OAuth callback and server-side account storage. |
| Support request | Name, reply email, selected topic, message, reference number, timestamp, and delivery status. | Server-side support record and transactional delivery provider. |
| Optional audience measurement | With consent: page URL, referrer, approximate location, browser or device information, session statistics, and page interactions. | Google Analytics and first-party analytics cookies. |
| Technical request data | Standard request information needed to serve pages and diagnose errors, such as time, route, and server logs. | Application and server logs. |
2. Why we use it
- Run accounts and games — to create an eligible account, keep a fictional balance stable, protect forms, and prevent duplicate application of a spin request.
- Provide requested account access — to authenticate email/password sign-in, deliver requested password recovery messages, and, only if enabled, complete Google sign-in.
- Provide requested help — to capture, reference, and deliver Support submissions.
- Apply Player Care choices — to remember reminder or break selections.
- Understand product use — only with analytics consent, to measure visits and improve navigation or content.
- Keep the product secure — to investigate errors, misuse, or attempted interference.
4. Retention
Account and fictional-credit records are retained while needed to operate the account and maintain its play history. Support records and operational logs are retained only as needed to answer requests, maintain security, and diagnose service errors. Password recovery tokens are stored only as hashes and expire after one hour. Analytics retention is controlled within the configured Google Analytics property; analytics cookies may remain for up to two years unless you withdraw consent or clear them sooner.
5. Security posture
The production service uses HTTPS, CSRF protection, Secure and HttpOnly session cookies, password hashing, and server-authoritative fictional-credit updates. No internet service can guarantee absolute security, so do not submit payment details, government identifiers, or sensitive personal narratives through Support.
6. Your choices and questions
You can allow, decline, or withdraw optional analytics at any time in the Cookie Preference Centre. Browser controls can clear stored data, though clearing essential cookies ends the current session. For access, correction, deletion, or privacy questions, contact help@ryanjbanda.com and include a support reference when available.
7. Updates to this notice
We will update the effective date and this notice when the product's data handling or service providers materially change.