This policy explains what personal data CasinoDrop collects when you use casinodrop.com, why we collect it, and what rights you have. We have kept it in plain English.
Who we are
CasinoDrop runs the website casinodrop.com. We are the data controller for the data described here. You can reach us at help@casinodrop.com.
What we collect
Information you give us
- Email. If you email us, we receive your address, your message and anything you attach.
- Comments. If you leave a comment, we store the name, email address and website you enter, plus your IP address and browser details. This is standard WordPress behaviour and helps us catch spam.
- Tracker ratings. If you rate one of our tracker pages, we store the star value, a timestamp and a pseudonymous code derived from your IP address and browser (a keyed hash — your raw IP address is not stored with the vote). The code lets you change your rating later; the page only ever shows the running average and vote count.
Information collected automatically
- Server logs. Our web server records your IP address, the pages you request, the date and time, the page you came from and your browser and device type. Logs are kept for a short period for security and troubleshooting.
- Analytics. We use Google Analytics 4 to see how many people visit, which pages are popular and roughly where visitors come from. Google Analytics uses cookies and processes a shortened version of your IP address. We do not use it to identify you personally.
- Country check. We check the country your IP address belongs to so we can block access from places where we are not allowed to operate.
- Browser storage. Our free tools, such as the simulators and the provably fair verifier, save your settings and inputs in your own browser using local storage. That data stays on your device and is not sent to us.
We do not ask for and do not want your casino passwords, card numbers, crypto seed phrases or identity documents. We do not sell anything on this site and we do not take payments. The only account we offer is the optional member account, which you can create from any page and which is described below.
Member accounts
If you create a member account, we store:
- your email address and username;
- a hash of your password (we never store the password itself);
- the time you accepted the terms and which version you accepted;
- one “member document” with the things the desk keeps for you: your settings (odds format, hidden sportsbooks, the bankroll figure you typed), your favourite leagues and matches, your alert rules and the notifications they produced, and your bet journal.
We use this to sign you in and to show you your own data on any device. We do not use it for anything else: no marketing email, no profiling, no sharing with sportsbooks or anyone else. We cannot see your betting accounts and we hold no money.
Signing in with Google, Discord, Kick, X or Telegram. If you choose “Continue with Google”, Google sends us your Google account identifier, your email address and whether Google has verified it, and your name. If you choose “Continue with Discord”, Discord sends us your Discord account identifier, your username and, if your Discord account has one, your email address and whether Discord has verified it. If you choose “Continue with Kick”, Kick sends us your Kick account identifier, your username, your email address and the address of your profile picture; we do not keep the picture. If you choose “Continue with X”, X sends us your X account identifier, your @handle and your display name; we keep the identifier and the handle. X’s permission screen also mentions seeing posts, because X bundles that with reading a profile; we never read posts. If you choose “Continue with Telegram”, Telegram sends us your Telegram account identifier, your name, your @username if you have one, and the address of your profile photo; we keep the identifier and the name or @username, not the photo. Telegram does not share your phone number with us, and our sign-in bot never sends you messages. We use them to create or find your member account and to suggest a username; we keep the identifier, the username and the email with your account. We do not receive your Google, Discord, Kick, X or Telegram password, contacts, messages, servers, channels or any other data from them, and we send nothing about your use of CasinoDrop to Google, Discord, Kick, X or Telegram through this sign-in. If Google or Discord confirms an email address that already has a CasinoDrop account, signing in links it to that account; if that account’s email had never been confirmed, we also remove its old password and sign out its other devices, so that only the person who controls the email keeps the account. You can set a new password on your account page. On that page you can also connect more sign-in providers to your account and disconnect them again; disconnecting deletes the provider identifier we stored, and we ask for your password first. The last way into an account cannot be removed. You can sign in this way only after confirming you are 18 or older and accepting the terms.
Account email. When you create an account with an email address, ask us to confirm it, reset your password or change your password, we send you one message about it. These messages go out through Amazon Simple Email Service (Amazon SES), run by Amazon Web Services, acting as our processor. Amazon receives only what the message needs: your email address, the subject and the text of that one message. A confirm or reset message contains a single-use link; none of them contain images, tracking pixels or click tracking, and we send no marketing email. Amazon SES processes the message in its Asia Pacific (Mumbai) region and keeps its own delivery records, including bounces and complaints, under its retention rules. We keep no copy of the message.
Cookie. Signing in sets two cookies. cd_member holds a random session token, nothing else; it is sent only to casinodrop.com, is not readable by scripts, and expires after 30 days without use. cd_member_hint holds the single character “1” and tells our pages that a member may be signed in on this browser, so that visitors without an account never make an account request; it lasts 30 days. Signing out removes both. While a Google, Discord, Kick, X or Telegram sign-in is in progress two short-lived cookies protect it: cd_oauth (10 minutes) ties the sign-in to your browser, and cd_oauth_pending (15 minutes) holds your place while you confirm a new account. Both expire on their own. These cookies are strictly necessary for the account to work; they are not analytics or advertising cookies.
Where it lives. On our own server. Backups of the site include it and are kept on the same schedule as the rest of the site.
How long. For as long as the account exists. Signing out from all devices ends every session; deleting the account removes the account, the document and the sessions immediately. Accounts that have not signed in for 24 months are removed. To apply that rule the account keeps the date it was last used; that date is part of your data download.
Your rights. You can see everything we hold about your account on the desk itself (it is your data, shown back to you). You can delete it yourself from the account menu, or ask us at help@casinodrop.com to export or delete it; we answer within 30 days.
Age. Accounts are for people 18 or older. We ask you to confirm this; we do not verify identity, because no money changes hands here.
Why we use it
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Running and securing the website | Legitimate interests |
| Replying to your email | Legitimate interests |
| Publishing and moderating comments | Legitimate interests |
| Analytics and measuring traffic | Consent, where required by law |
| Preventing spam, fraud and abuse | Legitimate interests |
| Meeting legal obligations | Legal obligation |
| Running your member account (sign-in, your saved data) | Contract (the terms you accept when you sign up) |
Cookies
We use a small number of cookies. Full details, including how to turn them off, are on our Cookie Policy page. Signing in to a member account sets two strictly necessary cookies, cd_member and cd_member_hint, described under Member accounts above.
Who we share data with
We do not sell your personal data. We share it only with the service providers we need to run the site:
- Our hosting provider, which stores the website and its logs on its servers.
- Google, for Google Analytics. See Google’s privacy policy.
- Email provider, which handles messages you send to us.
- Amazon Web Services, for Amazon SES, which delivers the account messages described under Member accounts. See the AWS privacy notice.
We may also disclose data if the law requires it, or to protect our rights, our users or the security of the site.
Affiliate links and other websites
When you click a link to a casino, you leave our site. The casino’s affiliate system records that the click came from us, usually with a tracking code in the link and a cookie set by them. From that point on, the casino’s own privacy policy applies, not ours. We have no access to your account, your balance or your play history. See our Affiliate Disclosure for more.
How long we keep data
- Server logs: a few weeks, then deleted or overwritten.
- Analytics data: as set in Google Analytics, up to 14 months.
- Comments: for as long as the comment stays published.
- Emails: for as long as we need them to deal with your query and keep a record of it.
- Tracker ratings: individual votes for 12 months, then deleted. The running totals behind the published averages are kept so they stay stable; after a vote expires, rating again counts as a new vote.
- Member accounts: for as long as the account exists; removed at once when you delete it, or after 24 months without a sign-in.
Where your data goes
Our providers, including Google and Amazon Web Services, may process data on servers outside your country, including in the United States and India. Where that happens, they rely on standard contractual clauses or similar safeguards approved for international transfers.
Your rights
Depending on where you live, you can ask us to:
- tell you what personal data we hold about you, and give you a copy
- correct anything that is wrong
- delete your data, for example a comment you left
- stop or limit how we use it, or object to us using it
- withdraw consent for analytics at any time
Email help@casinodrop.com and we will deal with your request within one month. It is free. If you live in the UK or EU and you are not happy with our answer, you can complain to your national data protection authority. If you live in California, we do not sell or share your personal information as those terms are defined by the CCPA, and you will never be treated differently for exercising your rights.
Security
The whole site is served over HTTPS. Access to the server is limited and protected, and we keep the software up to date. No website can promise perfect security, but we take it seriously.
Children
This site is for adults. It is not aimed at anyone under 18, and we do not knowingly collect data from children. If you believe a child has sent us personal data, email us and we will delete it.
Changes to this policy
If we change this policy, we will update the page and change the “last updated” date at the top. Please check back now and then.
Contact
Any questions about privacy or your data: help@casinodrop.com.