Privacy Policy
1. Controller
CashWars.io
2. Data we process
- Account: email address, display name, password (only as a scrypt hash), optional 2FA secret (encrypted), time you accepted the terms. A display name you change away from stays reserved for you for 14 days (only the lower-case name and the time are kept), unless you delete your account first.
- Sign-in and security codes sent by email (signing in, withdrawals, deleting the account and, without 2FA, opening a support ticket): only a keyed hash of each code, what it is for, when it was sent, used and how many tries it took; codes expire after 10 minutes.
- Sessions: hashed session token, shortened IP address (IPv4 /24, IPv6 /48), browser user agent, country reported by Cloudflare, whether the request came through a proxy, a keyed hash of a random browser identifier, timestamps.
- Fair-play checks: a keyed hash of the name part of your email address; these signals, payment addresses and player reports are compared between accounts to detect multiple accounts and cheating.
- Payments: deposit address, deposits and withdrawals, destination addresses, buy-ins and winnings. Transactions on the Solana blockchain are public and permanent: anyone can see the addresses and amounts of deposits, buy-ins, match payouts (each its own transaction) and withdrawals.
- Gameplay: moves and results of matches, and replays of real-money matches (the players of a match can watch its replay from 2 seconds after it ends; demo matches have none). Replays are stored for 30 days after the match ends, then deleted automatically.
- Shop: the cosmetic items you bought (with price and date) and the ones you wear.
- Security log: security-relevant actions (logins, withdrawals, account changes), for some of them with the shortened network address (IPv4 /24, IPv6 /48) they came from.
- Support requests: category, your message, your account or (when sent logged out) the email address you give for the answer (stored encrypted), and a shortened network address against spam.
3. Purposes and legal bases (GDPR)
- Performance of the contract (Art. 6(1)(b)): account, matches, deposits and withdrawals.
- Legal obligations (Art. 6(1)(c)): e.g. anti-money-laundering, record keeping.
- Legitimate interests (Art. 6(1)(f)): fraud and abuse prevention, IT security.
4. Recipients / processors
- Bot protection and DDoS protection: Cloudflare
5. Retention
Match replays: 30 days after the match ends, then deleted automatically (match results, payouts and player reports are kept).
These are removed automatically after a fixed time:
- Session details (shortened IP address, keyed hash of the full address, browser user agent, keyed browser identifier and countries): 90 days after the session started.
- The keyed hash of the address you signed up from: 90 days after you signed up.
- The shortened network a match seat was joined from: 90 days after joining.
- The shortened network stored with security log entries: 90 days (the entry itself stays).
- Email links (email confirmation, password reset) and emailed codes: one day after they were used or expired.
- Counters of failed sign-in attempts (per account and per network): one day after their last use, unless a lock is still running.
Account data is kept until the account is deleted. Deleting the account removes your personal data at once, among it your email address, display name, password hash, 2FA, session details, support and report texts, notifications, email links and codes and the networks in the security log; payment and log data (transactions, balances and the security log without networks) are kept for as long as the law requires.
6. Your rights
Access, rectification, erasure, restriction, portability, objection and complaint to a supervisory authority. Public blockchain records cannot be erased.
7. Cookies
We use one strictly necessary session cookie (HttpOnly) for sign-in and store your lobby selection locally in your browser. There are no advertising or tracking cookies.