Privacy

What we know about you, and what we do with it. Short version: as little as we can. The code will be open source, so you can check every line of this.

What we never ask for

No email, no name, no phone number, no ID documents. No analytics, no trackers, no ads, and no third-party scripts in your browser.

What we store

  • Account number: only a hash of it. We cannot see or recover it.
  • Nickname, if you set one, and your settings (display currency, exchange rate preferences).
  • Balance and history: every bet with its seeds (so it can be verified), deposits, withdrawals and investments.
  • Deposit address: a Monero subaddress made just for you.
  • Withdrawal addresses you send to, with the amount and transaction ID.
  • 2FA: your secret is stored encrypted, backup codes only as hashes.
  • Login sessions: stored as hashes, they expire after 7 days.
  • The invite code you signed up with, and who created it.

IP addresses

Your IP is used to rate-limit requests and is kept for a few minutes only. It is not saved to your account. When an admin changes something, that admin's IP is saved in the admin audit log.

The server hosting the site may keep short-lived standard access logs, like any website.

Cookies and your browser

Two cookies: your login session and a security token that blocks forged requests. Theme and sound settings stay in your browser's local storage and are never sent to us.

Outside services

  • CoinGecko: our server fetches the XMR price. Nothing about you is sent.
  • Trocador: only if you use the coin swap. Our server sends the swap request with your deposit subaddress as the payout address. Trocador's own privacy policy covers what they do with it.
  • Monero network: our wallet talks to a Monero node. Monero hides amounts and addresses on chain, but we, as the receiving wallet, can see your deposits.

What is public

Nothing, unless you choose. A bet you share gets a public link. Your nickname shows on receipts only if you turn that on in settings.

Who can see your data

The people who run xmrbet can see account data in the admin panel. We do not sell or share it. If we are legally forced to hand data over, we can only give what is listed above, which is very little.

Deleting your data

Ask the person who invited you or an admin. We delete your account, but keep records of deposits, withdrawals and bets needed to keep the bank's books correct.