Legal

Privacy Policy

Version 1.0 · Last updated: [OWNER: date this policy was finalised]

1. Who is responsible for your data

The data controller is the operator named below. As the operator details have not yet been supplied, this section is flagged for completion.

Operator: [OWNER: registered company / operator name]
Registered address: [OWNER: registered office address]
Registration number: [OWNER: company registration / CIN]
Data protection contact: [OWNER: email address for privacy requests]

2. What we collect

We intentionally collect as little as possible. The application stores:

• Account details — the display name you provide, and either an email address or a mobile number, whichever you use to register.
• Password — never in readable form; only a bcrypt hash is stored. A hash cannot be reversed to recover your password.
• Account activity — the dates you registered and last signed in, and a count of consecutive failed sign-in attempts used for temporary account locking.
• Security event log — server-side records of events such as successful sign-ins, failed attempts and password reset requests, with the IP address that made the request. This log exists to detect and investigate abuse.
• Session data — the server-side record that keeps you signed in.

We do not collect payment details, bank or UPI information, government identity documents, biometric data, location data, contact lists, or advertising identifiers. This build has no deposit, wagering, payout or withdrawal functionality, so no financial data is processed at all.

3. Why we collect it

• To create and secure your account — authenticating you and preventing unauthorised access.
• To meet legal obligations — including responding to lawful requests and maintaining records where required.
• To prevent abuse — rate limiting, detecting credential-stuffing, and protecting the service and its users.
• To respond to you — when you contact support or request a password reset.

Where the concept of a lawful basis applies in your jurisdiction, processing rests on the performance of a contract with you, your consent, our legitimate interest in securing the service, and compliance with legal obligations.

4. Cookies and sessions

This site uses exactly one cookie, which is strictly necessary for signing in:

• Name: mw.sid
• Purpose: identifies your server-side session so you stay signed in between page loads.
• Flags: HttpOnly (unreadable by page scripts), SameSite=Lax (blocks cross-site sending), and Secure when the site is served over HTTPS.
• Lifetime: up to 7 days, refreshed as you use the site, and deleted when you sign out.

There are no advertising, analytics, tracking or social-media cookies on this site, and no third-party scripts are loaded. Because we set no non-essential cookies, no cookie consent banner is required or displayed. If analytics or advertising tags are added later, this policy and the consent workflow must be updated first.

5. Sharing and disclosure

We do not sell, rent or trade personal data. Data may be disclosed only:

• to service providers who host the application or deliver email/SMS on the operator's behalf, under contract and only as needed;
• where required by law, regulation, court order or a lawful request from a competent authority;
• to protect the rights, safety or security of users, the operator or the public;
• as part of a reorganisation, merger or sale, in which case affected users will be notified.

Third-party processors currently configured: [OWNER: hosting provider, email/SMS provider and their locations]. Cross-border transfer arrangements: [OWNER: describe any cross-border processing].

6. Retention

• Account record: retained while your account is open.
• Failed-attempt counters and lockouts: cleared on a successful sign-in or after the lock expires.
• Session records: deleted on sign-out and purged automatically after expiry.
• Password reset tokens: expire after 30 minutes and are single-use.
• Security event log: kept only as long as needed for security and legal purposes, then deleted. Retention period: [OWNER: e.g. 90 days].
• Deleted accounts: account data is removed on a verified deletion request, subject to any legally required retention.

7. Your rights and choices

Depending on where you live, you may have the right to request access to your data, correction of inaccurate data, deletion, restriction of processing, portability, or to object to certain processing; and to withdraw consent at any time where consent is the basis. To exercise a right, contact [OWNER: privacy contact email]. We may need to verify your identity first. You may also complain to your local data protection authority.

8. Security

Measures implemented in this application include:

• bcrypt password hashing with a per-user salt, never reversible;
• session identifiers regenerated on every successful sign-in to prevent session fixation;
• session cookies that are HttpOnly, SameSite-restricted, and Secure in production;
• rate limiting on registration, sign-in and password reset endpoints;
• temporary account locking after repeated failed sign-in attempts;
• server-side validation of every submitted value, independent of the browser;
• parameterised database queries, so submitted values cannot alter query structure;
• strict HTTP security headers and a Content Security Policy that blocks third-party scripts;
• generic error responses that do not reveal whether an account exists;
• secrets held only in server-side environment variables, never in browser-delivered files.

No system is perfectly secure. If you believe your account has been compromised, change your password immediately and contact support. Never reuse a password you use elsewhere.

9. Age and children

This service is strictly for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn that a minor has created an account, it will be closed and the associated data deleted. If you believe a minor has provided us with data, contact [OWNER: support email].

10. Changes to this policy

This policy may be updated to reflect changes in the service or the law. The version number and "last updated" date above will change, and material changes will be announced in the official Telegram channel. Continued use after an update constitutes acceptance of the revised policy.

11. How to contact us

• Privacy & data requests[OWNER: privacy contact email]
• Postal address[OWNER: registered office address]

Terms and Conditions · Responsible Gaming · Contact