Privacy Policy

1. Analytics and click measurement

We use Google Analytics 4 to understand how the site is used, for example which pages are visited, time on page, country, and device type. This is aggregated reporting and is not used to identify you personally.

Google Analytics only loads after you accept analytics cookies in our consent banner. If you decline, it is not loaded and fires no events. You can change your mind by clearing the consent cookie in your browser, which brings the banner back on your next visit.

Separately from Google Analytics, we record when someone clicks through to a casino from one of our links. This is our own measurement rather than a third party's, and it is how we know which reviews and which parts of a page are actually useful. It does not use cookies and it does not depend on your consent choice. For each click we store which casino was clicked, which button or card it was clicked from, which page you were on, a broad device type such as mobile or desktop, the time, and a one-way hash of your IP address. If you are signed in, we also store which account it was. We do not store your raw IP address. We store a keyed hash of it instead, which is not directly reversible back into an address.

2. Site content

We use Supabase to store and serve the content of this site, such as casino data, slot data, live tracker data, and articles. Site content is not personal data about visitors.

3. If you create an account

Accounts are optional. You can read everything on FluxPlays without one. If you do create an account, we process the following.

From your social login

We use Google, Discord, Twitch or Kick to sign you in. We never see or store your password for those services. From the provider we receive a unique account identifier, your email address, and where available a display name and profile picture. We store the identifier so we can recognise you on your next visit, and the email address so we can contact you about your account.

From you

The username you choose, an optional display name, and an optional profile picture you upload.

Generated by using the account

A record of your consent choices, including the date, the version of these policies you agreed to, your user agent, and a one-way hash of your IP address. A record of any FLUX awarded to you and any corrections to it. Where you have linked a Twitch or Discord account, whether you follow or are a member at the time of linking.

If you use the Shop

To redeem a cash item or a Bonus Buy, or to claim a raffle prize, you link a YEET account. We store the YEET username and the YEET user id you link, and the amount YEET reported you had wagered when you linked. We read these from YEET's affiliate API, which lists the players who signed up with our code, only to check that your YEET account signed up under our code and has played. For each payment we keep the amount, the date, the YEET username it was sent to as a tip, and the payment reference. Only the team members who run the Shop see your YEET username; nobody else on the site does. If you redeemed before 18 October 2026, we also hold the USDC address on Ethereum you gave then. A payment on Ethereum is recorded publicly on that network, but we never publish which address belongs to which member.

Your profile page shows only your username, avatar, badges and join date. Your email address, your balance, your payout details, your linked YEET and social accounts and anything we hold for fraud prevention are never shown publicly.

4. Fraud prevention

Because we award FLUX to individual accounts, we take basic steps to notice when several accounts appear to belong to the same person. To do this we store a one-way hash of your IP address and a technical fingerprint of your browser. We do not store your raw IP address for this purpose. We store a keyed hash of it instead, which is not directly reversible back into an address.

This data is deleted automatically after 30 days.

If our system notices a possible link between accounts, it records a note for a human to review. It never restricts your account, never blocks you, and never makes any decision on its own. Any action is taken by a person who looks at the case first.

5. Legal bases

• Running your account is processed because it is necessary to provide the service you asked for.
• Analytics and marketing email are processed on the basis of your consent, which you give freely and can withdraw at any time.
• Click measurement is processed on the basis of our legitimate interest in knowing which of our recommendations people find useful, and in being credited correctly for the traffic we send. We limit it to a hashed IP address and a broad device type, and we remove anything identifying after 12 months.
• Fraud prevention is processed on the basis of our legitimate interest in making sure a reward intended for one person is not claimed several times. We limit this to hashed and short-lived data to keep the impact on you as small as possible.
• Keeping records of awards is processed on the basis of our legitimate interest in maintaining an accurate and auditable record of what we have issued.
• Checking your YEET link and paying you for a Shop redemption is processed because it is necessary to give you what you redeemed.

6. Marketing

When you create an account you can choose to receive updates, promotions and stream alerts. This box is never ticked for you, and leaving it unticked has no effect on your account. You can turn it on or off at any time in your account settings, and turning it off is as easy as turning it on. Messages about your own account, such as a confirmation that you asked to delete it, are not marketing and are sent regardless of this setting.

7. Cookies

We use a small consent cookie to remember whether you accepted or declined analytics. If you sign in, we use a session cookie to keep you signed in; this is strictly necessary for the account to work and cannot be declined while you are logged in. If you accept analytics, Google sets its own cookies. For more detail see our Cookie Policy.

8. How long we keep things

• Account profile and settings: until you delete your account.
• Consent records: until you delete your account.
• Hashed IP and browser fingerprint used for fraud prevention: 30 days.
• Affiliate click records: the hashed IP address and any link to your account are removed after 12 months. If you delete your account, the link to it is removed straight away. What remains (which casino was clicked, from which page and placement, the device type and the time) is kept as a commercial record and can no longer be linked back to you.
• Records of FLUX awarded: kept after account deletion, with your identity removed, so our own records stay accurate. These anonymised records can no longer be linked back to you.
• Your YEET link (username, user id and the wagering figure checked when you linked): until you delete your account or link a different YEET account. Payout details (the YEET username a payment was sent to, or a USDC address for redemptions before 18 October 2026) and payment records: kept with the redemption for as long as we keep payment records. When you delete your account, any money we owe you is paid first, and the link to your account is then removed.
• A username is held for 90 days after deletion so it cannot immediately be taken by someone else, then released.
• Analytics: according to the retention period set in our analytics account.

9. Who else processes your data

We keep the list of third parties short on purpose.

• Supabase hosts our database, file storage and login system.
• Vercel hosts and serves the website.
• Google, Discord, Twitch and Kick handle the sign-in step itself, under their own privacy policies.
• Google Analytics, only if you accept analytics cookies.
• Casino affiliate networks receive your click when you follow one of our links, in the same way any site you visit receives your request. We include a code identifying which of our pages sent you, so we are credited correctly. We do not send them your name, email address or account details.
• YEET tells us, through its affiliate API, which players signed up with our code and how much they have wagered. When you link your YEET account for the Shop, we match your YEET username against that list, and we send your Shop payouts to that YEET account as a tip. We do not send YEET your name, email address or FluxPlays account details.

We do not sell personal data, and we do not share your account details with the casinos or game providers featured on this site.

10. Transfers outside the EEA

Our database is hosted in the European Union. Some providers, including Google, may process data outside the European Economic Area under Standard Contractual Clauses or equivalent safeguards.

11. Your rights

You have the right to:

• Access the personal data we hold about you.
• Request correction of anything inaccurate.
• Delete your account and your personal data. You can do this yourself in account settings at any time.
• Receive a copy of your data in a portable format.
• Object to, or ask us to restrict, processing based on legitimate interest.
• Withdraw consent for analytics or marketing at any time.
• Complain to your local data protection authority.

If your account has been suspended you can still ask us to delete your data. Email business@fluxplays.com and we will action it. We respond to data requests within 30 days.

12. Automated decisions

We do not make decisions about you by automated means alone. Our fraud checks only surface information for a person to review, and any consequence follows a human decision.

13. Age

FluxPlays is for adults aged 18 and over, and accounts are limited to adults. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will remove it.

14. Changes and contact

We may update this policy when our practices change. The date at the top shows the most recent revision, and we keep a record of which version you agreed to when you created your account. Data questions can be sent to business@fluxplays.com.