1. Who we are
CryptoCasinos.help (“we”, “us”, “our”) is an independent information website about crypto casinos. We are not a casino. We don’t take bets, hold funds or process payments. This policy explains how we handle personal data when you visit cryptocasinos.help or contact us.
We are the “controller” of your personal data under the EU General Data Protection Regulation (GDPR) and the UK GDPR.
For any privacy question, email hi@cryptocasinos.help. We have not appointed a data protection officer, because the law does not require one for a site of our size and type. Your message goes directly to the people who run the site.
2. What we collect, and what we don’t
We don’t collect
- Names, phone numbers or postal addresses. There is no sign-up, login or user account. The report form doesn’t ask for your name.
- Payment details or crypto wallet addresses. You can’t pay us anything on this site.
- Anything you type into the site search. Search runs entirely in your browser and the query is never sent to us.
- Public comments, reviews or ratings from users. Nothing you send through the report form is published automatically.
We do process
| Data | When | Why |
|---|---|---|
| Technical request data: IP address, browser user-agent, requested page, time, referring page | Every visit. Our hosting provider receives it automatically, as with any website. | To deliver pages, keep the site secure and stop abuse. |
| Your country, worked out from your IP address | Every visit, through a small lookup at /api/geo | To show the legal notice and minimum age for your country, and to hide links to casinos that exclude your country. We get back a two-letter country code only. The IP address isn’t stored or logged by us. |
| Analytics data (see section 3) | Only after you accept analytics cookies | To understand which pages are useful and fix what isn’t. |
| Reports you send through the report form: what happened, the casino, amounts, dates, transaction hashes, any files you attach, your email if you give one, and your choices on the consent boxes. With it we store your approximate country and, for 24 hours only, a scrambled (keyed-hash) version of your IP address. | When you send a report | To investigate scams, unpaid withdrawals and mistakes on our site, contact you if you left an email, and, with your permission, the casino. The scrambled IP is only used to limit spam (a few reports per hour from the same network) and is deleted after 24 hours. |
| Anti-spam check (Cloudflare Turnstile) on the report form | When you open the report form | To tell people from bots without a puzzle. Cloudflare looks at technical signals from your browser and connection, such as your IP address and browser characteristics, under its own Turnstile privacy policy. |
| Emails you send us: your address, the message and any attachments | When you write to us, for example with a scam report, a correction or a right-of-reply request | To answer you, check the facts and, for scam reports, investigate. We never publish your name or email without your permission. |
Please don’t send us more than we need. Never send passwords, seed phrases or private keys. We will never ask for them. If you send screenshots, blur your username and wallet addresses unless they are needed as evidence.
3. Google Analytics 4
We use Google Analytics 4 (GA4) to measure how the site is used: which pages are read, how people arrive (for example from a search engine), and roughly which countries and devices our visitors use. It helps us decide what to write and what to fix.
- Off until you agree. The Google Analytics script is not loaded until you click “Accept” on the cookie banner. If you click “Reject” or ignore the banner, no analytics script runs and no analytics cookies are set.
- What Google receives when it is on: a random identifier stored in a cookie, the pages you view and how long you stay, the referring site, your device type, operating system, browser and screen size, your language, and your approximate location (city/region level). Google works out the location from your IP address. According to Google, GA4 doesn’t log or store IP addresses.
- No advertising features. We don’t enable Google Signals, remarketing, advertising reporting or ads personalisation, and we don’t link GA4 to Google Ads.
- Retention. We keep user-level analytics data for 14 months, the shortest practical setting that still lets us compare a year with the year before. Aggregated reports (for example “page views in March”) don’t identify anyone and may be kept longer.
- Who Google is. For visitors in the EEA, the UK and Switzerland, the service is provided by Google Ireland Limited. Elsewhere it is provided by Google LLC (USA). Google acts as our processor under its data processing terms. You can read Google’s privacy policy and how Google uses data from sites that use its services.
- Opting out. Use the link (also in the footer), clear this site’s cookies, or install Google’s opt-out browser add-on. We also don’t load analytics if your browser sends a Global Privacy Control signal.
4. Google Search Console
We use Google Search Console to see how the site appears in Google Search: which search terms show our pages, how often people click, and any technical problems Google finds. Search Console doesn’t place any code or cookies on this site and doesn’t collect anything from you when you visit. Google gives us aggregated figures only, such as “this page was shown 1,200 times for ‘rollbit review’”. It never tells us who searched. Google collects search data under its own privacy policy when you use Google Search.
We may use similar webmaster tools from other search engines, such as Bing Webmaster Tools, in the same way.
5. Cookies & local storage
Cookies and browser storage are small pieces of data saved on your device. Here is everything this site stores:
| Name | Type | Purpose | Expires | Needs consent? |
|---|---|---|---|---|
cc_consent | Local storage | Remembers whether you accepted or rejected analytics | 12 months | No (strictly necessary) |
cc_theme | Local storage | Remembers whether you switched the lights off (dark mode) | Until you clear it | No (strictly necessary) |
cc_country | Session storage | Remembers your country code so we don’t look it up on every page | When you close the tab | No (strictly necessary) |
cc_geo_dismissed | Session storage | Remembers that you closed the country notice | When you close the tab | No (strictly necessary) |
cc_compare | Session storage | Holds the casinos you picked to compare | When you close the tab | No (strictly necessary) |
_ga | Cookie (Google Analytics) | Distinguishes visitors with a random ID | 2 years | Yes |
_ga_<ID> | Cookie (Google Analytics) | Keeps track of your current visit (session) | 2 years | Yes |
The site’s fonts are hosted on our own server, so loading a page doesn’t contact any font service. Casino websites you visit through our links set their own cookies. See section 7.
6. Our legal bases (GDPR / UK GDPR)
- Consent (Article 6(1)(a)): Google Analytics. You can withdraw consent at any time, and doing so doesn’t affect processing that happened before.
- Legitimate interests (Article 6(1)(f)):
- Delivering and securing the site (server logs).
- Showing country-specific legal and age information, and hiding links to casinos that exclude your country. This also protects you.
- Replying to and investigating emails and reports you send us, and protecting the report form from spam.
- Legal obligation (Article 6(1)(c)): keeping records when the law requires it, or answering lawful requests from authorities.
Storage on your device that is strictly necessary for a feature you asked for doesn’t need consent under the ePrivacy rules (for example the UK PECR). Analytics cookies do, which is why we ask.
7. Affiliate links and casino websites
Some “Visit” buttons are affiliate links. When you click one, you leave our site. The casino, or the affiliate network that manages its programme, usually records the click with a tracking parameter or cookie. That is how it knows you came from us and can pay us a commission if you sign up.
- That tracking happens on their websites, under their privacy policies. Read them before you sign up.
- Casinos and affiliate networks send us reports: usually numbers of clicks, sign-ups and deposits, sometimes with a pseudonymous player ID, and the commission due. We don’t receive your name, email, ID documents or wallet addresses, and we don’t try to identify you from these reports.
- Casinos collect a lot of personal data, including ID documents for KYC checks. Once you are on a casino site, we have no control over what it collects or how it protects it.
8. Who receives personal data
We don’t sell or rent personal data, and we don’t share it for advertising. The only recipients are:
- Our hosting and content-delivery provider, which serves the site and handles security (including the country lookup).
- Google, for Analytics, only if you consent.
- Our email provider, which stores the messages you send us.
- Cloudflare, which stores reports in a private database (Cloudflare D1, kept in the EU) and attached files in private storage (Cloudflare R2), and runs the Turnstile anti-spam check. Only our editorial team can open them, after signing in.
- A casino you report. We contact the casino about a complaint only with your agreement. We share only what is needed, such as a transaction hash and dates, not your contact details unless you ask us to.
- Professional advisers, such as lawyers, where needed to protect our rights.
- Authorities, if the law requires us to share data.
- A buyer, if the site is ever sold, on the condition that they keep to this policy.
Our providers process data only on our instructions, under written data processing terms.
9. International transfers
Some of our providers, including Google, may process data in the United States or other countries outside the EEA and UK. When they do, the transfer is protected in one of three ways:
- the EU–US Data Privacy Framework (and its UK Extension), where the provider is certified;
- the European Commission’s Standard Contractual Clauses;
- the UK International Data Transfer Addendum.
You can ask us for details of the safeguard that applies.
10. How long we keep data
| Data | How long |
|---|---|
| Server and security logs at our host | Usually a few days to 30 days, depending on the provider’s settings |
| Country lookup | Not stored by us. The code stays in your browser’s session storage until you close the tab. |
| Google Analytics user-level data | 14 months |
| Reports sent through the form, and their attached files | Up to 3 years after the case is closed, for the same reason as emails. Reports we mark as spam are deleted within 30 days. |
| Emails and attachments | Up to 3 years after the matter is closed, because scam reports and corrections can be challenged later. Earlier deletion is possible on request, unless we need the email to defend a published report. |
| Your cookie choice | 12 months, then we ask again |
11. Your rights
If you are in the EEA or the UK, and in many other places, you have the right to:
- Access: get a copy of the personal data we hold about you.
- Rectification: have inaccurate data corrected.
- Erasure: have your data deleted, unless we must keep it.
- Restriction: ask us to pause using it while a question is resolved.
- Objection: object to processing based on legitimate interests.
- Portability: receive data you gave us in a common format.
- Withdraw consent at any time, for example to analytics through .
We make no automated decisions about you that have legal or similarly significant effects. To use a right, email hi@cryptocasinos.help. We answer within one month. We may ask for information to confirm the request is really yours. Analytics data is linked to a random ID, not your name, so we usually can’t find “your” analytics data without that ID. Clearing your cookies or rejecting analytics removes the link on your side.
12. US state privacy rights
Residents of California and other US states with privacy laws (such as Virginia, Colorado, Connecticut and Texas) have the right to:
- know what personal information we collect;
- delete it;
- correct it;
- opt out of its “sale” or “sharing” for cross-context behavioural advertising.
We don’t sell personal information and don’t share it for cross-context behavioural advertising. We don’t use sensitive personal information to infer characteristics about you. We honour Global Privacy Control signals as an opt-out. We won’t treat you differently for using these rights.
Note that online casino gambling is illegal in most US states, and most casinos reviewed here exclude US players. See laws by country.
13. Children
This site is about gambling and is meant only for adults aged 18 or over, or older where the local legal gambling age is higher. It is not directed at children, and we don’t knowingly collect data from anyone under 18. If you think a child has sent us personal data, email us and we will delete it.
14. Security
The site is served only over HTTPS. It has no user accounts or passwords to steal. Reports from the form are kept in private storage that only our team can open, after signing in with two-factor protection. Uploaded files are never shown on the public site. We limit access to our email and analytics accounts to the people who need it, and protect those accounts with strong passwords and two-factor authentication. No system is perfectly secure. If a breach affects your data in a way the law requires us to report, we will notify the regulator and, where needed, you.
15. Changes to this policy
We update this policy when our practices or the law change. The “Last updated” date at the top always shows the current version, and the change history below lists every change. If we start collecting new kinds of data, for example a newsletter or user reviews, we will update this policy before that feature goes live, and ask for consent where the law requires it.
16. Contact & complaints
Email hi@cryptocasinos.help with any question or request. We reply within 5 working days, and complete formal requests within one month.
If you are unhappy with our answer, you can complain to a data protection authority. In the UK this is the Information Commissioner’s Office (ICO). In the EU it is the authority in the country where you live or work, or where you think the problem happened. They are listed on the European Data Protection Board’s website. We would appreciate the chance to fix the problem first.
Change history
| Date | Change |
|---|---|
| First version. | |
| Added the report form: what it collects, Cloudflare D1/R2 storage, Turnstile anti-spam, retention. | |
| Scrambled IP addresses from the report form are now deleted after 24 hours. |
Related: Terms & conditions · Disclaimer · Editorial policy · Responsible gambling