Privacy Policy

• Account details you give us: name, email, phone number, username, and a password (stored only as a salted scrypt hash — never in plain text).
• Play data: the bets you place, rounds you join, and your coin and House Token ledgers.
• Wallet data: deposit/withdrawal requests, the blockchain addresses and transaction hashes you submit, and any proof screenshot you upload.
• Technical data needed to run the service securely: your IP address and basic request metadata, used for rate-limiting and abuse prevention.

• to create and secure your account and verify your email;
• to accept bets, settle rounds, and keep your balances correct;
• to process deposits and withdrawals and meet legal or anti-fraud obligations;
• to send transactional email (verification, password reset, settlement and wallet decisions); and
• to detect, prevent, and investigate abuse, fraud, and security incidents.

We process your data to perform our contract with you (running your account and the game), to meet legal obligations (such as record-keeping for real-money transactions), and for our legitimate interest in keeping the service secure and free of abuse. Where the law requires consent — for example non-essential communications — we ask for it and you can withdraw it.

We do not sell your personal data. We share it only with:

• service providers that run the product on our behalf (database hosting and email delivery), under contract and only as needed;
• the public blockchain — deposit and withdrawal transactions are, by nature, recorded on-chain and are outside our control; and
• authorities where we are legally required to, or to protect our rights, users, or the public.

Note: your username is public on the boards and leaderboard. Your name, email, and phone are not.

We keep account and transaction records for as long as your account is open and for as long afterwards as we need to meet legal, accounting, and anti-fraud obligations. Single-use email tokens expire quickly (verification links in 24 hours, reset links in one hour) and are then purged automatically.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can update your profile in your account, and you can exercise the rest by emailing support@bombaybaazi.xyz. Some data must be retained even after account closure where the law requires it.

Passwords are hashed with scrypt and never stored or logged in the clear; sessions use signed, HttpOnly cookies; a password reset invalidates every existing session. No system is perfectly secure, so please use a strong, unique password and tell us at once if something looks wrong.

Questions about privacy, or a request about your data? Email support@bombaybaazi.xyz. We will respond within a reasonable time. This policy may change; the “last updated” date above always reflects the current version of Bombay Baazi’s policy.