1. Information We Collect
When you log into the Casino Bot Dashboard or interact with the bot in Discord, we collect only the minimal data required for authentication, permissions, and server ledger accounting:
- Discord Account Information: Your Discord User ID, username, and avatar URL provided via Discord OAuth2 (
identifyandguildsscopes). - In-Server Economy Ledger: Virtual wallet and bank balances, shift work logs, casino simulation outcomes, and virtual shop fulfillment tickets.
- Security & Telemetry Logs: Timestamped records of macro verification attempts (CAPTCHA pass/fail) and moderation events to safeguard the server economy.
2. How We Use Data
We process collected information solely to:
- Verify your Discord role permissions when accessing administrative dashboard features.
- Maintain provably-fair simulation records and atomic ledger integrity.
- Deliver prize codes and fulfillment transcripts via private Discord ticket channels.
- We never sell, monetize, or rent user data to third-party advertisers or data brokers.
3. Cookies & Strict Tracking Script Gating
The dashboard uses an encrypted, HTTP-only session cookie (casino_session) to maintain your authenticated state across page requests.
We strictly block any analytics or tracking scripts from initializing until you explicitly grant consent through our cookie consent banner. No advertising pixels, Meta pixels, or cross-site tracking beacons are embedded.
For a full technical inventory of all cookies, local storage keys, and lifespans, read our dedicated Cookie Policy.
4. Data Encryption & Security Safeguards
All communications and stored credentials are protected by industry-standard encryption protocols:
- Encryption in Transit: Enforced HTTPS with TLS 1.3, modern cipher suites, and HTTP Strict Transport Security (HSTS) preloaded across all endpoints.
- Encryption at Rest: Database backups and sensitive system secrets (OAuth secrets, Discord bot tokens) are encrypted and isolated from public repositories.
- Session Protection: Session payloads are signed cryptographically with HMAC-SHA256 and verified using timing-safe comparisons to eliminate timing attack vectors.
5. Biometric Authentication & Device Security
Casino Bot supports WebAuthn and FIDO2 standards (such as Apple FaceID, TouchID, or Windows Hello) for optional enhanced staff authentication:
- Biometric authentication requires explicit, voluntary user consent prior to browser registration.
- Raw biometric templates and biometric scans are strictly processed inside the secure enclave of your personal device.
- Casino Bot servers never receive, transmit, or store biometric identifiers. Only public cryptographic challenge signatures are verified.
6. Artificial Intelligence Data Privacy
When using AI Commander or embed generators, prompt instructions are processed via secure API endpoints exclusively to generate the requested output. User chat histories, guild member rosters, and personal communications are never sold, retained for external model training, or fed into public generative training datasets.
7. Marketing Opt-Out & Unsubscribe Links
Users maintain full control over notification and marketing preferences:
- You may unsubscribe from non-critical server broadcasts at any time using our one-click unsubscribe endpoint at /api/unsubscribe.
- Essential transactional alerts (such as ticket confirmations and security verifications) are exempt from marketing opt-outs.
8. Data Retention & Deletion Rights
Virtual economy transactions and server logs are retained to maintain server audit histories and prevent double-spending. If you wish to request deletion of your recorded user data from our databases pursuant to GDPR or CCPA guidelines, submit a formal request to our contact email.
9. Contact Information
For privacy questions, data requests, or security concerns, reach out to the project maintainer at: