Legal

Privacy Policy

Draft — pending legal review. This document is a working draft prepared without legal counsel. Before public launch it must be reviewed against GDPR (EU/UK), local data-protection law, and any gambling-advertising regulations that apply to your jurisdiction.

Last updated: 2026-05-27

1. Who we are

SlotShare is operated by [legal entity name and address to be confirmed]. We are the data controller for the personal data described below.

2. What we collect

  • Account data: email address, chosen username, optional avatar URL, two-letter country code, and a timestamp confirming you declared yourself to be 18+.
  • Authentication metadata: sign-in events, approximate IP-based location, and OAuth provider identifiers (Google, Discord) when used. This is stored by our authentication provider (Supabase).
  • Room activity: when you join or leave a room, your role (host or guest), and your device type (desktop or mobile).
  • Affiliate clicks: when you click an outbound casino link, we record the casino, your user ID (or anonymous if signed out), an optional room reference, and a hashed version of your IP address. We never store raw IP addresses.
  • Reports: reports you submit about other users or rooms include the report text, your user ID, and optionally the targeted user or room.
  • Rate-limit telemetry: per-user request counts within short windows for abuse prevention.

We do not store voice audio or screen-share video. These are relayed in real time through LiveKit and discarded once the session ends.

3. How we use it

  • Operate accounts, rooms, and access controls.
  • Enforce age and regional restrictions.
  • Track which casino each affiliate click was directed to, so the casino can attribute it to SlotShare for commission.
  • Investigate and respond to reports of abuse.
  • Detect and prevent fraud, spam, and service abuse.
  • Improve the service via anonymous, aggregated metrics.

4. Legal bases (GDPR)

For EU/UK users, we rely on the following legal bases under GDPR / UK GDPR:

  • Contract: account, room, and core service data — needed to deliver the service you signed up for.
  • Legitimate interests: affiliate-click logs, rate-limit logs, and abuse-prevention data.
  • Consent: analytics cookies, where applicable (you can withdraw this at any time via the cookie banner).
  • Legal obligation: retention of certain records for tax, accounting, or compliance reasons.

5. Third parties

We share data with the following processors:

  • Supabase — authentication, database, and hosting of stored data.
  • LiveKit (self-hosted, Hetzner) — real-time voice and screen-share relay. We host the server ourselves; no third-party voice/video provider is involved.
  • Sentry — error and performance monitoring. Sentry receives stack traces and minimal request context when errors occur.
  • Vercel — application hosting and edge delivery.
  • Casino partners — when you click an outbound link, your browser provides the casino with the same standard information any browser sends to any site (IP, user-agent, referrer). We do not transmit additional personal data to casinos.

6. International transfers

Some of our processors are headquartered outside the EU/UK. Where required, transfers rely on Standard Contractual Clauses or equivalent safeguards.

7. Retention

Account data is retained for as long as your account is active. Affiliate-click rows are retained for [retention period TBD] for commission reconciliation. Rate-limit logs are trimmed after 24 hours. Reports are retained for [retention period TBD] for investigation.

8. Your rights

If you are in the EU, UK, or another jurisdiction with similar protections, you may:

  • request a copy of your data;
  • ask us to correct or delete it;
  • object to or restrict processing;
  • withdraw consent to analytics cookies;
  • lodge a complaint with your supervisory authority.

Contact [privacy contact to be confirmed] to exercise any of these rights.

9. Cookies

We use essential cookies to keep you signed in. Analytics cookies are used only if you accept them via the consent banner. Core features work without analytics consent.

10. Children

SlotShare is for adults (18+ or the legal gambling age in your jurisdiction, whichever is higher). We do not knowingly collect data from minors. If you believe a minor has provided us with data, contact us and we will delete it.

11. Changes

We may update this policy. Material changes will be announced via the service.

12. Contact

Privacy questions: [privacy email to be confirmed].