Privacy Policy

1. Site Analytics

As you move around the site, we record first-party analytics events so we can see what people read and search for. For each event we may store:

• Page views: the path you viewed, the page type (casino, region, editorial, and so on), and the casino if you viewed a listing
• Searches: the search terms you type and how many results came back, plus which result you clicked
• Engagement: how far you scroll a page and how long you stay on it
• Impressions: which casino cards appeared on the pages you viewed
• Approximate location: country, region, and city inferred from your IP address by our host. We do not store the IP itself in these records, only a salted SHA-256 hash of it.
• Device & browser: device type, operating system, and browser, derived from your user agent (e.g. “mobile”, “iOS”, “Safari”)
• Referrer & campaign: the domain that sent you and any UTM parameters on the link
• Session and visitor IDs: random identifiers stored in the ca_sid and ca_vid cookies, used to group events from one visit and count returning visitors. The identifiers themselves are random values, not derived from anything about you.
• Your account, if you are signed in: page views, searches, and clicks recorded while you are logged in carry your account ID, so these records are linked to you rather than only to a session.

Traffic we identify as automated (bots, crawlers, link unfurlers, uptime monitors) is dropped and never recorded. Admin traffic is never recorded either. If you have declined tracking, none of the events above are written at all (see section 9).

2. Outbound Click Tracking

When you click an outbound casino link (the casino's website, a hotel booking, a sportsbook, and so on), we log:

• Timestamp: when the click occurred (UTC)
• Hashed IP address: a salted SHA-256 hash applied before storage. We do not keep the original address on the record.
• Device, browser, and country: derived from your user agent and IP. We also store the raw user-agent string on click records.
• Click type and destination: the category of link clicked and the URL we forwarded you to
• Referrer and campaign: the page you came from and any UTM parameters
• Session ID: the ca_sid cookie, used to deduplicate clicks so a single visit is not billed twice
• Your account, if you are signed in: clicks recorded by the on-page tracker carry your account ID

Click tracking does not collect your name, email, address, or payment information. What a partner casino can see of this is described in section 10; it is not the raw record above.

3. Accounts & Your Hub

Creating an account is optional. If you sign up, we store the information needed to run your account and the personal records you choose to add:

• Account basics: email, username, and a bcrypt hash of your password (we never store the password itself). If you sign in with Google or a magic link, that is handled through Supabase and linked to your account by email.
• Profile: your name, your date of birth, an optional phone number, and an optional answer to “how did you hear about us?”. We also record the IP address you signed up from and the one you last used; these raw addresses are automatically deleted after 90 days (the one you last used is kept while your account stays active), and only the security records described below keep raw IP addresses longer.
• Hub content: anything you save to your personal hub, including visited and wishlisted casinos, trip logs, gambling sessions and win/loss figures, your chip collection, your players cards, saved promo codes, and tax documents you upload.
• Identity verification: if you present a players card at a participating casino desk and staff check your ID, we record that you were verified, the name on the ID, and which casino verified it.

Your hub content is not shown to other users. Reviews you post are the exception: they appear publicly on the casino's profile (see section 5). Certain details can reach a casino operator, but only through the settings described in section 10, and only when you turn them on.

4. Organization & Partner Accounts

Casino operators access the platform through organization accounts. For team members we store name, email, job title, sign-in username, a bcrypt password hash, role and permissions, and multi-factor authentication settings, along with a record of their activity in the portal. For the organization itself we store the contact details it gives us, plus its contracts, invoices, promotions, and promo-code redemptions. This information is used to operate the partner program and to bill for referrals. It is not sold or used for unrelated marketing.

5. User-Submitted Information

If you submit content through any of the following features, we store the information you provide:

• Suggest or Claim a Casino: casino name and address, optional photos, and the contact details (name, email, phone, message) you provide. Suggestions are reviewed before a listing is added; claim contact details are used only to verify the claim and are not shown publicly.
• Report an Issue / Flag: the casino in question, the field flagged, and any description you include. Used to investigate and correct inaccurate data.
• Reviews: your written review and star rating, displayed publicly on the casino's profile.
• Promo-code redemptions: when an operator redeems a code you saved, we record the redemption to calculate billing. We do not publish which codes you saved.

6. Geolocation & Location Search

The “Near Me” feature may ask for your device's location through your browser's standard prompt. If you allow it, your coordinates are used only within your browser to sort casino listings by distance; they are never sent to our servers and are discarded when you leave or refresh the page. Declining the prompt affects nothing else on the site.

Typing a place into the location box is different: that text is sent to our server, which looks it up with Nominatim, the OpenStreetMap Foundation's geocoding service. We make that request from our server rather than your browser, so your IP address is not disclosed to them; the search text itself is.

7. Cookies

If you sign in with Google or a magic link, Supabase sets its own authentication cookies. Organization and admin sessions use their own short-lived cookies, set only after you log into those areas. We do not use advertising cookies, tracking pixels, or Google Analytics.

8. Why We Collect It

• To understand which pages, casinos, and searches people use, so we can improve the directory
• To measure which listings attract traffic, report it to partner casinos who pay for referrals, and bill them accurately
• To detect and filter bot traffic, repeated clicks, and abuse
• To run accounts, the personal hub, and the operator/partner program
• To process casino suggestions, flags, claims, reviews, and promo-code redemptions
• To send you email you asked for, and to keep the site secure and functioning

Security is the one place we keep real IP addresses rather than hashes. Sign-in attempts, blocked addresses, and requests that probe the site for vulnerabilities are logged with the IP they came from, because an attacker's address is the whole point of the record. These logs are not analytics, are not shared with partners, and are not used to build any profile of you.

9. Your Tracking Choices

A banner asks every visitor whether to accept cookies. Your answer is stored in the ca_consent cookie and we treat the three states differently:

• Declined: we record nothing. Not just “no cookies”: no page view, no search, no click record, anywhere in the world. You can still use the entire site.
• Accepted: we record the events described in sections 1 and 2.
• Not yet answered: we record those events, except for visitors in the EU/EEA, the UK, and Switzerland, where we wait for an explicit acceptance first.

Global Privacy Control: if your browser or an extension sends a GPC signal, we treat it as a decline and record nothing, regardless of where you are or what the banner says. We also treat it as a “do not sell or share” request (see section 10), and we never load the third-party performance scripts named in section 14.

10. Selling or Sharing, and What Partners See

Partner casinos pay us (per click, plus monthly fees and per-redemption or per-visit fees). Some of what they get back is information about you. California law calls that a “sale or share” whether or not money changes hands for your data specifically, so we treat it as one rather than claim an exemption we would not qualify for. Concretely:

• By default, a partner sees pseudonymous rows. For casinos you saved or visited, they see a per-casino pseudonym (“Visitor #4f2a...”) with no name, no email, and no card number, alongside coarse detail: whether you wishlisted or visited, whether you said you would return, whether you told us in a visit survey that you hold their card, a win/loss bucket rather than an amount, your visit count, and the month you last visited. The pseudonym is a keyed hash that differs for every casino, so a partner cannot follow you across casinos or reverse it back to you.
• Personalized offers (off by default): if you turn this on, partners for casinos you saved or visited additionally see your name and email, with your visit count and whether you would return. This setting also lets an operator running a players-card program see your card's number, tier, and points balance, and lets a linked account's name and email fill in their own player roster.
• Card sharing (off by default): if you turn this on, a casino you gave a card number for also sees that players-card number next to your name and email.
• Traffic exports: a partner can download their own casino's click log for a month. It is per-click, not aggregated, and it carries the click type, destination, billable flag, referring domain, country, device, OS, browser, campaign parameters, the date, and the time to the minute. The session is a per-casino keyed hash, not the raw cookie, so they can spot a repeat visitor within their own casino but cannot correlate one across casinos or back to you. Hashed IPs and account IDs are never included.

Two honest limits. If a member of an operator's staff types your details into their own player roster at the desk, that record is theirs, and it stays visible to them regardless of your settings here; we simply stop filling in the blanks from your account. And we cannot claw back what a casino received before you changed a setting: they hold their own records.

Everything else stays with us. We do not sell or share your data with data brokers, advertisers, or anyone else. Our own staff can see full account detail; that is us, not a third party, so it is not a sale.

To close both settings in one click, with or without an account, use Do Not Sell or Share My Personal Information. To set them individually, see Offers & Privacy in your hub profile.

11. How Long We Keep It

• Raw analytics (page views, searches, impressions): deleted automatically after 13 months.
• Outbound click records: kept indefinitely. They are the financial record behind a partner's invoice, so they are deliberately not covered by the 13-month analytics deletion.
• Aggregated statistics (for example, “Casino X received 1,200 clicks in March”): kept indefinitely. They describe a casino, not a person.
• Account and hub data: kept until you delete your account. Deleting it removes your saves, visits, sessions, chips, players cards, saved promo codes, and tax documents (including the uploaded files), and scrubs your name, email, username, phone, date of birth, IP addresses, verified identity details, and security credentials from your account record. Section 12 explains what survives and why.
• Reviews: kept after account deletion, with the link to you removed, so they read as anonymous. The casino's rating history is content other visitors rely on. We may also remove any submitted content at our discretion.

12. Your Rights & How to Use Them

We are a small operation with no revenue, below every threshold that would make California's privacy law (Civ. Code 1798.140(d)) apply to us. We offer these rights early anyway, because they are cheap to build now and expensive to retrofit. Here is what actually works today:

• Know and access: download everything we hold against your account as JSON, from Your Data in your hub profile. It includes what you typed in and what we observed (your page views, searches, and outbound clicks), capped at the most recent 5,000 rows per category. It excludes internal-only values such as password hashes, MFA secrets, and hashed IPs, and never contains another person's data.
• Delete: delete your account yourself from the same page. You confirm with your password, or, if you only ever signed in with Google or a magic link, with a code emailed to you.
• Correct: edit your profile and hub content directly in the hub. For anything you cannot reach, email us.
• Opt out of sale/share: /do-not-sell, no account required, or send a Global Privacy Control signal.
• No retaliation: we do not charge you differently, degrade the site, or withhold features because you opted out or exercised any right above.

One thing deletion deliberately does not do: if your email, phone, or IP has been banned from the site, that ban survives. Otherwise deleting an account would be a one-click way to clear it and sign straight back up.

If you have no account and want data we hold about a session removed, email us with your ca_sidcookie value (found in your browser's dev tools under Cookies) or a description of what you submitted, and we will locate the relevant records.

13. Children

Gambler's Atlas is intended for adults: our Terms require you to be 21 or older, or of the legal gambling age where you are. We ask for a date of birth at signup, but we check only that it is a real, plausible date. We do not verify your age, and you should not read anything on this site as an age check. We do not knowingly collect personal information from children. If you believe a child has given us personal information, email us and we will delete the account and its data.

14. Third-Party Services

• Supabase: our database, file storage, and OAuth/magic-link authentication provider. Your account data, uploaded photos, and tax documents live there.
• Vercel: our hosting provider. Request logs may be retained per Vercel's policies, and Vercel supplies the approximate country/region/city we record. We also load Vercel Analytics and Speed Insights for aggregate performance metrics, but only if you have explicitly accepted cookies and are not sending a Global Privacy Control signal.
• CARTO and the OpenStreetMap Foundation: our interactive map is built on MapLibre and loads CARTO's basemap tiles, which are made from OpenStreetMap data. Your browser requests those tiles directly, so CARTO receives your IP address and the map area you are looking at.
• Nominatim (OpenStreetMap Foundation): geocodes the place names you type into the location box. We send the query from our server, so they receive the text but not your IP (see section 6).
• Typesense: powers site search. Search queries are sent from our server, not your browser.
• Stripe: processes payments for partner and organization billing. We do not store payment card data; Stripe handles it under their privacy policy. Stripe is not involved unless you are an operator paying an invoice.
• Cloudflare Turnstile: detects automated submissions on login, signup, and our public submission forms (reviews, flags, casino suggestions and claims, feedback), and may process your IP and browser attributes per Cloudflare's privacy policy.
• Resend: sends our email. They receive your address and the message.
• Upstash: provides the rate-limiting layer that protects our forms and APIs. Identifiers are hashed with a secret salt before they leave our servers, so Upstash never receives a raw IP or email address.
• Anthropic: powers admin-only drafting of casino and region descriptions. No visitor personal data is sent: the prompts contain casino facts only.
• Sentry: collects error diagnostics so we can fix bugs. We strip personal data out of every event before it is sent: email addresses, tokens, password hashes, cookies, request bodies, and query strings are redacted, and only your internal account ID is attached.

15. Changes to This Policy

We update this policy when what the site does changes, and the “Last updated” date at the top always reflects the current version. If a change materially expands what we collect or who receives it, we will say so here rather than let the date carry the news on its own. Your continued use after a change means you accept the updated policy. We do not keep a public archive of previous versions; if you need one, email us.

16. Contact

Privacy questions, or to exercise any right in section 12: jacobmedici@fake.mailTap to Reveal Copied to Clipboard
Email is the only channel we operate. See also: Do Not Sell or Share and Affiliate Disclosure