---
title: "Privacy: what gambatracker records and keeps · gambatracker"
description: "What gambatracker records about its visitors, accounts, newsletter and reviews, every cookie and storage key, how long each is kept, and how to export or…"
url: https://gambatracker.com/privacy
rendered: 2026-11-11T12:33Z
---

# Privacy

What this site records about the people who use it, why, for how long, and how to see, export or delete it. Written from the code that runs the site, in plain words.

Last updated 4 November 2026.

## Who we are

gambatracker (gambatracker.com) is an independent analytics site for crypto casinos and CS2 case sites. It is run under the gambatracker name; the person responsible for what this page describes answers at [privacy@gambatracker.com](mailto:privacy@gambatracker.com). The short version: we sell no data, run no advertising network, load no third-party analytics, and most of the site works without storing anything about you at all. The rest of this page lists the exceptions.

## Site analytics

To see which pages people read and how they find the site, each page sends a small report to our own server: the path without its query string, the name of the website you came from on your first page (such as google.com), the `utm_` tags of the link you followed, and the names of a few buttons when you press them (search, chat, copy code, subscribe, follow). The server adds the country Cloudflare reports and the kind of device, browser and operating system read from your browser's user agent. No third party sees any of it: there is no analytics script from anyone else, and the beacon stores nothing on your device.

Visits are counted with a number made from your IP address and your browser's user agent, mixed with a random value that changes at midnight UTC and is deleted within two days. The IP address itself is never stored, and the same browser gets a different number the next day, so a visitor cannot be followed from one day to the next or recognised later. A session is a random number that our server keeps in memory and forgets after 30 minutes without an event. The individual reports are kept for 90 days; after that only daily totals remain (page views, visitors, sessions, and the day's most common pages, referrers, countries, devices and browsers).

Nothing is sent when your browser asks sites not to track it (Global Privacy Control or Do Not Track), when it is driven by automation, or when it belongs to the people who run the site. The server ignores crawlers and other bots, and we can switch collection off entirely.

Clicks on partner links go through `/go/<casino>` on this site, which redirects to the casino with our referral code. The redirect writes one line: the casino, the game if you came from a game page, the time, the page you came from, the country Cloudflare attaches to the request, the kind of device, browser and operating system, and the day's visitor number described above. The visitor number is cleared from those lines after 90 days; the counts themselves are kept so we know which agreements pay for the servers. We do not pass any identifier to the casino. The [affiliate disclosure](https://gambatracker.com/affiliate-disclosure) says which links these are.

## Accounts

An account is optional; every public page is the same with or without one. You sign in with Discord, Google or a link we email you; there is no password. What we store:

- **Your profile:** a display name, an avatar URL if the provider gave one, the email address alerts go to, your alert settings (daily cap, email alerts on or off) and when the account was created.
- **Each sign-in method:** the provider, its stable user id for you, the email and name it reported, and when the method was added and last used. From Discord we ask for your identity and email; from Google for your name, email and picture.
- **Sessions:** a hash of the session token (never the token itself), how you signed in, your browser's user agent, and when the session was created, last seen and will expire. You can see and end every session on your account page.
- **Email sign-in links:** the hash of the single-use token, the address it was sent to, and a keyed hash of your IP address to limit how often links can be requested. The link works once, within 15 minutes, and the record is deleted after two days.
- **Sign-ins in progress with Discord or Google:** a hash of the state and the PKCE values, for ten minutes.

Your account page has a **Download** button that gives you everything above plus your watchlist, alert rules, push devices and alert history as one JSON file, and a **Delete account** button that removes the account at once: sign-in methods, sessions, watchlist, alert rules, push subscriptions, alert history, unused sign-in links to your addresses, and the reviews you wrote while signed in. Both are on [/account](https://gambatracker.com/account).

## Watchlists and alerts

Following a casino, player, game, provider or streamer stores that choice on your account, with the name as you saw it. Nothing you follow is public. Alert rules store what you want to hear about, the thresholds you set, and the channels: push, email or Discord DM.

- **Push:** the subscription your browser's push service hands us (its URL and the two keys that encrypt messages to it), your browser's user agent, and when it last accepted a message. Alerts are sent through that push service, which is run by your browser's maker.
- **Email:** alerts go to a verified address of one of your sign-in methods, through Resend. If an address bounces or marks us as spam, email alerts stop until you change it.
- **Discord DM:** connecting it asks Discord for your identity and permission to add you to our server, and we store your Discord user id and the DM channel once it opens. You can disconnect it on your account page.

Every alert we send or hold for a digest is kept in your alert history (title, text, link and each channel's outcome) so you can see what went out. The history is part of your export and goes with the account when you delete it.

## Newsletter

The monthly report by email is double opt-in: nothing is sent until you open the confirmation link, which is valid for seven days. We keep your address, when you confirmed, where you signed up (the newsletter page or a report), and the hash of the confirmation token. No IP address is stored with a subscription. Emails are sent through Resend; open and click tracking are off, and there are no tracking pixels.

Every issue carries a one-click unsubscribe link and the standard `List-Unsubscribe` header, so your mail client can do it too. Unsubscribing marks the row as unsubscribed with the time and the way it happened; write to us if you would rather have it deleted. The [newsletter page](https://gambatracker.com/newsletter) has the same in one list.

## Reviews and reports

A review stores the stars, title, text, pros and cons, the month you started playing, and the name you chose to sign it with, along with a keyed hash of your network address (never the address itself). A review written while signed in is tied to your account; a guest review is tied to an edit key that stays in your browser, of which we keep only the hash. Every review is read by a moderator before it shows, and the moderators can redact or reject it; the hash of its text is kept to spot duplicates.

Helpful votes and reports are stored against your account or the same network hash, so each can be made once. Submits, votes and reports are also written to a rate-limit log that is swept after two days. Authors the moderators ban are stored as the account or the network hash.

Guest review forms use Cloudflare Turnstile to tell people from scripts. Its script loads from challenges.cloudflare.com only when a guest opens the form, never on a plain page view, and runs under Cloudflare's own privacy terms. Signed-in users do not see it.

"Demo not working?" reports on game pages store the game, the reason you picked and a keyed hash of your network address, so one network can report each game once and at most ten times an hour.

## Cookies and local storage

Browsing the site sets no cookie. The ones below exist only once you sign in or run the site's admin console. There are no advertising cookies and no third-party analytics cookies.

| Cookie | Set | Lifetime | Purpose |
| --- | --- | --- | --- |
| `__Host-gt_session` | when you sign in | 180 days | A random session token, read only by our server (HttpOnly). The session behind it ends after 30 days without a visit or 180 days after sign-in, whichever is first. |
| `gt_auth` | when you sign in | 180 days | The value 1, so the header can show your account link on pages that are cached and identical for everyone. Carries nothing secret. |
| `__Host-gt_oauth` | while you sign in with Discord or Google | 10 minutes | The state of the sign-in in progress, so the answer from the provider can only land in the browser that started it. |
| `gt_staff` | only by our own admin console | 1 year | Marks the browsers of the people who run the site so their visits are left out of the analytics. A visitor's browser never gets it. |

Signing out clears the first two. Some preferences stay in your browser's own storage and never leave it; clearing site data in the browser removes them:

| Key | Where | What it holds |
| --- | --- | --- |
| `gt.chat` | localStorage | Whether the global chat panel is open, which side it docks on and which sites you picked. |
| `gt.promos` | localStorage | Which partner card you hid, and until when (30 days). |
| `gt.demo18` | localStorage | That you confirmed you are 18 or older before a studio demo, so the question is not asked again in this browser. |
| `gt_review_key:<site>` | localStorage | The edit key of a review you wrote as a guest, so this browser can edit it later. Our server keeps only its hash. |
| `gt_review_votes:<site>` | localStorage | Which reviews you marked helpful, so the button stays pressed. The vote itself is counted on the server. |
| `gt.demoReported:<game>` | sessionStorage | That you already reported a broken demo for this game in this tab. |

## Third parties

- **Cloudflare** sits in front of the site as its CDN and proxy, so every request passes through it; it tells our server which country a request comes from, and it runs the Turnstile check on guest review forms.
- **Resend** delivers our email: sign-in links, newsletter confirmations and issues, and email alerts.
- **Discord and Google** handle sign-in if you choose them; what they tell us is listed under accounts. Your browser's **push service** carries push alerts.
- **Game studios** provide the demo games on game pages. A demo loads in a frame from the studio's own site only after you press Play demo and confirm you are an adult; the frame names the studio's domain, and the studio may set its own cookies inside it under its own terms. Some studios open the demo on their own site in a new tab instead.
- **Casinos and case sites** you follow a Visit button to receive the referral code described above and nothing else about you. Their pages are theirs.

The fonts and scripts the site itself uses are served from our own domain; the only script from anyone else is Turnstile, under the conditions above.

## Public data about players

Bets, wins and chat lines on this site come from the casinos' own public feeds and public chat rooms, and are shown as the casino published them: the username as displayed there, the game, the stake, the payout and the time. Where a casino masks names, we show the mask. Raw sampled bets are kept 90 days; notable bets (big wins, records) and the per-player totals behind the leaderboards are kept longer. Published chat lines are kept for six hours and never read by user.

If your username appears in a casino's public feed and you do not want it on this site, write to [privacy@gambatracker.com](mailto:privacy@gambatracker.com) with the casino and the name. We add it to the opt-out list within a day: your player page is removed and every feed and leaderboard shows you as *Hidden*. The opt-out list holds the casino and the name, which is what it needs to work. Switching on the casino's own "hide my name" setting does the same at the source for future bets. The [responsible gambling page](https://gambatracker.com/responsible-gambling#opt-out) says the same.

## How long we keep things

- Analytics reports and partner-click visitor numbers: 90 days; daily totals after that. The daily salt behind visitor numbers: deleted within two days.
- Sessions: until they expire (30 days idle, 180 days at most) or you end them. Sign-in links: two days. Sign-ins in progress: ten minutes.
- Account, watchlist, alert rules, push subscriptions and alert history: until you delete the account.
- Newsletter subscription: until you unsubscribe (the row then records that) or ask us to delete it.
- Reviews: while they are published or in the queue; a rejected review stays in the moderation record. The review rate-limit log: two days.
- Public bet data: raw bets 90 days; notable bets and leaderboard totals longer; chat lines six hours.

## Your rights

Depending on where you live you have rights over data about you, including under the GDPR and the UK GDPR: to know what we hold, to get a copy, to have it corrected or deleted, to object to or restrict its use, and to complain to your data protection authority. For an account, the export and delete buttons on [/account](https://gambatracker.com/account) do this at once and without asking us. For anything else, including a newsletter address, a review, or a casino username, write to [privacy@gambatracker.com](mailto:privacy@gambatracker.com); we answer within a month, usually much sooner. Analytics data cannot be tied back to a person, so there is nothing to look up there.

Our basis for what this page describes is your consent where we ask for it (newsletter, account, alerts, the demo gate) and our legitimate interest in running, securing and funding the site for the rest (analytics without identifiers, abuse limits, partner-click counts, and showing what casinos already publish).

## Children

This site is for people aged 18 or over, or the legal gambling age where they live if that is higher. We do not knowingly collect anything from anyone younger; if you believe we have, write to us and we will delete it.

## Changes to this page

When the site starts recording something new, or stops, this page changes with it and the date at the top moves. The page is written from the code that runs the site, so it is updated alongside it rather than once a year.

## Contact

Privacy questions, requests and opt-outs: [privacy@gambatracker.com](mailto:privacy@gambatracker.com). Everything else: [hello@gambatracker.com](mailto:hello@gambatracker.com).

How these figures are produced and labelled: https://gambatracker.com/llms.txt