Privacy Policy

This Privacy Policy explains how BloxCash ("we", "us", or "our") collects, uses, shares, and protects information about you when you use https://bloxcash.com, together with its related pages, applications, APIs, and services (collectively, the "Website" or the "Services"). This Policy forms part of, and is incorporated by reference into, our Terms of Service.

By creating an account or using the Services, you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Services.

The sections below give the full detail. In summary:

• We do not sell or rent your personal information, and we do not share it with advertisers;
• We do not use third-party advertising networks, and we do not track you across other websites;
• The only cookies we set are functional ones, needed to sign you in and keep the Website working;
• We never see your password, and we never hold card or bank details, because deposits and withdrawals are made in cryptocurrency;
• Public chat messages are deleted automatically after about 24 hours;
• What we do keep, such as your account details, security logs, and your gaming and financial records, is kept only to run the Services, protect your account, and meet our legal obligations;
• You can make your profile private, opt out of marketing emails, and delete your account yourself at any time.

We collect the information you give us directly when you create and use your account:

• Account details: a username, an email address, and a password. Passwords are stored only in hashed form; we cannot see or recover your actual password;
• Sign-in with Google: if you register or sign in with Google, we store your Google account identifier and the email address associated with it. We never receive your Google password;
• Discord linking: if you link a Discord account, we store your Discord ID and username, together with the tokens needed to keep the link active;
• Two-factor authentication: if you enable 2FA, we store the secret needed to verify your codes, along with hashed single-use recovery codes;
• Avatar: your chosen preset avatar or, if you upload one, the custom image you provide. Avatars are publicly visible;
• Content you post: messages in the public chat (kept only briefly, as described in Section 11), optional messages attached to tips, and any abuse reports you file;
• Support conversations: messages you exchange with our support team through the on-site live chat or by email;
• Preferences: settings such as profile privacy, marketing email preferences, responsible gaming limits, and self-exclusion requests.

When you use the Website, we automatically record certain technical information: the IP address you register and sign in from, a history of successful sign-ins to your account (IP address, a browser and device description, and the time), the IP address associated with financial transactions, and standard technical logs generated by our servers.

The network and security infrastructure in front of our servers also provides us with the approximate country associated with your connection. We use this, together with your sign-in history, to protect your account: after your first sign-in, if your account is signed in from an IP address we have not previously seen on it, we send an alert to your email address with the IP address, approximate location, device summary, and time of the sign-in.

To protect the Website from bots and automated abuse, we run our own security checks that may analyze technical signals from your browser and general interaction patterns. These checks are used only to tell humans and bots apart, and not to identify or track you.

We do not use third-party advertising networks on the Website.

Because BloxCash is a gaming service, we keep detailed records of the activity on your account: deposits, withdrawals, bets, wins, tips sent and received, rain participation, rakeback, bonuses, and promo code redemptions, together with balance snapshots and timestamps.

Each game round is stored with the server seed, client seed, and nonce used to generate it, together with the resulting outcome, so that results can be independently verified as described on our Provably Fair page.

For cryptocurrency deposits and withdrawals, we store the wallet addresses involved and the blockchain transaction identifiers. Blockchain transactions are public by design: anyone can view a transaction on the relevant public blockchain, and neither you nor we can alter or remove it. Deleting data from our own systems cannot remove data recorded on a public blockchain.

We use a small number of cookies, all of which serve a functional rather than an advertising purpose:

• A signed session cookie that keeps you logged in. It expires when you close your browser or, if you select "remember me", after a longer period (currently around 30 days);
• A security (CSRF) cookie that protects forms and requests against cross-site request forgery;
• A short-lived cookie that secures the sign-in with Google flow while it is in progress;
• Cookies or similar storage set by our support chat widget when you open the on-site live chat, needed to run your chat session;
• Cookies that our third-party captcha provider may set when a captcha check runs (see Section 7).

We also use your browser's local storage to remember device-level interface preferences, such as game settings and panel positions. This information stays on your device, is not used to identify or track you, and can be cleared at any time through your browser.

Blocking or deleting cookies in your browser will stop core features of the Website, such as staying logged in, from working.

We use the information described above to:

• Provide and operate the Services, including your account, balance, gameplay, deposits, and withdrawals;
• Keep your account secure, including sign-in alerts, session management, and two-factor authentication;
• Detect, investigate, and prevent fraud, money laundering, multi-accounting, bonus abuse, and other violations of our Terms of Service. This includes automated risk checks on withdrawals and internal review notes and flags that our staff or automated systems may attach to accounts;
• Operate our responsible gaming tools, including enforcing wager and loss limits and self-exclusion, as described on our Safe Play page;
• Send you service emails about your account, such as email verification, password and security changes, deposit and withdrawal updates, sign-in alerts, responsible gaming confirmations, and account deletion notices;
• Send you marketing emails, unless you have opted out (see Section 8);
• Respond to your support requests and reports;
• Comply with legal obligations and respond to lawful requests from competent authorities.

We operate most of our infrastructure ourselves. Our cryptocurrency payment gateway and our own security checks (see Section 3) are served from our systems, and your support conversations are stored in our support desk system. There, support staff see your conversation alongside a snapshot of your account (your account ID, email address, username, level, balance, lifetime deposit and wager totals, and account standing), so they can help you without asking for those details.

A small number of third-party services process limited data on our behalf or in connection with the Services:

• Captcha: sensitive actions such as registering, signing in, withdrawing, and redeeming codes are protected by a third-party captcha service (currently hCaptcha). When a check runs, your browser connects to the provider, which may process your IP address, browser information, and interaction data under its own privacy policy;
• Email delivery: emails we send you are handled by a third-party email provider, which processes your email address and the content of those messages;
• Network protection: traffic to the Website passes through network and security infrastructure that shields us from attacks, provides us with the approximate country of your connection, and gives us aggregate visitor statistics that do not identify you;
• Sign-in with Google: if you choose to sign in with Google, Google processes that sign-in under its own privacy policy, and the same applies to Discord if you link a Discord account;
• Avatar moderation: if you upload a custom avatar, the image is checked by a third-party moderation service (currently Sightengine) for content that is not permitted on the Website.

We may send promotional emails about bonuses, offers, and site updates to accounts with a verified email address. Accounts receive these by default, and campaigns may be targeted using basic account attributes, such as how recently you have played, your level, or whether you have deposited.

Every marketing email contains an unsubscribe link that stops future marketing emails immediately, and the same page lets you resubscribe at any time while signed in to your account. Opting out of marketing does not stop essential service emails, such as password resets, security alerts, and withdrawal notifications.

Some information is visible to other users of the Website:

• Your username, avatar, level, and rank;
• Your public profile, which also shows your join date and lifetime statistics (total wagered, total bets, and total rewards claimed);
• Messages you send in the public chat, and announcements the site may generate for events such as big wins, tips, and rain payouts;
• Your participation in public games such as Case Battles, and your bets in the public live feed.

You can enable the private profile option in your settings. With a private profile, other users see only your username, avatar, level, and rank; your join date and lifetime statistics are hidden, your bets appear anonymously in the public live feed, and you are not identified in battle spectator lists. Site announcements for events such as big wins, tips, and rain payouts are still shown with your username even if your profile is private.

You can also send tips anonymously and block individual users so that their chat messages are hidden from you.

We do not sell or rent your personal information, and we do not share it with advertisers. We share information only:

• With the service providers described in Section 7, to the extent needed for them to provide their service;
• When we believe disclosure is required by law, regulation, legal process, or an enforceable request from a competent authority;
• To detect, investigate, or prevent fraud, abuse, or threats to the security of the Services or our users, including cooperating with law enforcement;
• In connection with a merger, acquisition, restructuring, or sale of assets, in which case account data may be transferred as part of that transaction under protections consistent with this Policy.

Within BloxCash, access to account data is restricted to staff roles that need it, and administrative actions on accounts are recorded in an internal audit log.

We keep your information for as long as your account exists and for as long as it is needed for the purposes described in this Policy. Financial, gaming, and anti-fraud records are retained after an account is closed because we need them for auditing, dispute resolution, fraud and abuse prevention, and compliance. Where records are retained after account deletion, they are first stripped of directly identifying details, as described in Section 12. Self-exclusion records are kept even after deletion so that the exclusion remains on record.

Public chat messages are stored only briefly to power the chat room and are deleted automatically after a short period (currently around 24 hours). If a message is reported for abuse, a copy of the reported message is kept with the report so our moderators can act on it.

You can delete your account yourself from the Account section of the Settings page. Deletion must be confirmed with your password and, if you have 2FA enabled, a valid authenticator or recovery code. It takes effect after a grace period, currently seven (7) days, during which you can cancel it from your account. When the grace period ends, deletion is permanent:

• Deleted: your sign-in history, notifications, queued emails, 2FA secret and recovery codes, custom avatar image, chat mutes and blocks, responsible gaming limit settings, internal notes and flags, and reports you filed;
• Anonymized: your username, email address, and password are replaced with random values; linked Google and Discord identifiers are removed; chat messages you sent are redacted; messages attached to tips are removed; and IP addresses are removed from your account and transaction records;
• Retained: financial and game transaction records (including deposit and withdrawal wallet addresses and blockchain transaction identifiers), self-exclusion records, abuse reports other users filed about you (with the report's free text removed), and internal administrative audit records (with identifying labels and details removed), all linked only to the anonymized account.

You control most of your data directly on the Website:

• Update your email address, password, avatar, and other account details in your settings;
• Limit what other users can see with the private profile option;
• Opt out of marketing emails at any time;
• Set responsible gaming limits or self-exclude on the Safe Play page;
• Delete your account as described in Section 12.

Depending on where you live, you may also have legal rights to access, correct, or delete your personal information, to restrict or object to its processing, or to receive a copy of it. To exercise any right that you cannot exercise directly on the Website, contact us via the on-site live chat or by emailing support@bloxcash.com. We may need to verify that you control the account concerned before acting on a request, and we will respond within a reasonable time.

We protect your information with technical and organizational measures. Traffic to the Website is encrypted in transit, passwords are stored only as Argon2id hashes, optional two-factor authentication protects sensitive actions, sessions are signed and can be revoked immediately, and staff access to account data is role-restricted and logged.

No online service can guarantee absolute security. If you believe your account has been compromised, contact us immediately via the on-site live chat or by emailing support@bloxcash.com. Security researchers can find our vulnerability disclosure process on the Security Policy page or contact security@bloxcash.com.

The Services are strictly for adults aged 18 and over (or the age of majority in your jurisdiction, whichever is higher). We do not knowingly collect personal information from anyone under 18. If we learn that an account belongs to a minor, we will close the account and delete the associated personal information. If you believe a minor is using the Services, please report it to us immediately.

Our servers may be located in a country different from your own. By using the Services, you understand that your information may be processed and stored outside the country you live in, where data protection laws may differ from those of your jurisdiction.

We may update this Privacy Policy from time to time, including to reflect changes to the Services, our practices, or applicable law. When we make changes, we will update the "Last updated" date at the top of this page, and for material changes we may additionally notify you on the Website or by email. Your continued use of the Services after a revision takes effect constitutes your acceptance of the revised Policy.

If you have any questions about this Privacy Policy or about how we handle your data, contact us via the on-site live chat or by emailing support@bloxcash.com.