What this site stores about you, why, and how to get rid of it.
Only what the site needs to work — nothing is bought in from data brokers
Account
Email address, username, a hash of your password, avatar, language, referral code, who referred you, your Google account ID if you sign in with Google, and the tag of the link you first arrived on, if it had one
To create and run your account
Sessions
A hash of the session token, IP address, browser user-agent, expiry date
To keep you signed in and to spot account abuse
What you post
Reviews; complaints, with the amount and your username at the casino if you give them; messages in a case thread
To publish and moderate submissions
Casino connections
Your username or player ID at each casino you link, and wager figures from its reports. Casino buttons pressed while you are signed in carry your referral code; when the casino reports a sign-up or deposit under that code, we store the report and link that casino account to yours
To confirm your play and credit rewards
Rewards
Balance, transactions, claimed codes, and the USDT wallet address you give for each withdrawal
To pay out what you have earned
Support chat
Messages you write in the support chat on the site, and our replies
To answer you
Messaging
For each sign-in, confirmation or password-reset email: the address, the kind of email and hashes of its link and code. Your email preferences. If you use our Telegram bot: its chat ID, your name there and your alert settings, plus your Telegram username if you link the bot to your account, and the tag of the bot link you first opened it with, if it had one
To send account mail and the alerts you asked for
Stake address availability
Per country, never per visitor: each Stake address, how many times it answered or did not answer a check, and how fast. Nothing that identifies who ran the check — no IP address, account or browser details. The counts fade by half every five days and are deleted after 60 days
To list first the Stake addresses that open in your country
Seven cookies, all first-party, none of them for advertising. Two exist only for a few minutes during sign-in.
sid30 daysKeeps you signed in. HTTP-only, so scripts cannot read it.
locale365 daysRemembers whether you are reading the site in English or Russian.
ref90 daysRecords who referred you, so their referral reward is credited.
src90 daysSet only when you arrive on a link tagged with utm_source (and optionally utm_campaign): remembers which post or channel first brought you here, so we can tell which of our placements work. The first tag is never overwritten, and if you register it is saved to your account. HTTP-only.
theme365 daysRemembers light or dark theme, so the page arrives in the one you chose.
goauth10 minutesSet only while you sign in with Google, to check that Google's answer belongs to the sign-in you started. HTTP-only.
astep20 minutesSet only for site staff, between the password and the emailed code at sign-in. HTTP-only.
Clearing cookies signs you out and resets the language to whatever your browser asks for. A few preferences are kept in your browser's local storage instead: theme, the sidebar and its folded sections, sound switches, the codes you marked as redeemed and the banners you closed. They stay in your browser and are not sent to us.
The site is run by a private individual resident in the Russian Federation, acting as the data controller. There is no company behind it and no registered office to publish.
For anything about your data — access, correction, deletion, or a complaint — write to the support address at the bottom of this page. It reaches the operator directly and is the only channel for such requests.
Running your account, paying rewards and answering support requests is necessary to provide the service you asked for.
Moderating submissions, preventing fraud and keeping the site secure rest on our legitimate interest in a site that is not being gamed.
We send no marketing email. Sign-in links, confirmation codes and password resets are part of running your account.
The site is hosted by a provider based in the United States; the servers that run it are in Frankfurt, in the European Union, and pages reach you through that provider's worldwide network. The database holding everything described on this page runs on servers in the European Union. Email is sent through a provider in the United States, and mail you send to our support address is received through another provider in the United States. Google receives nothing unless you choose to sign in with Google, in which case it confirms your address to us — that one is named because you can see the button.
Casinos: when you press a casino button while signed in, the link carries your referral code — not your name or email — so the casino's affiliate system can tell us you registered. If you file a complaint, we may pass its details to that casino to get an answer.
Stake: the page listing Stake's addresses checks, from your own browser, which of them open for you. Opening it makes your browser send a small request to each address it checks (up to about 130), so Stake and its network provider see an ordinary request from your IP address and browser, with no cookies and no address of our page; your internet provider or DNS resolver sees the names of those addresses. Your browser then sends us which addresses answered and how fast. We add that to the counts for your country, which our hosting provider determines from your IP address; the IP address itself is kept only in the server's memory, for up to an hour, to limit abuse, and is never written anywhere.
There is no advertising network, no analytics service and no tracking pixel on this site. If that changes, this list changes with it.
Sessions expire after 30 days and are deleted automatically.
Account data is kept until the account is deleted. There is no delete button: write to support@gamblora.com from the address on the account and we delete it. That removes your profile, casino links, balance, transaction history and support chats.
Reviews and disputes that have already been published stay up under the display name you used, detached from your account — the record of a dispute is the point of publishing it.
Write to us first — the support address below reaches the operator directly and is the fastest way to have something corrected or deleted.
If that does not resolve it, the supervisory authority for the operator's jurisdiction is Roskomnadzor, the Russian Federal Service for Supervision of Communications, Information Technology and Mass Media (rkn.gov.ru). If you are in a country with its own data-protection authority, you may complain to it as well.
Passwords are stored only as hashes, and session tokens are stored hashed as well — the raw values never touch the database.
No system is perfect. If a breach affects you, we will tell you and the relevant authority as quickly as the law requires.
This site is for adults. We do not knowingly collect data from anyone under 18, and an account found to belong to a minor is closed.
We can update this policy. Material changes are announced on the site before they take effect.
Access, correction or deletion — write to us and we will handle it.