Privacy policy
We collect as little data as possible. This page explains what we collect and why.
On this page17 sections
Who we are
GambGenius (https://gambgenius.com) is the data controller for personal data collected through this website. Contact: hello@gambgenius.com.
Data we collect
Browsing the site does not require an account, and our calculators run entirely in your browser. If you create a free account we collect:
| Data | Why | Legal basis |
|---|---|---|
| Name, email, password (stored only as a secure hash) | To create and secure your account | Contract |
| Country and phone number | To show offers available where you live and, if you opt in, to send SMS alerts | Contract / consent |
| Date of birth | To confirm you are 18 or older | Legal obligation |
| Marketing preferences | To send bonus alerts by email or SMS only if you opt in | Consent |
| Saved offers, guides and safer-gambling settings | To provide account features you choose to use | Contract |
| Sign-in times, IP address and the page you joined from | Security, fraud prevention and understanding which content helps readers | Legitimate interests |
Sign in with Google or Apple
If you choose to sign in with Google or Apple, we receive your account id at that provider, your email address and, from Apple, your name the first time you sign in (Apple may give us a private relay address instead of your real email). We never ask for your contacts or files, we never store the provider’s access tokens, and we never post anything for you. You can disconnect Google or Apple at any time under Security in your account; signing in with an emailed link keeps working.
Passkeys
If you add a passkey we store its public key, its credential id, the label you give it and the dates it was added and last used. Your fingerprint, face or device PIN never leaves your device and we never see it. You can remove a passkey at any time under Security in your account.
Boards and shared links
Boards you create hold their names and the items you add. If you share a board, anyone with the link sees only the board name and its items, never who made it. You can revoke a shared link at any time; sharing also stops if you take a break or self-exclude, and our editors may remove a shared board that breaks our rules. Boards are deleted with your account.
RTP reports
If you report the RTP version a casino offers for a slot, we keep the casino, the slot, the RTP you saw, the date and any evidence you give us. Approved reports are shown without your name. If you delete your account, approved reports stay published in anonymised form (no longer linked to you); reports still waiting for review are deleted.
Email course
The email course has its own double opt-in: you ask for it, then confirm from the email we send, and nothing is sent until you do. Every course email has an unsubscribe link, and the course stops straight away if you take a break or self-exclude. It is separate from bonus alerts and other marketing.
Marketing
We only send marketing if you tick the opt-in boxes, and you can withdraw consent at any time from your account or the unsubscribe link in every email. Self-excluding automatically withdraws all marketing consent. We never sell your data.
Sharing
We share data only with processors that help us run the service (hosting, email and SMS delivery) under contracts that protect your data. We do not share your personal details with casinos or sportsbooks.
Support correspondence
Emails you send to support@gambgenius.com or privacy@gambgenius.com are handled as tickets in our own ticketing system (part of our staff tools, hosted on our server). A ticket holds your address, your messages and attachments, and our replies. It is linked to your account only when it comes from your account’s address and passes our sender checks. If you delete your account, the content of your tickets is erased.
Staff notes and tags
Our staff may add short notes and tags to your account, for example to remember a support conversation or a safer-gambling request. Only staff whose role needs it can see them, and every time a staff member opens or changes personal data it is recorded in an audit log. Tags are included when you download your data; you can ask for notes as part of an access request. Both are deleted with your account.
Email delivery logs
For every email we send we log its type, template, delivery status and time, so we can fix delivery problems and show which emails you agreed to. Bounces and spam complaints add your address (as a one-way hash) to our suppression list, so we stop emailing it.
Campaign targeting
Marketing emails go only to members who opted in. We may choose who receives a campaign using account data such as your country, the topics you follow and what you saved. Members on a break, self-excluded or with offers hidden are always left out, and every marketing email has an unsubscribe link. We make no decisions with legal or similarly significant effects about you by automated means.
Official slot demos
Free demos are loaded from the game provider’s own server, in a frame on our page, and only when you press play. The provider then receives your IP address, browser details and our site address (not the full page address), and it may set its own cookies; its privacy policy applies. The frame can’t read our cookies or your account.
Retention
We keep personal data only as long as we need it:
| Data | How long we keep it | Legal basis |
|---|---|---|
| Account data (profile, saved items, settings, consent history, staff notes and tags) | While your account is open; removed straight away when you delete your account | Contract / legitimate interests |
| Security log (sign-ins, security changes, IP address) | 1 year; IP addresses blanked if you delete your account | Legitimate interests (security) |
| Safer-gambling register (self-exclusions, breaks and hidden offers carried over to a new sign-up) | Indefinitely, as a one-way hash of your email address only (a self-exclusion until it ends) | Legal obligation (responsible gambling) |
| Marketing suppression list (addresses that unsubscribed, bounced or complained) | Indefinitely, as a one-way hash of your email address only, so we never email you by mistake | Legitimate interests (honouring your opt-out) |
| Support tickets and emails to our support or privacy address | 3 years after the ticket is solved; message content erased if you delete your account | Legitimate interests / legal obligation |
| Email delivery log (type, template, status, time) | 400 days | Legitimate interests (deliverability, proof of consent) |
| Staff audit log (which staff member opened or changed personal data) | 2 years | Legitimate interests / legal obligation (accountability) |
| Data protection requests (access, deletion) and how we answered them | 3 years after the request is completed | Legal obligation |
| Database backups | 14 days, then overwritten | Legitimate interests (recovery) |
| Copies of emails in our support and privacy mailboxes | 30 days (the ticket keeps the conversation) | Legitimate interests |
| Server logs (web server access log without query strings; system journal) | 14 days (web server); 30 days (system journal) | Legitimate interests (security) |
Cookies and similar storage
We do not set advertising cookies. Analytics cookies are off until you choose “Allow analytics”; until then, and if you reject them, everybody sees the standard version of every page and no visitor identifier is stored.
| Name | Purpose | Lifetime | Legal basis |
|---|---|---|---|
__Host-gg_session (formerly gg_session), gg_auth, __Host-gg_mfa (formerly gg_mfa) | Keep you signed in and protect two-step sign-in (members only) | 1 day, or 30 days with “Keep me signed in” (the two-step cookie: a few minutes) | Strictly necessary |
gg_kd | Recognises a browser that has signed in to your account before, so a lock triggered by attacks on your account does not stop you signing in from it (a signed value, no personal data) | 180 days | Strictly necessary (account security) |
gg_oauth | Protects a Google or Apple sign-in while you are sent to the provider and back (a random value, no personal data) | 10 minutes | Strictly necessary |
gg_oauth_pending | Keeps your place while you finish creating an account after signing in with Google or Apple | 30 minutes | Strictly necessary |
gg_pk | The one-time challenge for a passkey sign-in | 5 minutes | Strictly necessary |
gg_consent | Remembers whether you allowed or rejected analytics cookies | 180 days | Strictly necessary |
gg_cc | Only where enabled (it is not set at the moment): your country code, where our server sets it, used only to hide offers that are not available where you are | 1 day | Strictly necessary (showing only offers that are lawful where you are) |
gg_vid | A random visitor number used to keep you in the same version of a page we are testing | 365 days | Consent (analytics) |
gg_exp | Which test versions you were shown, so results can be measured | 90 days | Consent (analytics) |
gg_attr | How you first and last reached us (campaign tags, referring site, landing page and date). Copied to your account if you join, and to our click log when you visit an operator through a /go/ link | 90 days | Consent (analytics) |
We suggest a starting language from the country of your IP address, looked up in memory in the DB-IP “IP to Country Lite” database (CC BY 4.0); your IP address is never stored, and the language you choose yourself is kept in a gg_lang cookie for one year.
The site also keeps a few items in your browser’s local storage so features you use keep working: recently viewed slots, guides and searches, where you stopped reading a guide, saved filters, ranking weights and comparisons, break-reminder and safer-gambling display settings, answers you marked helpful and suggestions you hid, whether you have seen a tip or the “add to home screen” hint, and the time of your last visit (to show what is new). These names start with gg_, stay on your device, are never sent to us and can be removed by clearing this site’s data in your browser. We also count anonymous events (such as a page view or a button tap) with no cookie or identifier attached.
Stored only on this device
These items make features work for you. They hold no identifier, are never sent to us, and are strictly necessary for the feature you use, so no consent banner is needed for them.
| Name | Purpose | Lifetime | Legal basis |
|---|---|---|---|
gg_meter | Counts the free demos and full slot guides you have opened, so the free weekly allowance works without an account (only a count and dates) | 7 days from your first use | Strictly necessary (functional, device only) |
gg_guest_saves | Slots, guides and providers you save before joining; moved into your account if you join, then removed | Until you clear it or join | Strictly necessary (functional, device only) |
gg_have | Brands you marked “I have an account” in this browser | Until you clear it or join | Strictly necessary (functional, device only) |
gg_known | Remembers that a member signed in on this device (no email, no account number), so “Sign in” is shown first. “Sign out and forget this device” removes it | Until you sign out and forget this device | Strictly necessary (functional, device only) |
gg_remember_email | Your email address, only if you tick “Remember my email on this device” when signing in, so the sign-in form is filled in for you. “Sign out and forget this device” and deleting your account remove it | Until you untick it, forget this device or delete your account | Strictly necessary (functional, device only, at your request) |
gg_bs_mastery, gg_bs_best | Your blackjack trainer accuracy for each hand, and your best run | Until you clear it | Strictly necessary (functional, device only) |
gg_do_pending | A save you asked for before joining or signing in (only the action and the time), so it is done once when you come back; a link from anywhere else asks you first | 24 hours, or until it is done | Strictly necessary (functional, device only) |
gg_prefill_email | The email address you typed, passed to the next sign-in, sign-up or password-reset page in the same tab so you don’t type it twice (instead of putting it in the link). Kept in this tab only | Read once and removed when that page opens, or when the tab closes | Strictly necessary (functional, device only) |
gg_deposit | The deposit amount you typed into an offer list, so bonus values are shown for that amount | Until you clear it, or sign out and forget this device | Strictly necessary (functional, device only) |
gg_ref_card | Remembers that you closed the short “what a free account adds” card, so it is not shown again | Until you clear it | Strictly necessary (functional, device only) |
gg_dash_seen | When you last left your account dashboard, so the “new since your last visit” dot clears (members only) | Until you sign out and forget this device | Strictly necessary (functional, device only) |
gg_now_out_seen | Watched slots already shown to you as “now out” on your dashboard, so each is announced once (members only) | Until you sign out and forget this device | Strictly necessary (functional, device only) |
gg_track_pct | Your last reading-track progress on the dashboard, so a bar only moves when it changes (members only) | Until you sign out and forget this device | Strictly necessary (functional, device only) |
gg_auth_ping | A short “signed in” or “email confirmed” notice passed between your open tabs of this site so they update together (only the notice type and the time) | Replaced by the next notice | Strictly necessary (functional, device only) |
gg_rotate_hint | Remembers that the “turn your phone sideways” hint was shown on a demo, so it appears once | Until you clear it | Strictly necessary (functional, device only) |
gg_offline_saved | Your choice to keep saved pages readable offline, and when they were last refreshed (members only) | Until you turn it off or sign out (signing out removes it) | Strictly necessary (functional, device only, at your request) |
gg_reg_draft | The email, first name and country typed on the sign-up form, so a reload doesn’t lose them (never your password or date of birth) | Until you finish signing up or clear it | Strictly necessary (functional, device only) |
Safer-gambling and deposit details you enter without an account (such as hiding offers, break reminders or a deposit amount) are kept only in this browser. We can’t see them, so they don’t follow you to another device; join, or set the same limits in your account, to have them apply everywhere.
Changing your mind: you can allow or withdraw analytics consent at any time. Withdrawing deletes the analytics cookies from your browser straight away.
When you click through to an operator, that operator may use its own cookies to attribute your sign-up to us; its own privacy policy applies.
Your rights
You can download your data or delete your account at any time from your account. You can also ask us to access, correct, delete or restrict your data, or object to processing, by emailing privacy@gambgenius.com. We may ask you to confirm the request from your account’s email address first, and we answer within one month. You may complain to your local data protection authority.
Gambling should stay fun
Set deposit limits before you play, never chase losses and take regular breaks. If gambling stops being enjoyable, free and confidential help is available 24/7.