Privacy Policy
Updated
This policy explains what information DiceGem (“we”, “us”) collects when you visit dicegem.com, play our games at play.dicegem.com, play a DiceGem game embedded on another website, or use a publisher account at partners.dicegem.com, and what choices you have. DiceGem is the controller of this information.
Short version: there are no player accounts. We collect pseudonymous game events to know which games are played and to report plays to the sites that embed our games. We do not collect a player’s name or email unless they write to us. Website owners in our publisher programme have accounts, described in section 2. We never sell data.
1. Information we collect
Game events
When you play, the game sends small event records to our server (api.dicegem.com):
- the event type: game loaded, game started, game finished (with whether it was completed and how many players won), and, when advertising is active, ad requested, ad shown and reward granted,
- the game’s name and version, and the kind of platform (our website, a partner website or an app),
- a random session ID created when the game page opens; it is not saved on your device and changes on every visit,
- the time of the event,
- when the game is embedded on another site, the address of that site and the partner’s publisher ID.
Our server records the time it received the events and the host name of the embedding site (never the full page address), and replaces your IP address with a one-way salted hash before storing it. We do not store the IP address itself, your browser type or your location. A salted hash still lets events from the same address be grouped together, for example to spot fraudulent traffic, so we treat it as pseudonymous personal data.
Game ratings
When you rate a game on its page, our ratings server (api.dicegem.com) stores the game’s name, the number of stars and the time. To allow one rating per game from each address, it keeps a one-way keyed hash of your IP address instead of the address itself; the same hash is used to limit how many ratings an address can send in a few minutes. Ratings are shown on our website only as an average and a count.
Data stored on your device
Your game progress, settings, statistics and virtual credit balance are saved in your browser’s local storage on your own device, along with your language choice in the games, your light or dark theme choice on our website, and the games you marked as favorites or opened recently on our website. This data is not sent to us. See our cookie policy.
Server logs
Like any website, our hosting and security providers process technical request data (IP address, browser type, requested page) to deliver pages and protect the service from abuse. Our own server also keeps IP addresses briefly in memory to limit the rate of requests; they are not written to storage.
Emails
If you email us, we receive your address and message and use them only to reply and keep a record of the conversation.
2. Publisher accounts
If you join our publisher programme, we process:
- Account details: your email address, name or company name, and your password, which we store only as a salted scrypt hash. We also record which version of the publisher terms you accepted and when. If you turn on two-step verification, its secret is stored encrypted, and recovery codes are stored only as hashes.
- Sites: the domains you add and their verification status.
- Payment details: your payout method, either a PayPal email address or a bank account holder name, IBAN and SWIFT code, stored encrypted, and your payout history.
- Security records: sign-in times, failed sign-in counts and lockouts, and an audit log of account actions (such as changing your payout method or adding a site) with the time, the account that acted and a salted hash of its IP address.
- Session cookie: when you sign in we set one cookie, described in our cookie policy.
We send you service emails about your account: when your password is changed or reset, a password reset link you ask for, and a notice when your payout method changes. We do not send marketing emails.
3. How we use information
- to count plays per game, find games that fail to load or finish, and decide what to fix or build next,
- to report plays and ad impressions to partner websites that embed our games, and to detect fraudulent traffic,
- to keep the service secure,
- to answer your messages,
- to run publisher accounts, calculate revenue shares, make payouts and protect accounts from takeover.
We do not build personal profiles, and we make no automated decisions with legal or similarly significant effects about you. Our fraud checks can flag a publisher payout, but a person reviews it before it is held.
4. Legal basis (GDPR)
We process game events and server logs on the basis of our legitimate interest in running, securing and improving a free service and in reporting accurately to our partners. We process emails to respond to your request. We process publisher account and payment details to perform our contract with you, and keep payment and audit records where accounting, tax or anti-fraud obligations require it.
5. Advertising
At the time of writing, DiceGem does not show advertising. When we introduce it, ads will be provided by Google (Ad Placement API / AdSense for games), will appear only at natural breaks, and rewarded ads will always be optional. Before ads go live we will update this policy and our cookie policy and, where the law requires it, ask for your consent first.
6. Sharing
We share information only with:
- service providers who host and secure our site and servers, acting on our instructions,
- partner websites that embed our games, which receive aggregated play and ad statistics for their own sites (not session-level data),
- payment providers (PayPal or banks) to make publisher payouts,
- authorities, where the law requires it.
We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.
7. Retention
- Game events: used to produce daily statistics and partner reports, close monthly payouts and investigate fraud. Once a month’s payouts are closed, its raw events are deleted automatically when they are 180 days old. The daily statistics that remain contain no personal data.
- Sign-in sessions: a publisher session ends after 30 days; expired sessions are deleted within an hour.
- Publisher accounts: kept while the account is open. After closure we delete account details, except payment and audit records that we must keep for accounting, tax and fraud purposes for as long as the law requires.
- Game ratings: kept while the game is on our website, so the average stays accurate; you can change your rating at any time from the game page.
- Emails: kept as long as needed to deal with your request.
8. Your rights
Depending on where you live (for example under the GDPR, UK GDPR or California law), you may have the right to access, correct, delete or export personal data we hold about you, to object to or restrict its processing, and to complain to your data protection authority. Because we do not know who you are from game events, we may need details (such as the approximate time and site you played on) to find related records. Publishers can also ask us to close their account. Write to [email protected]. We answer within one month, as the GDPR requires.
9. International transfers
Our providers may process data outside your country. Where data leaves the European Economic Area or the UK, we rely on recognised safeguards such as the European Commission’s Standard Contractual Clauses.
10. Children
Our general games are suitable for all ages, but the service is not directed at children under 13 and we do not knowingly collect personal information from them. Casino-style games are intended for adults aged 18 or over. If you believe a child has sent us personal information, contact us and we will delete it.
11. Security
Data travels over encrypted connections, IP addresses are stored only as salted hashes, passwords only as salted scrypt hashes and sign-in sessions only as hashes of their tokens. Access to our servers is restricted to the people who run the service, and administrator accounts require two-step verification.
12. Changes
We will update this policy when our practices change, revise the date at the top, and point out significant changes on this page.
13. Contact
Privacy questions and requests: [email protected].