Privacy Policy

This Policy describes the data flows identified in x51.games. The contact displayed by the service is info@x51.games. It is not a claim of legal review, regulatory compliance or certification. Agreeing to the Terms is not blanket consent to all personal-data processing.

Registration processes email, password through the authentication service, username, account identifier, Terms version/acceptance time and separate 18+ attestation time. The attestation does not verify age. Profile information includes the selected avatar and username; legacy profile records can also contain creation information and a biography.

Play records can include table membership, stakes, moves, game state, card hands needed to operate WHOT, outcomes, forfeits, connection/presence information, chat messages, invitations, friend relationships and notifications. Private hands are handled separately from public game state.

Payments and Cash Out process provider/payment/order references, amounts, statuses, payment addresses, transaction information supplied or returned, saved payout addresses, address-change audit records and wallet/ledger history. Saving a payout address uses password re-verification through authentication; it does not prove wallet ownership.

Technical processing includes session tokens/storage, request timing, security counters, hashed email/IP rate-limit identifiers, error/stack information and page-path context where reporting hooks are active. Infrastructure providers may process IP addresses, device/browser information and request logs.

Accounts, session access, profile changes, game participation, chat delivery, wallet accounting and payment requests are processed to provide requested service functions. Contract necessity may be the appropriate basis where the processing is objectively needed to perform the user's contract; the controller must confirm this assessment.

Security controls, abuse prevention, error diagnosis, service integrity and handling disputes may rely on legitimate interests where recognised by applicable law, subject to an assessment of necessity and your interests/rights. Financial retention or disclosures may instead require a specific applicable legal obligation; none is invented here.

An optional use that genuinely requires consent must have a separate, specific choice and a withdrawal mechanism. The registration Privacy acknowledgement is a notice acknowledgement, not consent for marketing, tracking or every processing purpose. Age attestation is recorded separately.

Other signed-in players can read profile information made available by the service, including account identifiers, usernames, avatars and player records/ratings. Legacy profile fields may also be available. Friends and invitation search use this player-facing information.

Public-game watching can expose player identifiers, usernames, avatars, stakes, public board/game state and results to visitors, including people who are not signed in. Do not use a username or avatar you consider confidential. Private-table visibility is restricted under its access rules.

Email, account consent records, wallet/ledger information and saved payout addresses are not intended to be player-directory or spectator data. Privileged service processing and authorised staff access are distinct from access by other players. Participant chat is membership-protected and is not included in spectator views. Opponents' private WHOT hands are not public spectator data.

Lovable Cloud provides the managed app backend, including authentication, database and storage using Supabase services. The app is developed/hosted through Lovable; hosting delivery uses a serverless deployment and associated infrastructure. Password authentication is processed by the authentication provider, not included in coin-invoice creation.

NOWPayments receives payment instructions and references needed to create/reconcile USDT TRC20 payments, including amounts/currency, order identifier, payment description and callback details. The inspected invoice payload does not include the customer's email or password. Blockchain transactions and addresses may be publicly observable and are not controlled by this Privacy Policy.

Error-reporting hooks may share exception, stack and route context with Lovable when available. Server/infrastructure logs also support diagnostics. Email authentication messages are handled through the configured authentication/email delivery services; their precise delivery vendor and active settings require confirmation.

Information may be disclosed to authorised operational personnel, professional advisers or competent authorities where justified by a valid legal basis. This statement is not permission for indiscriminate sharing or a promise that any specific fraud-monitoring provider is integrated.

The app uses persistent browser storage for authentication sessions and preferences such as sound, vibration and install-prompt dismissal. Session storage supplies a match-tab identifier. Development game state can be stored locally. In eligible framed Lovable previews, session storage can be brokered to the authorised editor ancestor; this is preview-specific.

Clearing storage may sign you out or reset local preferences; it does not cancel a live stake or erase server records. Hosting, authentication and delivery services may also use cookies or similar technology; absence of an application cookie-setting function does not establish absence of infrastructure cookies.

Providers may process information outside your country. The review has not established processing regions, transfer mechanisms or contractual safeguards; no claim of a particular adequacy decision or standard contractual clauses is made.

Supported account deletion removes access, anonymises the username and clears the avatar/biography, but preserves linked game and transaction history. It can be blocked while active games, held funds, unresolved payments or a remaining balance need resolution. It is not immediate erasure of every chat, payment, payout-address, consent or backup record.

The reviewed security-window cleanup is configured to remove request-limit windows older than two days. This limited cleanup rule is not a retention period for accounts, games, chat, financial records, raw infrastructure logs or backups, nor a guarantee that every scheduled cleanup has run.

Implemented protections include authenticated access, owner/membership-scoped reads, server-side move validation, restricted ledger writes, payment re-fetch/signature checks and request limits. These describe design controls, not an independent security audit, encryption certification, guarantee against unauthorised access or claim that every path is equally protected.

Keep credentials and wallet secrets private. Do not post passwords, private keys or seed phrases in chat or support messages. Contact the operator if you suspect unauthorised access.

Depending on applicable law, you may have rights to access, correct, erase, restrict or obtain a portable copy of information, object to eligible processing, and withdraw consent where consent is actually used. These rights are subject to lawful limits, not to a blanket waiver through Terms acceptance.

Contact info@x51.games to request action and describe the request without sending credentials. Identity checks proportionate to the request may be necessary before disclosure. The Profile page edits your username/avatar; it does not provide a complete export or all statutory rights workflows.

You may have the right to complain to the competent data-protection regulator. No specific regulator or response deadline is asserted because the controller and jurisdictions are not confirmed. This does not remove deadlines or complaint rights imposed by applicable law.

This page is dated. Material changes to data uses require appropriate notice and, where necessary, a new legal basis or separate consent; replacing the page is not permission to expand processing without those steps.