Privacy Policy

Cymba is in early beta. A full Privacy Policy will be published here before paid tiers launch. Until then this placeholder describes what we actually collect and how we use it.

What we collect

• Account data: name, email, hashed password.
• API keys: hashed (SHA-256) for lookup, plus a 4-character display suffix. The raw key is shown once at creation and is never recoverable from our database.
• Spin logs: timestamp, total multiplier, lines, and which API key + game config produced each spin. No bet amounts or personal player data.
• Provably-fair material: server seed (stored unencrypted at rest to support the verification flow), commit hash, and per-key nonce.
• Billing: while paid tiers are waitlisted, no payment data is collected. Once Stripe Checkout is live, card data is handled directly by Stripe — we only store Stripe customer / subscription identifiers.

What we don't collect

End-player identities, bet amounts, jurisdiction data, IP addresses beyond standard request logs, and any information that would let us identify your end users.

Third parties

Email verification is sent via a transactional email provider (e.g. Postmark / SES / Resend). Billing, when live, runs through Stripe. We don't sell or share your data with anyone else.

Your rights

You can delete your account (and with it, all associated API keys, configs, and spin logs) at any time. Email [email protected] for deletion requests during the beta — a self-serve flow is on the launch checklist.

Contact

Questions or concerns: [email protected].