Privacy policy
The shortest honest version: if you only play, Flickloot stores nothing about you. If you choose to open the optional account, it holds your email address and the date of birth you declare, for two purposes only: a self-exclusion that follows you across devices, and your choice about Flickloot email. It has no payment data, because it takes no payments. It sells nothing to anyone.
What is collected
| Without an account | Nothing that identifies a person, with one exception below. Coins, settings and game state are held in the browser. An approximate location may be derived from the connection in order to apply jurisdictional blocks; it is not stored. Free play never requires an account. |
|---|---|
| If you report a problem | An issue description, optional evidence text, and an email address only if you choose to give one, through /legal/report-a-problem/. No account is created or required to use it. |
| With the optional account | Your email address and the date of birth you declare. The date of birth is declared age information for the account; it is not identity verification. Alongside these, the dates needed to run the account: when it was created, any self-exclusion you set (state and term), your email choice, a suppression flag that stops marketing email, and the date you close it. There is no password. No gameplay record is linked to the account: coins and game state stay in your browser, and the anonymous play events carry no identifier and are not linked to it. |
| Never collected | Payment card details, bank details, identity documents, government identifiers, biometric data. No mechanism exists on this platform to submit any of them. |
Identity documents: do not upload them
Any KYC or verification screen shown on Flickloot is a demonstration of how such a flow should behave. It executes entirely in the browser, accepts specimen documents only, and transmits nothing to any server. Do not upload a real passport, identity card, or driving licence. It will not be processed, and it should not be sent. The demonstration shares no data store with the optional account.
The optional account
Free play on Flickloot needs no account and collects no personal data. You can choose to open an optional account. It does exactly two things: it lets a self-exclusion you set follow you to other devices where you sign in, and it lets you choose whether we may send you Flickloot email. It is not a player profile, a wallet, an identity check, a leaderboard or a condition of play. Coins stay granted-only and are never sold, redeemable or transferable, with or without an account.
Where it is kept and how you sign in
Account records are kept in a private store on our server, outside the folders the website serves, readable and writable only by the site’s own account software. The play page never receives your account record, your email or your date of birth; it receives only whether you are signed in and whether a self-exclusion is active. You sign in with a single-use link sent to your email; there is no password. The link expires after 15 minutes and works once. When you confirm it, your browser receives a random session cookie (Secure, HttpOnly) that lasts 12 hours.
Self-exclusion across devices: what it can and cannot do
Self-exclusion applies on any device after you sign in there. If you do not sign in on another device, we cannot recognise you there and cannot block play on that device. A self-exclusion cannot be shortened once set, and setting one also switches off marketing email for the account.
Flickloot email
We send marketing email only if you tick the box that says: «Yes, email me Flickloot updates and optional promotions. You can unsubscribe at any time.» The box is unticked by default and opening an account does not tick it. Every marketing email carries a one-click unsubscribe link that works without signing in. Unsubscribing, self-excluding or closing the account each stop marketing email at once, and that stop outranks any earlier choice or list. Account notices (your sign-in link, confirmation of a self-exclusion, a change of email choice, closure) are sent from accounts@flickloot.co.uk; replies go to hello@flickloot.co.uk.
Why it is collected
- Email address — to send the single-use sign-in link and the account notices, and, only if you tick the box, Flickloot email.
- Declared date of birth — age information for the optional account, declared by you; it is not verified.
- Self-exclusion state and term — so that the exclusion applies on every device where you sign in.
- Approximate location — to apply jurisdictional access rules, in real time, and not retained.
- A submitted report — issue text, optional evidence and optional email — to investigate what happened and, where an email is given, to reply.
What is not done with it
No data is sold. No data is shared with advertisers, data brokers, or affiliate networks. No behavioural profile is built for the purpose of re-engaging a player. No push notification is sent to encourage a return to play. There is no advertising on this platform. Marketing email goes only to people who ticked the box, and never to a suppressed, self-excluded or closed account.
Rights
Under the GDPR and, for California residents, the CCPA, a person may request access to their data, correction of it, deletion of it, and a portable copy of it. Flickloot answers such requests within thirty days, and typically far faster.
Beyond that: several games expose an export button that produces the complete spin-by-spin history as a file, immediately, without a request being made. Data portability is a legal right that the industry answers in thirty days with a PDF. It should be a button.
Retention
- Email address, date of birth and account dates: 30 days after you close the account, then deleted, unless an active self-exclusion requires them to be kept until it ends.
- Self-exclusion records: the exclusion term plus 6 years.
- The suppression flag that stops marketing email: kept while it is needed to honour your choice; while it is set we never send marketing.
- Sign-in link hashes: 24 hours. Sign-in timestamps: 30 days. These are security records, not browser data.
We understand these periods to be a reasonable reading of our retention duties; a qualified adviser should confirm them. Aggregate statistics that identify nobody may be retained.
Reports submitted through /legal/report-a-problem/ are kept for review and, once a report is closed, for six years afterward.
Processors
Account records are stored on Flickloot’s own hosting; no third-party database holds them. Account notices and sign-in links are sent through our transactional email provider, Brevo (Sendinblue SAS, France), which receives the recipient address and the message text. Website hosting is provided by IONOS. Both act on instruction only.
Contact
Data requests via the contact page.