Privacy Policy

Wallet and on-chain data

Your public wallet addresses, the network you use, your payments, quotes, box results, payouts, VIP status and fairness seeds. Blockchain transactions are public by design and cannot be deleted by anyone, including us.

Optional profile

A username and an avatar image, only if you choose to set them. Both are public and appear in places like the winners list.

Contact form

Your name, email address, subject and message when you contact us, so we can reply.

Security and abuse prevention

IP addresses are converted into salted one-way hashes for rate limiting and abuse prevention. We do not store raw IP addresses with your activity. A signed session cookie keeps you signed in after you sign a message with your wallet.

Settings in your browser

Preferences such as sound, music, volume, graphics quality, theme, your last chosen network and box, and your client seed are stored locally in your browser storage. They stay on your device and you can clear them at any time.

• to quote prices, verify payments, open boxes and send payouts;
• to show your history, profile, VIP status and public leaderboards;
• to provide provably fair verification;
• to prevent fraud, abuse, spam and attacks, and to keep the service secure;
• to answer your messages and provide support;
• to comply with legal obligations.

We work with a small number of service providers who process data on our behalf:

• Cloudflare hosts and protects Lootz (servers, database, file storage, email routing and network security). Cloudflare processes technical data such as IP addresses to deliver and secure the site.
• Cloudflare Turnstile protects forms such as the contact form and avatar upload from bots. It may process device and browser signals. See Cloudflare's privacy policy for details.
• Wallet and blockchain providers such as WalletConnect and Reown (wallet connection and optional email or social sign in) and RPC providers (reading and sending transactions). When you use their services, their own privacy policies apply.
• Price sources provide public market rates. We do not send them your personal data.

We do not sell, rent or trade personal data, and we do not share it for advertising. We may disclose data if the law requires it, or to protect the rights and safety of players and Lootz.

• Box, payment and payout records are kept for as long as needed for accounting, fairness verification, security and legal purposes.
• Your username and avatar are kept until you change or remove them.
• Contact messages, with the hashed IP they came from, are kept for up to 24 months, then deleted.
• Hashed IP data used for rate limiting expires automatically, usually within days.
• On-chain data stays on the blockchain permanently and is outside our control.

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict some processing, and to complain to a data protection authority. You can change or remove your username and avatar yourself at any time.

To make a request, email hello@lootz.xyz. We may ask you to sign a message with your wallet to prove that you control it. We cannot delete or change data recorded on a public blockchain.

We use encryption in transit, signed sessions, rate limiting, bot protection and strict access controls. No system is perfectly secure, so please protect your wallet and never share your seed phrase. Lootz will never ask for it.

Lootz is only for adults aged 18 or over. We do not knowingly collect data from anyone under 18.

We may update this policy. The date at the top shows the latest version. Significant changes will be highlighted on the site.

Privacy questions: hello@lootz.xyz or our contact form.