Privacy Policy
DepositScope analyses public blockchain data to help licensed gambling operators understand the value and risk of a player's crypto wallet. This page explains what we collect, why, who we share it with, and how to have it deleted.
1. Who we are
DepositScope ("we", "us") operates the website depositscope.com and the
product at app.depositscope.com. For privacy questions, write to
hello@depositscope.com.
2. Two different roles
We handle two kinds of data, and the law treats them differently.
As controller — your account with us
When you register, sign in, or contact us, we decide what is stored and why. This section covers that data.
As processor — data about your players
When a gambling operator sends us a wallet address and its own internal player identifier, the operator remains responsible for that data. We process it only to produce the verdict the operator asked for, under the operator's instructions and our Terms. We do not use it to build profiles for anyone else, and we never share one customer's data with another.
3. What we collect
| Data | Why | How long |
|---|---|---|
| Email address | It is your login and the only way we can reach you about the account. | Until you ask us to delete the account. |
| Company name (optional) | To know which operator we are talking to. | Same as above. |
| IP address at sign-up | To stop one person opening unlimited free trials. | Same as above. |
| Demo request: name, email, company, and optionally your phone or Telegram handle, position and message | To arrange the call you asked for. Sending the form does not create an account. | Until you ask us to delete it. |
| Password, stored only as a PBKDF2-SHA256 hash with a per-user salt | To verify sign-in. We cannot read your password. | Same as above. |
| Sign-in method, account creation time, last sign-in time | Account security and support. | Same as above. |
Session cookie ds_session | To keep you signed in. It is HttpOnly, expires after 14 days, and carries no tracking identifier. | 14 days, or until you sign out. |
Sign-in cookie g_state | Only while you sign in with Google: it makes sure the answer coming back from Google belongs to the sign-in you started, so another website cannot complete a sign-in in your name. HttpOnly. | 10 minutes. |
| Balance movements — top-ups, charges and refunds, with the amount, date, what each was for and who recorded it | To bill you correctly and to answer any question about a charge. | As long as accounting law requires us to keep them. |
| Wallet addresses and the player identifiers our customers submit | To produce the verdict the customer requested. | Until the customer deletes the player or closes the account. |
| Public blockchain transfer records | The raw material of every verdict. Scoring changes weekly and verdicts are recalculated from stored raw data instead of re-querying the networks. | Kept indefinitely — see section 7. |
To know how many people visit this website and the product at app.depositscope.com, including the pages you see when signed in, we use Cloudflare Web Analytics. It sets no cookies, stores nothing in your browser, does not fingerprint you and does not follow you across other sites: it counts page views, the page, the referring site, the country and the browser type. We do not use advertising cookies, session recording, or any other tracker. There is no cookie banner because there is nothing to consent to beyond the two sign-in cookies above, which are strictly necessary.
4. Signing in with Google
If you choose "Continue with Google", Google tells us two things: your email address and
whether Google has verified it. That is the entire scope we request
(openid and email).
- We do not request, receive, or store access to Gmail, Drive, Calendar, Contacts, or any other Google service.
- The short-lived token Google issues is used once, in that moment, to read your email address. We do not store it and we do not keep a refresh token.
- We use your email address only to identify your account — the same way a password login would. It is never sold, shared for advertising, or used to train any model.
- If the email address is new to us on the client sign-in page, a free trial account is created for it. On the admin console, Google only recognises accounts we invited.
Google's own handling of your data is covered by the Google Privacy Policy.
5. Legal bases (GDPR)
- Steps at your request before a contract — contacting you about the demo you asked for.
- Contract — creating your account, signing you in, producing verdicts you request.
- Legitimate interests — keeping the service secure, preventing abuse of the free trial, and knowing when someone registers so we can respond to them.
- Legal obligation — keeping records required for accounting and, where applicable, sanctions screening.
6. Who else sees the data
We do not sell data and we do not share it for advertising. We do use a small number of service providers:
| Provider | What it sees | Where |
|---|---|---|
| Hetzner Online GmbH | Hosting of the application and database | Germany (EU) |
| GitHub Pages | Serving this website; standard web server logs | EU / US |
| Cloudflare, Inc. (Web Analytics) | Anonymous page-view counts for this website and app.depositscope.com: page, referring site, country, browser type. No cookies, no account data | Global |
| Namecheap Private Email | Delivery of the email with your verification code | US |
| Telegram | Operational alerts to our own team, which include your email address when you register or sign in, and the details of a demo request when you send one | Global |
| Blockchain data providers: TronGrid, Alchemy, Helius, Solana RPC, Dune, Arkham, Jupiter, CoinGecko | The wallet addresses being analysed. These are public blockchain addresses, not account data; no email address or player identifier is ever sent to them. | Various |
| Your email address, if you choose to sign in with Google | Global |
Transfers outside the EU rely on the providers' Standard Contractual Clauses.
7. Blockchain data cannot be deleted
Blockchain transfers are public records maintained by thousands of independent computers. We store a copy so verdicts can be recalculated without querying the networks again, but we cannot erase a record from the blockchain itself — nobody can. What we can and do delete is everything that links a wallet address to a person or to a customer's player account. Once that link is gone, the address is as anonymous to us as it is to any other observer.
8. Your rights
Under the GDPR you may request access to your data, correction, deletion, restriction, portability, or object to processing. Write to hello@depositscope.com and we will respond within 30 days. You may also complain to your national data protection authority.
If you are a player, not a customer: we hold data about you only because a gambling operator asked us to analyse a wallet. That operator decides what happens to it, so please send your request to the operator. They can erase you from our systems at any time — the product has a dedicated deletion function that removes the player, their wallets, verdicts and alerts, and records that the erasure happened.
9. Security
- All traffic is encrypted with TLS.
- Passwords are stored only as salted PBKDF2-SHA256 hashes.
- Each customer's data is isolated by a tenant identifier enforced on every query.
- Access to production is limited to our own team; database backups run nightly and are restore-tested monthly.
10. Children
The service is sold to licensed businesses only and is not directed at anyone under 18.
11. Changes
If we change this policy we will update the date at the top and, for material changes, email account holders.