Privacy policy

1. Controller

If you have any questions about data protection, you can contact us at any time at the email address above.

2. Which data we collect

We collect and process the following categories of data:

• Access data (server logs): IP address, time, requested URL, browser, operating system
• Contact data: name, email address when you contact us directly
• Account data (app only): email, username, password (hashed), optionally a second factor, Twitch user data
• Login log (app only): IP address, browser identifier, time and type of login and security events — see section 5
• Usage data (app only): stream session data, overlay configurations, chat interactions
• Country of origin (app only): country code from the login IP, determined locally — see section 5

3. Server logs

When you visit this website, technical access data is automatically stored in server log files. This includes:

• IP address of the requesting device (anonymised after 7 days)
• Date and time of access
• Name and URL of the requested file
• Referrer URL (page from which the access was made)
• Browser type and version, operating system

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing our website securely and without errors).
Retention period: 30 days, then automatic deletion.

4. Contacting us

If you contact us by email, the data you provide (your email address, your name if applicable and your request) is stored so that we can process your request.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract / pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest).
Retention period: Until your request has been fully resolved, then in accordance with statutory retention periods.

5. User account & app data

If you create an account at app.casinolayers.de, we collect and process the following data:

Registration data

• Email address and username
• Password (stored exclusively as an Argon2id hash, never in plain text; bcrypt hashes taken over from the previous login are converted at the next login)
• Optionally a second factor: for the authenticator app an encrypted key and recovery codes stored only as a hash, for passkeys only the public key, the name you assign and the times of creation and last use

Login and security log

To protect your account, we log login and security events, e.g. successful and failed logins, password and email changes as well as setting up or removing a second factor. In each case we store the type of event, the time, the IP address and the browser identifier (user agent). This allows us to detect and fend off attacks such as password guessing and to trace incidents. To throttle too many login attempts, we additionally count failed attempts for a short time per IP address and login name; these counters expire after 15 minutes.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security of the accounts and the application).
Retention period: 90 days, then automatic deletion.

Stream data

• Overlay configurations (position, size, settings)
• Bonus hunt sessions and results
• Slot request queues
• Tournament data and participants
• Wager histories

Country of origin

When you log in, we determine your country of origin (country code, e.g. “DE”) so that payments and licences can be allocated correctly for tax purposes. This is done exclusively locally on our servers using a geo database (GeoLite2) — your IP address is not transmitted to third parties for this and is not stored for determining the country (for the login log see above). Only the determined country and the date are stored; the first value determined is kept permanently and is checked manually by us and updated if necessary.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract — correct invoicing for tax purposes) in conjunction with Art. 6(1)(f) GDPR (legitimate interest in proper accounting).
Retention period: As above — for as long as the account is used, deleted within 30 days of account deletion.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Retention period: For as long as the account is used. When an account is deleted, all personal data is deleted within 30 days.

6. Twitch OAuth

If you log in with your Twitch account, the following data is transmitted to us by Twitch and stored:

• Twitch username and ID
• Twitch broadcaster ID
• Email address (if transmitted by Twitch)

We do not store a complete OAuth token permanently. You can find more information about data processing by Twitch at: twitch.tv/p/de-de/legal/privacy-notice

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) as well as your explicit consent when connecting your Twitch account.

7. Cookies & session

This landing page (casinolayers.de) uses no tracking or marketing cookies.

The app (app.casinolayers.de) uses only technically necessary session cookies:

• next-auth.session-token – session cookie for authentication. Deleted after logging out or when the session expires. No tracking purpose.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure operation of the application). No consent is required for technically necessary cookies.

8. Fonts

The font files are delivered locally. Your IP address is not transmitted to third parties in connection with loading the fonts.

The Inter font is licensed under the SIL Open Font License (OFL) and comes from the open-source project rsms.me/inter.

9. Disclosure to third parties

Your personal data is only disclosed to third parties if:

• you have given your explicit consent (Art. 6(1)(a) GDPR),
• this is necessary for the performance of a contract (Art. 6(1)(b) GDPR),
• there is a legal obligation (Art. 6(1)(c) GDPR), or
• legitimate interests require it and your interests do not override them (Art. 6(1)(f) GDPR).

We do not sell your data to third parties and do not use it for advertising purposes. Your country of origin is determined entirely on our own servers — your IP address is not transmitted to external geo services for any purpose.

Service providers used (processors)

• Hosting: Hostinger International Ltd. – servers in the EU
• Twitch: for OAuth login (only if you use this function)

10. Retention period

We only store personal data for as long as is necessary for the respective purpose or as required by statutory retention obligations:

• Server logs: 30 days
• Login and security log (app): 90 days
• Account data: Until the account is deleted (+ 30 days buffer)
• Contact emails: Usually up to 2 years
• Session cookies: Until logout or session expiry

11. Browser extension “CasinoLayers Now Playing”

The optional browser extension “CasinoLayers Now Playing” automatically detects the casino game currently being played and reports it to CasinoLayers in order to update the overlay.

Which data is collected?

On the supported casino pages opened by the streamer themselves, the extension reads:

• the URL of the game frame, and only on the domains of the supported game providers (Pragmatic Play, Hacksaw Gaming, Nolimit City, Relax Gaming, Push Gaming),
• the game ID contained in it (gameSymbol / gameId),
• the title of the game frame as a readable game name.

The extension reads no other page content, no account balances, stakes or casino login details, no browser history and no data of other people.

Locally in the browser (chrome.storage), the extension stores the connection token, the app URL as well as the last reported game and the time of the last report. This data only leaves the browser in the form of the reports listed below and is deleted when the extension is removed.

Which data is transmitted?

• source (provider abbreviation, e.g. “pragmatic”),
• externalId (game ID),
• optionally title (game name from the frame title),
• x-extension-token (dedicated, rotatable channel token).

The transmission is encrypted (HTTPS) and goes exclusively to CasinoLayers (app.casinolayers.de) when a game is opened, switched or closed.

Purpose & legal basis

The data is used exclusively to display the game currently being played in the stream overlay.

Legal basis: GDPR Art. 6(1)(b) (performance of a contract / use of the service) and (f) (legitimate interest in providing the overlay service).

Retention period & disclosure

• Current game: only the respective current game; it is overwritten with every switch and deleted as soon as no game is open any more.
• Game IDs not yet assigned (for maintaining the slot catalogue): until the channel or account is deleted.

There is no disclosure to third parties and no sale of data. Hosting in our own Kubernetes cluster (Infomaniak). Redis for real-time updates.

12. Your rights

You have the following rights towards us regarding your personal data:

• Access (Art. 15 GDPR): You can request information about the data stored.
• Rectification (Art. 16 GDPR): You can request the correction of inaccurate data.
• Erasure (Art. 17 GDPR): You can request the deletion of your data unless statutory retention obligations prevent this.
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR): You can object to processing based on legitimate interests.
• Withdrawal of consent (Art. 7(3) GDPR): At any time with effect for the future.

To exercise your rights, please contact: info@casinolayers.de

You also have the right to lodge a complaint with the competent data protection authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC). For EU users, the respective competent national supervisory authority is responsible.

13. Data security

We use technical and organisational security measures to protect your data against manipulation, loss, destruction or unauthorised access. These include:

• SSL/TLS encryption of all connections (HTTPS)
• Passwords are stored exclusively as Argon2id hashes
• Optional two-factor login via authenticator app or passkey, mandatory for admin accounts
• Overlay access via secure tokens without login data
• Regular security updates and dependency checks

Our security measures are continuously improved in line with technological developments.

14. Changes to this privacy policy

We reserve the right to amend this privacy policy in order to adapt it to changes in the legal situation or to changes in the service and data processing. The current version is always available at casinolayers.de/datenschutz. Please check the content of the privacy policy regularly.