Privacy policy
Updated 22 September 2026
Privacy by default
The public leaderboard shows only login and points. Email and Telegram are not shown to other players or used for advertising. Delete them with your profile in the Profile menu.
1. Scope and international principles
This policy covers the free XTAP points beta at xtap.games and its game API. It follows transparency, data minimization, purpose limitation, security and user-control principles reflected in GDPR and Convention 108+. These instruments apply only where relevant to the operator or user; mandatory local rules remain applicable. The beta accepts no stakes, payments or wallets.
2. Data operator and contact
The XTAP operator determines the purposes and means of processing. Send data questions and access requests through the official X or Telegram channels below. Before a public commercial launch, the site must also publish the operator’s full legal name, registration country, address and dedicated privacy contact; this beta policy does not replace those details.
3. Data processed
Profile: login, email and optional Telegram handle. Game: UP/DOWN predictions, round results, points and action times. Security: an irreversible HMAC hash of a random device key and a protected session cookie. Technical: the server or hosting provider may briefly process IP addresses and standard HTTP data for delivery, logging and abuse prevention. The service does not request passwords, payment details, seed phrases, private keys, identity documents or wallet addresses.
4. Browser storage
The browser stores a random device key, selected language and ID of the last displayed result. Email, Telegram and session tokens are not stored in localStorage. The session cookie is HttpOnly and inaccessible to JavaScript.
5. Purposes and grounds
Profile and game data fulfill your request for a profile and the functions in the participation terms. Optional Telegram stores a contact you voluntarily provide. The leaderboard displays public login and points. Security processing limits automation, protects profiles and diagnoses faults in the legitimate interest of maintaining the service. Limited data may be retained or provided when applicable law expressly requires it.
6. Public and private data
Only login and total points are public. Email, Telegram, user identifier, contact history and device key are excluded from the public API.
7. Recipients and international processing
Netlify Functions and Netlify Database (PostgreSQL) process the data. The landing page loads Google Fonts and a public Binance BTC/USDT price; these services may see visitor IP addresses and standard request data. They receive no email, Telegram, device key or game session. Google Analytics and advertising trackers are disabled in this build. Personal data are not sold. Hosting and technical providers may process data outside your country. Before production launch, the operator must identify actual processing countries and arrange required cross-border safeguards and processor agreements.
8. Retention
Profiles and game history remain until profile deletion or the end of the beta. Technical logs should be kept only as long as needed for security and diagnosis. If the operator enables backups, deleted records disappear through scheduled backup rotation.
9. User rights
Depending on applicable data-protection rules, you may request information, access, correction, deletion, restriction or portability, object to processing or withdraw consent where consent is the basis. You may contact your national data-protection authority. The Profile menu deletes your profile, contacts, predictions and points without support. Re-enter the same login in the same browser to update email and Telegram. For other requests, use the official contacts.
10. Device key and recovery
Email is a contact, not an account lookup or protection method. A public login and random browser key identify the profile. Signing out revokes the session but retains this browser’s key for signing in again with the same login. Other people using a shared browser can also sign in. Deleting the profile removes the key. Automatic recovery after clearing browser data or losing the device is not available in this beta.
11. Security and age
Production deployment uses encrypted connections, HttpOnly cookies, request limits, Origin checks and database transactions. No internet service can guarantee absolute security. The service is intended for adults aged 18 or older, not deliberate collection of children’s data.
12. Automated processing
The server accepts one prediction per round, compares price direction and awards game points. This affects only free-game results, not financial, credit or other legally significant outcomes.
13. Changes
This page and its version date are updated when data, processing countries, external services or game mechanics change.