Privacy Policy

• Account data: email address, display name, password hash, account creation date.
• Financial data: crypto deposit addresses, transaction hashes, balance and prize history.
• Gameplay data: boxes opened, items won, seeds and nonces used for fairness verification.
• Technical data: IP address, approximate country, device and browser information, timestamps.
• Verification data: identity documents and shipping details, only when a physical prize or large withdrawal requires it.

• To operate your account, deposits, box openings and prize delivery.
• To enforce our restricted-jurisdiction rules — your IP address is used to determine your country, to block access from sanctioned regions, and to display an informational notice to visitors from the United States and the United Kingdom.
• To detect fraud, multi-accounting and abuse.
• To meet anti-money-laundering and record-keeping duties under São Toméan law.
• To send service notices about deposits, wins and security events.

When you load the site we read the country associated with your IP address from our edge network. We do not store precise location data and we do not use GPS. If your country is sanctioned, service is refused; for US and UK visitors we only show a notice. Country and IP are retained in security logs for fraud and compliance purposes.

Access to sensitive records (opening history, win history, admin actions) is written to a tamper-evident audit log secured with a SHA-256 hash chain. Logs are reviewed for repeated denied access and unusual read volumes, and are purged automatically after the retention period configured by the operator.

We do not sell personal data. We share it only with: our hosting and database provider, our crypto payment processor for deposit settlement, shipping partners for physical prizes, and competent authorities where we are legally required to do so.

Account, transaction and verification records are kept for the period required by São Toméan AML rules and for as long as your account is open. Security and access logs are kept for the configured retention window and then purged or archived.

• Access a copy of the data we hold about you.
• Correct inaccurate account details from your dashboard.
• Request deletion, subject to our legal record-keeping duties.
• Object to marketing messages at any time.

Send requests to privacy@doodly.cc. We respond within 30 days.

We use strictly necessary storage for your login session, language choice and interface preferences (such as your selected tab and saved filters). We do not run third-party advertising trackers.

Doodly is strictly for adults aged 18 or over. We delete any account found to belong to a minor and return the remaining deposit balance to source.

Questions about this Policy: privacy@doodly.cc. See also our Terms of Service.