Privacy *Policy*

SlotKabar collects no more than it needs to run. This page describes what we actually store and what we deliberately do not, and it matches the code that runs the site.

No sign-up to read anything

You need no name, email address, phone number or password to browse the directory, and we build no user profile that follows you around. The only sign-in on the whole site is the optional Telegram login, and it is needed for one thing: posting your own experience or a scam report on a site's page. If you never post, you never sign in.

How we count views

So that each listing can show how often it is viewed, we count visits. When you open a site detail page we combine your IP address, the id of that site, the day's date and a fixed salt string, then compute a SHA-256 hash. Only the hash is stored: the raw IP address is never written down and cannot be recovered from the hash. Because the hash differs for every listing and changes daily, it cannot follow you between sites or link one day to the next.

The record holds only the site id, the hash and the date, and exists solely to count one visitor once per site per day, which is why the totals you see are daily visitors rather than raw page loads. A routine cleanup deletes these rows once they are older than a day, leaving nothing behind but a running total against each listing.

• Our own servers never store: your raw IP address, name, email, location or device id
• We never build a profile of you, and we never track you across other websites
• Page-view statistics are collected by Google Analytics, described below

The age check stays on your device

When you confirm that you are 18 or over, a small flag named slotkabar.age18 is saved in your browser's localStorage, purely so you are not asked again on every page. It stays on your device and is never sent to our server. It is not an advertising cookie, and your browser's data settings clear it at any time.

What a site submission stores

If you fill in the submission form we store exactly what you typed: the site name, the URL, the tagline, the bonus, the minimum deposit, the payout time, the payment methods and the longer description, along with whether you sent it as a listing suggestion or a scam report, the time it was sent, and whether it is still pending, approved or rejected. We also store a hash calculated as above, so the limit of three submissions per person per day can be enforced. Unlike the view-counting rows, this hash stays until the record is deleted.

If you enter a phone number it must be the agent's or site's public contact number — it is published on the listing once approved. Never enter your own phone number.

The form is for public information about a gambling site or agent. Do not type your own name, phone number or account number into it.

What a community post stores

When you sign in, Telegram sends us your account number, your display name, your username if you have one and a link to your profile photo. We keep only the account number and the display name, and your phone number is never part of it. When you post, we store that account number, the display name, what you wrote, whether it is an experience or a scam report, which site it is about, the time you sent it, and its moderation status. Approved posts are public and the display name is shown beside them, so use a name you are content to publish.

The account number is kept because it enforces the daily posting limit and the one-post-of-each-kind-per-site rule; it is never published. Signing out clears the session cookie described below.

Cookies

Two cookies come from this site itself, and only when you sign in: signing in with Telegram sets a session cookie, and an administrator signing in sets an admin cookie. Both are HttpOnly, both are limited to what they are for, and neither follows you anywhere. If you never sign in, this site sets none of its own. Google Analytics separately sets its own _ga cookies for every visitor — see the Google Analytics section above.

Where the data lives

The site runs on Cloudflare's infrastructure and the records sit in a Cloudflare D1 database only the administrator can read. Traffic is encrypted with HTTPS. Because requests pass through Cloudflare, that company may keep operational logs under its own policy, and some fonts load from Google Fonts. On a site's own page, the Telegram sign-in button is a widget loaded from telegram.org, so Telegram sees that request; it is only ever loaded when the sign-in feature is switched on. Once you click through to a listed site you have left SlotKabar, and only that operator's policy covers what they collect.

Google Analytics

This site uses Google Analytics 4 to understand which pages people find useful — for example how many readers open the scam list, or which guide gets read most. It reports totals and trends, not individuals, and we never use it to look up what one named person did.

Google Analytics sets its own cookies in your browser (names starting with _ga) to tell a returning visit from a new one, and it sends Google your page address, referrer, approximate location from your IP, and basic device and browser details. In Google Analytics 4 your IP address is not stored by Google, and we have not enabled advertising features, remarketing or Google Signals on this property.

• The data is processed by Google and is subject to Google's own privacy policy.
• You can block it with any tracker-blocking extension, Google's official opt-out add-on, or your browser's Do Not Track / cookie controls — the site works exactly the same either way.
• We cannot connect Analytics data to a site submission, a community post or a Telegram account: those systems never share an identifier.

Things we do not do

• No advertising networks and no tracking pixels
• No advertising features, remarketing or Google Signals in Analytics
• We never sell, rent or trade data to anyone
• We build no user profiles and no interest lists
• No marketing email, because we collect no email addresses

Children

This site is for adults aged 18 and over, and we do not knowingly collect anything from anyone younger. If we learn that we have, we delete it.

Asking us to delete something you sent

If you sent us a site, a scam report or a community post and want the record removed, get in touch through the contact route shown on the site. Include the site name, the URL and roughly when you sent it, which makes it far easier to find; for a community post, the Telegram display name you posted under is enough. Once we can confirm the request we delete the whole record, stored hash included. One honest limit: the view counts are plain numbers identifying nobody, so your share cannot be isolated and removed.

If this policy changes, the date at the top of the page changes with it. Questions are welcome through the contact route on the site.