Privacy
policy
What we collect, why we collect it, and how to get it back or get rid of it. We do not sell your data to anyone, and we do not run advertising trackers on this site.
Last updated 21 July 2026
Demo build
This is a demonstration build of Scratch Card Joe. The wording below is a genuine draft written for this site, but it has not yet been reviewed by a solicitor. Final terms will be checked professionally before the site goes live.
Who is responsible for your data
Scratch Card Joe is the data controller for scratchcardjoe.com. That means we decide what personal data is collected here and what happens to it.
This policy explains how we handle your personal data under the UK GDPR and the Data Protection Act 2018. If anything here is unclear, email info@scratchcardjoe.com and we will explain it properly.
What we collect and why
We keep this deliberately small. Below is everything we hold about a registered user, what it is for, and the lawful basis we rely on.
| What | Detail | Why | Lawful basis |
|---|---|---|---|
| Account identifiers | Your user ID, the sign-in provider you used and the ID it gives us, and your email address if the provider supplies one. | To create your account, sign you in and keep you signed in. | Contract |
| Username and avatar | The display name you choose and your avatar or chosen preset. | To identify you on leaderboards, win listings and your profile. | Contract |
| Date of birth | The date you give us at signup, and your 18+ confirmation. | To verify you are old enough to use a site that carries gambling advertising. | Legal obligation / legitimate interests |
| Joe Coin ledger | Every coin movement — earnings, bonuses, card purchases and wins — with a timestamp. | To run the coin economy accurately, show your history and correct errors. | Contract |
| Watch sessions | When a watch session started, its heartbeats, and how many seconds were credited each day. | To credit you correctly, apply the daily cap and prevent automated farming. | Contract / legitimate interests |
| Game history | The cards you played, what they cost, what they returned and the audit record of each roll. | So results are auditable and disputes can be settled from a record rather than memory. | Contract / legitimate interests |
| Affiliate click counts | That a link was clicked, which casino it was for, your user ID if signed in, and a one-way hash of your IP address. We never store the address itself. | To count clicks for commission reconciliation and to spot fraudulent traffic. | Legitimate interests |
| Contact messages | The name, email address and message you submit through the contact form. These are sent to info@scratchcardjoe.com and are not stored in the site database. | To answer you. | Legitimate interests |
| Basic technical logs | Standard server and error logs, and aggregate page analytics. | To keep the site up, fix bugs and understand which pages are used. | Legitimate interests |
What we do not do
We do not sell or rent your personal data to anybody. We do not run advertising or behavioural tracking pixels on this site. We do not send marketing email — and if we ever wanted to, we would have to ask for your consent first, and you could withdraw it at any time. We do not collect special category data, and we never ask for payment details, because there is nothing on this site to pay for.
Where the data comes from
- From you — your username, date of birth, profile settings and anything you type into the contact form.
- From your sign-in provider — when you sign in with a third party such as Kick, Google or Facebook, they pass us an account identifier and, depending on the provider and your settings, a display name, avatar and email address. We do not receive your password.
- Generated by your use of the site — coin ledger entries, watch sessions, game results and click counts.
How long we keep it
- Account data — for as long as your account is open. Delete your account and it goes.
- Coin ledger and game history — kept while the account is open so balances are auditable, then deleted with the account.
- Watch sessions — daily totals are kept for up to 24 months for anti-abuse purposes, then removed.
- Contact messages — not stored in the site database. They reach us as email at info@scratchcardjoe.com and are kept in that inbox for up to 24 months after the conversation ends.
- Click records — hashed and aggregated; retained for up to 24 months for commission reconciliation.
- Server logs — typically 30 to 90 days.
Where we are legally required to keep something for longer, we will, and only for as long as required.
Your rights
Under UK data protection law you have the right to:
- Be informed — which is what this page is for.
- Access a copy of the personal data we hold about you.
- Rectification — have inaccurate data corrected.
- Erasure — have your data deleted, in most circumstances.
- Restrict processing while a concern is being looked into.
- Data portability — receive your data in a common machine-readable format.
- Object to processing we carry out on the basis of legitimate interests.
- Withdraw consent at any time, where we relied on consent.
Exercising any of these rights is free, and we will not treat you differently for doing so.
How to use your rights
Most of it is self-service. From your profile page you can update your username and privacy settings, hide yourself from public leaderboards, export your data, and delete your account outright. Deletion is immediate and permanent — your Joe Coin balance goes with it and cannot be restored.
If you would rather we did it, email info@scratchcardjoe.com from the address on your account, or use the contact form. We will respond within one month, as the law requires. We may need to verify who you are first — that is to protect your data, not to make it awkward.
Security
The site is served over HTTPS, sessions are held in a signed, HTTP-only cookie, and we do not store passwords because we do not use them — sign-in is handled by your chosen provider. Coin balances are server-authoritative and every movement is written to an append-only ledger, so tampering on the client achieves nothing.
Access to the production database is limited to the people who need it to operate the site. No system is perfectly secure, but if a breach ever affected your rights and freedoms, we would notify the Information Commissioner’s Office and you, without undue delay.
Children
This site is strictly for people aged 18 and over, and it is not directed at children. We do not knowingly collect data about anyone under 18. If we discover that an account belongs to a minor, we close it and delete the data. If you believe a child has created an account, please tell us at info@scratchcardjoe.com and we will act quickly.
International transfers
Some of our service providers process data outside the United Kingdom. Where that happens, we rely on UK adequacy regulations or on the International Data Transfer Agreement / UK Addendum to ensure your data receives an equivalent standard of protection.
Changes and complaints
If we change this policy, the updated version appears here with a new date at the top. Material changes will be flagged on the site.
If you are unhappy with how we have handled your data, please tell us first — we would much rather fix it. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.