Security & Trust

Purchases are processed through Stripe. We currently operate in test mode, which means:

• Real card numbers are accepted, but no actual money is charged or transferred.
• You can use Stripe test cards (for example, 4242 4242 4242 4242) to simulate purchases.
• Gold Coins and Sweeps Coins are credited to your wallet automatically after a successful checkout session.

When we move to live mode, this page will be updated and we will display appropriate disclosures before any purchase.

Your account data, game history, and wallet balances are stored in a managed PostgreSQL database provided by our hosting platform. Key practices include:

• Row-Level Security (RLS) is enforced on user tables. You can only read and modify data that belongs to your account.
• Sensitive operations (bet placement, win crediting, package purchases) are handled through restricted database functions callable only by authenticated service processes.
• Passwords are never stored in our database. Authentication is handled by the platform’s auth system using standard hashed credential storage.

We use the platform’s built-in authentication system. Users sign up with an email and password. Sessions are managed with time-limited access tokens and automatic refresh rotation.

• All authenticated API calls are validated server-side; there is no client-side bypass.
• Game endpoints and wallet operations require an active, verified session.

We use first-party cookies and local storage to keep you signed in and remember your currency preference (Gold Coins vs. Sweeps Coins). We do not use third-party advertising cookies.

Basic usage metrics may be collected to improve performance and stability. We do not sell personal data to third parties.

Game history and transaction logs are retained for operational and compliance purposes. If you want to delete your account and associated data, contact us at the email below. We will process verifiable requests in accordance with applicable US state privacy laws.

If you discover a vulnerability or suspicious activity, please email us directly:

foam-party-zodiac@duck.com

• Please include a clear description, steps to reproduce, and any evidence (screenshots, URLs, timestamps).
• Do not exploit vulnerabilities beyond what is necessary to demonstrate the issue.
• We aim to acknowledge reports within 72 hours and will keep you updated on remediation progress.