Privacy Policy
Last updated October 19, 2026 (Google Analytics, page speed and error reports).
This policy explains what Slots at Sea ("we") collects when you use slotsatsea.com and create an account, and how we use it.
What we collect
- Account details: your email address, display name, where you live (country group), and a securely hashed version of your password. We never store your password itself.
- What you choose to track: cruises, casino sessions (buy-ins, cash-outs, coin-in, points), program points and tiers, casino offers, budgets and saved finder settings.
- Confirmations: the date you confirmed you're of legal gambling age and accepted our Terms.
- Saved offer plans: scenarios, back-to-back plans and sailings you save in the offer tools.
- Security records: for each signed-in device, the browser and operating system (from its user agent), the country it connected from, and when it was last active. We also keep a log of account activity, like sign-ins, password changes and email changes, so you can spot anything you don't recognize. We don't store full IP addresses in these records.
- Email records: a log of the emails we send you (type, time and whether delivery worked), and single-use links for confirming your email or resetting your password, stored only in hashed form.
- Technical data: our hosting provider, Cloudflare, processes IP addresses and request logs to run and protect the site. We use IP addresses briefly to limit repeated sign-in attempts.
- Visit statistics: which pages are viewed, the site you came from, campaign tags in the link, your country, and your device type, browser and operating system. See Cookies and analytics for how visitors are counted.
- Google Analytics: how the site and its tools are used: pages viewed, clicks, scrolling, downloads, searches and forms sent, and the device and approximate location you visit from. See Google Analytics below.
- Error reports: if a page breaks in your browser, it tells our server what broke (the error message with numbers, links and email addresses removed, the script and line, the page address without IDs, and your browser's name). No cookies or identifiers are involved, so this runs for every visitor. Reports of blocked content (our Content Security Policy) are kept the same way.
How we use it
- To run your account and show your data back to you.
- To keep the site secure, including preventing abuse and brute-force sign-in attempts, and alerting you to sign-ins from a new device.
- To send you account emails: confirming your address, password reset links, and security notices (password or email changes, new recovery codes). These are always sent.
- To send reminders you can switch off in Dashboard → Settings or with the unsubscribe link in each one: offers about to expire, program years about to reset, and (if you turn it on) new Celebrity casino offer lists.
We don't sell your data, share it with cruise lines or casinos, or use it for advertising. Google handles Google Analytics data for us as described below. Emails are sent through Cloudflare Email Service.
Cookies and analytics
We count visits with our own analytics, stored in our database. Without analytics cookies, each visitor is counted using a code made from a random value that changes every day, combined with the browser and network address. We never store the address itself, and the code can't be linked from one day to the next.
If analytics cookies are allowed, we also set a first-party cookie with a random ID so we can see returning visitors and which sources lead to sign-ups. It isn't shared with anyone. If you're in the UK, the EEA or Switzerland, we only set it after you say yes. Elsewhere it's on unless you turn it off. Change your choice any time with Cookie settings.
Google Analytics
Every page, including the offer tools, loads Google Analytics (Google LLC), which sets the cookies below to measure visits, the pages you view, clicks, scrolling, downloads, searches and forms sent, and the device and approximate location you visit from. We also tell it when someone saves an offer plan, starts or completes VIP checkout, or uses a tool such as the finder, using only fixed labels like the kind of plan. We also measure how fast pages load and respond (Core Web Vitals). When you create an account, sign in, start VIP checkout or save an offer plan and we accept it, our server tells Google Analytics so (only what happened, such as "sign-up" or the kind of plan, linked to the same Google Analytics cookie), and only if you've allowed Google Analytics or live where no banner is needed. We send page addresses without the part after "?" and with anything that looks like an ID removed, and we never send your name, email address, what you type into forms or search, or your casino records.
- UK, EEA and Switzerland: Google Analytics stores nothing until you choose to allow it in the cookie banner; "Essential only" keeps it off.
- Elsewhere: it's on, and you can turn it off any time in Cookie settings.
- Do Not Track and Global Privacy Control: if your browser sends either signal, we load no Google script and our server sends Google nothing.
Your choice is remembered in your browser. Google Analytics keeps this data for 14 months. Google may use it as its terms allow; see How Google uses information from sites that use its services.
| Cookie | What it's for | How long | Type |
|---|---|---|---|
| __Host-sas_session | Keeps you signed in (HttpOnly) | Up to 30 days | Essential |
| sas_li | Tells the site to show "My dashboard" instead of "Sign in". No personal data. | Up to 30 days | Essential |
| sas_consent | Remembers your cookie choice | 180 days | Essential |
| ga-consent | Remembers your Google Analytics choice (stored in your browser, not a cookie) | Until you clear it | Essential |
| ga_consent | Tells our server you've allowed Google Analytics, so it may report accepted sign-ups and similar actions to it. Removed when you turn Google Analytics off. No personal data. | 1 year | Essential |
| sas_vid | Random visitor ID for returning-visitor and sign-up-source statistics (HttpOnly) | 13 months | Analytics |
| _ga, _ga_<ID> | Google Analytics measurement (see Google Analytics) | Up to 2 years | Analytics (Google) |
We keep our own visit statistics for 400 days; Google Analytics keeps its data for 14 months. When you delete your account, your sign-up and activity events are no longer linked to you.
Where your data is stored
Your data is stored in a Cloudflare D1 database and served through Cloudflare's network.
How long we keep it
We keep your data until you delete it or delete your account. Deleting your account permanently removes your account and everything you've saved. A scheduled job removes data we no longer need:
- Expired sign-in sessions: removed daily (sessions last up to 30 days).
- Email confirmation and password reset links: expire after 48 hours, 24 hours (email change) or 1 hour (password reset), and are deleted a week later.
- Account activity log: 180 days.
- Email send log: 90 days. After you delete your account, its entries are no longer linked to you.
- Records of which reminders we've sent: about 13 months, so we don't send the same reminder twice.
Your choices and rights
- Access and export: download all your data from Dashboard → Settings → Export my data.
- Correction: edit or delete any entry in your dashboard.
- Deletion: delete your account from Dashboard → Settings.
- Emails: choose which reminders you get in Dashboard → Settings → Email reminders.
- Devices: see where you're signed in and sign out any device in Dashboard → Settings → Security.
Depending on where you live (for example the UK, EU or California), you may have additional rights under data protection law. Contact us to use them.
Age
The site is for adults of legal gambling age. We don't knowingly collect data from anyone under 18.
Contact
Questions about your data: privacy@slotsatsea.com.
Changes
If we change this policy, we'll update the date at the top of this page.