Legal
Privacy Policy
This policy covers the Zestix Studios website, its public game demos and business enquiries. The demos use valueless virtual credits. They do not offer deposits, withdrawals, payments or real-money wagering. Demo status does not mean that no data is processed.
Who is responsible and how to contact us
Zestix Studios operates this website and determines how its demo and enquiry records are used. For privacy questions or requests, contact contact@zestix.co.
Information used by the demos
Bottle Shot, Vault Reveal, Hopscotch and Vault Heist can store session and round identifiers, virtual balances, bets and returns, selected actions, round status, timestamps, retry/request receipts and private game outcomes. These records let the server maintain the game, resume a session, complete rounds correctly, prevent duplicate balance changes and investigate problems. A random session identifier is not your name, but it can link actions within a session; we do not treat every session-linked record as anonymous.
Depending on the demo, retained technical records can also include coarse device/browser information, hashed network or session identifiers, and connection, reload, retry or error signals. Rate-limit and access-control identifiers are hashed in the game implementations. Hosting and other infrastructure providers separately receive connection information and may keep technical logs, including IP addresses and request headers. A statement about hashed game records is not a statement that providers never receive an IP address.
After the 18+ confirmation, Vault Reveal sends its session and game-action requests directly from your browser to our existing Supabase game service in Ireland. Supabase therefore receives the connection information and request headers for those requests directly. Vercel still serves the website files. This routing change does not send unrevealed outcomes to your browser or add advertising tracking.
New Vault Reveal rounds retain the original fixed nine-position board on the server with the round's model version. After a zero-payout round settles, the same session can receive the actual unused symbols for an informational display. This read does not change the balance or create new outcomes. Older sequential-model rounds retain their separately stored decorative display records and original rules; those historical records are not rewritten.
New-round technical records
New rounds can record coarse device type, operating-system and browser family/major version, viewport class, touch capability, public/test classification, and explicit reload, retry or automatic-completion events. Country is recorded only if a trusted network source has been verified; otherwise it stays unknown. These new metadata fields do not store raw IP addresses or raw User-Agent strings. They do not use GPS or create a persistent hardware fingerprint. Earlier records are shown only with the information actually retained.
Our own optional test-device setup stores a classification token and label only in the current browser tab, for up to four hours. Ordinary visitors do not need it. It changes the classification of future rounds, not the game's outcomes. The setup page is not an admin login. The restricted operator interface can read retained game records through a dedicated read-only connection after promotion; login and page-view audit records remain separate.
Necessary browser storage
Different demos use necessary cookies, local storage or session storage for an opaque session credential, pending actions and request IDs, virtual progress, language or sound settings, and a local 18+ confirmation. Cookie-based demo credentials can last up to 30 days; browser-stored settings or credentials can remain until you clear them. These durations do not set the lifetime of server records. Clearing browser storage may remove your ability to resume a session and does not by itself erase server-side history.
We do not currently add advertising or third-party analytics cookies. Necessary game storage and provider operational logs still apply. The homepage loads fonts from Google Fonts; those requests send connection information to Google even though they are not advertising analytics.
Business enquiries
If you submit the contact form, we receive the work email, selected area of interest and message you provide. FormSubmit processes the submission and delivers it to Zestix Studios. We use it to respond and manage the business enquiry. Please do not submit passwords, session tokens, payment details or other sensitive information.
Why we use this information
We use demo records to provide the requested game, preserve progress, keep virtual-credit accounting consistent, prevent abuse, troubleshoot faults, answer support requests and understand aggregate use. We rely on our legitimate interests in operating and securing these services. For business enquiries, processing also supports responding to your request and discussing a potential business relationship. Where a separate consent is legally required for an optional feature, we will request it before enabling that processing.
Service providers and international processing
- Supabase: database and server-side demo services. The currently configured demo database is hosted in the EU, Ireland. Infrastructure and support processing are also subject to the provider's terms and safeguards.
- Vercel: public website and frontend delivery, including the technical connection data needed to serve and secure requests.
- FormSubmit and email delivery services: handling the business messages you choose to send.
- Google Fonts: delivery of website fonts and the associated technical requests.
- Cloudflare: hosting of our separate, restricted administration interface and its short-lived login sessions. The restricted back office reads retained game records through a production read-only role. Its separate login and page-view audit storage remains in the staging/control project. It is not a public player account portal.
Authorized personnel and the providers needed to deliver these services may access the relevant records. Access is restricted by role and purpose. Providers may process technical or support information in other countries; the database's EU location does not mean that every website, log or support operation occurs only in Ireland. International processing is subject to the relevant provider's terms and data-processing arrangements. Contact us for information about the destinations and safeguards relevant to your request.
How long information is kept
Public demo records are kept while needed for session recovery, correct round completion, duplicate-request protection, security investigations, unresolved support requests or applicable legal obligations. A single automatic deletion period has not yet been enabled across all public demo stores. Do not assume that every public round, receipt or provider log disappears after seven days. You may ask us to locate, review or delete the records connected to your session; an active round or an unresolved integrity issue may need to be handled first.
A seven-day cleanup policy is used for eligible records in the separate staging/test environment. Open or recently active sessions and stores awaiting coordinated sidecar cleanup are deferred. Current balances/session shells and eligible daily aggregates remain. This test-environment setting is not the public demos' production retention promise.
Business correspondence is kept while needed to answer the enquiry, manage an ongoing discussion or partnership, and address applicable record-keeping or legal claims. Infrastructure logs, backups and copies downloaded for support have separate lifetimes and are not covered by the staging history timer. Deletion requests are assessed across the relevant stores and providers. Aggregated information that no longer identifies or links to a person can be retained separately.
Your choices and rights
Depending on applicable law, you may request information about processing, access, correction, deletion, restriction, objection or a portable copy of eligible data, and withdraw consent where processing relies on consent. You may also complain to the competent data protection authority or court. Email contact@zestix.co. We may need proportionate information to verify the request and locate the relevant session. A round ID and approximate time can help; do not send a session credential or password by email.
Providing game actions and necessary session data is required to run or resume a server-backed demo. You can choose not to launch a demo or submit an enquiry. You can clear browser storage through your browser settings, subject to the resume limitations explained above.
Security, age and external links
We use encrypted connections, restricted administrative access and separate server-side credentials. Access credentials and active-round hidden outcomes are not public game-history fields. Vault Reveal discloses original unplayed positions only to the same session after a settled loss; authorized private administration can inspect the stored board. The demos are intended for adults aged 18 and over; a local confirmation is not identity verification. If you believe a child's personal information has been provided, contact us so we can review it.
Links to Supabase, GambleAware, Gamecheck, X, LinkedIn and other external services lead to services with their own privacy practices. This policy is reviewed when the site's processing changes; the update date appears above.