Privacy Policy · Slot Check™

1. Who is responsible

Slot Check™ is operated by Jay Fructose; it is built and maintained by Ames Create, which processes data on the operator's behalf. Privacy questions and requests go to support@jayfructose.com. This policy covers the app at https://slots.jayfructose.com. It does not cover Patreon, Discord, or any casino; those have their own policies.

2. What we collect, and why

Your photo

Photos submitted for a check are kept privately, without exact position or contact details attached, to improve the reader and Jay's coverage. They are never shared or published outside the service providers that process and store them for us, and can be deleted on request through support at support@jayfructose.com. Check records use an opaque member reference so support can find and delete them. Photos are resized and embedded metadata is stripped before private storage. When you grant browser location permission, we keep the casino name, never your exact position.

Anthropic processes the image under its commercial API terms, which do not permit it to train on customer inputs, and retains inputs only for the limited period its policy allows for operating and abuse-monitoring purposes. We have no control over, and do not receive, anything Anthropic retains.

Please keep people out of the frame. The app only needs the screen and meters. If a photo includes other people, their faces, or anything else you would not want transmitted, do not upload it.

Casino catalog coordinates use OpenStreetMap contributors and Wikidata.

Cookies

Essential cookies. These are the ones the Service cannot run without.

jsc_sess is a signed session cookie set when you sign in with your email link. It keeps you signed in and can be ended at any time by signing out.
jsc_mob is a signed, randomly generated unlock token set when a device is unlocked with an access code. It tells the app this device belongs to a member. It contains no personal information, lasts up to 90 days, and can be revoked individually.
jsc_caps is a signed counter of how many checks this device has used today. Lasts about 36 hours.

Analytics cookies. Google Analytics sets first-party cookies (named _ga and _ga_ followed by a property code) to tell one visit from another and one returning browser from a new one. They last up to two years and you can remove or block them at any time in your browser, or with Google's opt-out browser add-on, without losing access to the Service. See “Site analytics” below.

We do not set advertising cookies, we do not use fingerprinting, and no cookie we set is used to build an advertising profile or to track you across other websites.

Usage counters (rate limiting)

To keep the Service fair and affordable, we keep short-lived counters in a hosted Redis store (Upstash): checks per unlock token per day, checks per IP address per minute and per day, wrong access-code attempts per IP, and a global daily total. These counters contain your IP address (as part of the key) and a number, nothing else, and expire automatically within about 30 hours.

Site analytics

We use two measurement tools to see how the site itself is used: which pages get opened, how people move through sign-up and checkout, roughly where visitors are in the world, and what browser and device type they are on.

Google Analytics 4. A Google script runs in your browser and sends Google page views and similar events along with the cookie identifiers described above, your user agent, your screen size, the page you are on and the page you came from. Google receives your IP address in order to derive an approximate location (country and region level) and, under its documented behaviour for Analytics 4, does not log or store that IP address. We have not enabled Google Signals, advertising features, or any link between this property and an advertising account, so this data is not used to show you ads. Google's handling of it is covered by the Google Privacy Policy.
Vercel Web Analytics. Our host's own page-view counter. It sets no cookies and builds no cross-site profile.

You can stop Google Analytics on your own device by blocking the cookies above, by installing Google's opt-out browser add-on, or by using any tracker blocker. None of that affects your account, your checks, or your ability to use the Service.

Read telemetry

For every check we record one line of anonymous diagnostics so we can answer questions like “is photo quality costing members verdicts?”: the game name the model read, whether the two reads agreed, the verdict and which rule produced it, how many meters were visible, whether a bet amount was legible, how long the read took, and the upload size. This data contains no image, no cookie value, no access code, no IP address, and nothing that identifies you. It is written to our hosting provider's logs and may also be copied to a spreadsheet we control.

Hosting logs

The app runs on Vercel. Like every web host, Vercel records standard request metadata (IP address, user agent, timestamp, path, response code) for security and operations, retained for a limited period under Vercel's policy. We use this only to keep the Service running and to investigate abuse.

Your account (optional)

If you sign in with email, we store: your email address, when the account was made, whether you accepted the Terms, your plan and where it came from (a code or a Stripe subscription), your pack-credit balance, any banked roll-over checks, a per-month count of checks used, lifetime counts of checks attempted, checks charged and PLAY verdicts (these drive your status tier and your leaderboard position), your rewards record (bonus scans held and earned, scans counted toward rewards, and the Vegas dates of your daily check-ins), your display handle if you have one, and your Stripe customer and subscription identifiers. Sign-in links are single-use tokens that expire in 15 minutes; sessions are signed cookies you can end any time by signing out. There is no password to store. If you pay by card, the card details go to Stripe — we never see them. Email support@jayfructose.com to have your account deleted.

Emails we send to your account

Two kinds. Sign-in and account email (your magic link, a receipt, a notice about your plan) is part of the Service and you cannot opt out of it while you have an account. Product email about Slot Check features, plans and offers goes out occasionally to the address on your account; every one of those carries a one-click unsubscribe link, and unsubscribing stops the product email without touching your account, your plan or your sign-in links. Our email provider (Resend) records whether a product email was opened and which links in it were clicked, so we can tell whether an email was worth sending, and we keep our own copy of those records in our database keyed to a one-way reference rather than to your address. That measurement stays inside the email: it does not follow you around the web and it is never used for advertising.

Emails you send us

When you email support, we keep that conversation (your address, what you wrote, and our replies) so we can answer you and pick up where we left off. We look up your Slot Check account to help, and the text of your email is processed by our AI provider (Anthropic) to help prepare a reply that a member of our team reviews. Asking to unsubscribe by email works the same as the unsubscribe link.

Beta waitlist emails

If you join the beta waitlist on our homepage, we store the email address you give us, when you joined, and which page you signed up from, so we can email you when the beta opens and send at most an occasional launch-related update. We send a confirmation when you sign up. These addresses are not shared with anyone, are not used for advertising, and are deleted on request — reply to any waitlist email or write to support@jayfructose.com and we'll remove you.

What others can see

Slot Check has a public leaderboard. If you are on it, anyone visiting the site, signed in or not, can see your display handle, your rank, your status tier, and your counts of machines checked and plays found. Your email address is never shown to anyone anywhere in the app, and handles are not derived from it. Everyone with a charged check is given a randomly generated two-word handle; you can change it or remove yourself from the board at any time from your account page, and removing yourself takes you off the public list while your own counts keep working. Nothing else about you appears on any screen another person can see.

What we do NOT collect

No name, phone number, address, or payment-card details (cards go directly to Stripe), and no account at all unless you choose to sign in.
No saved exact position or background location tracking. After a scan, Slot Check may ask whether to add the casino to your scans. It asks at most three times and then stops for good. Only if you say yes does your browser ask for location, and your browser decides. Sharing is optional. With permission, the browser requests a position when you open the camera to find the nearest casino, then discards it. Camera-roll photos are not tagged with your current location. We keep only the casino, how it was selected, and approximate accuracy rounded to 50 metres. None of it is shared with any casino, operator or venue, and we do not sell or license it to anyone. Your device remembers how many times you were asked, when, and whether you said yes, so we do not ask again. We also record whether a scan's location attempt was allowed, refused or timed out, with no position attached. You can revoke location permission in your browser settings at any time, and turn the request back on from your account page. We never read a photo's embedded metadata. Note that a photo your phone saved with location metadata may carry it to the AI vendor as part of the file; large photos are re-encoded on your phone before upload, which strips it.
No contacts, no camera access outside the moment you take a photo, no background activity.
No advertising identifiers, no cross-site tracking, no data brokers.

3. How we use information

To deliver the check you asked for and show you the result.
To recognise member devices, enforce daily limits, and stop brute-force or automated abuse.
To improve read accuracy and the playbook using aggregate, anonymous telemetry.
To measure how the site is used, so we can see what is working and what is broken.
To run the status tiers and the public leaderboard.
To keep the Service secure and comply with law.
To email you about your account, and to send occasional product email you can unsubscribe from with one click.

We do not sell personal information and we do not share it for cross-context behavioural advertising.

4. Who we share with

Anthropic — receives your photo to transcribe it, and the text of emails you send support to help prepare a reply (Section 2). United States.
Vercel hosts the app, stores the private check photos, and processes request logs. United States.
Upstash — stores the short-lived rate-limit counters. United States.
Resend — sends sign-in and product email, and records delivery, opens and clicks for product email. United States.
Google receives site analytics events through Google Analytics 4 (see Section 2), and receives anonymous telemetry if it is mirrored to a spreadsheet we control. United States.
Law enforcement or others when required by law, or to protect the rights and safety of members, the public, or us.

Neon stores the check records (game, meters, verdict, an opaque member reference) and our own copy of the delivery, open and click events for product email, each row keyed to a one-way reference rather than an address. No contact details are in either set of records. United States. Neon also holds support conversations (Section 2), which do include your email address because we need it to reply.

Each vendor acts on our instructions as a processor for the data it receives.

5. Retention

Private check photos and check records: retained to improve the reader and coverage until deleted on request through support.
Unlock cookie: up to 90 days, or until revoked. Cap cookie: about 36 hours.
Rate-limit counters: expire automatically within about 30 hours.
Anonymous read telemetry: retained indefinitely; it contains nothing that identifies you.
Hosting logs: per Vercel's retention schedule.
Google Analytics data: per Google's retention schedule for the property, currently 14 months for user and event data.
Product-email delivery, open and click records: retained while the account exists, keyed to a one-way reference.
Support conversations: retained for up to two years after the last message, or deleted sooner on request.
Your account record, including the counts behind your status tier and leaderboard position: retained while the account exists, and deleted when you ask us to delete the account.

6. Your choices and rights

Stop using the app: clear the site's cookies to end access on that browser. Scan records and private photos already stored remain until you ask us to delete them.
Revoke a device — email us and we will revoke the unlock token for a device you believe was copied.
Access / deletion requests: to have your account, check records or private photos deleted, email support@jayfructose.com and we will respond within 30 days.
Residents of California, Colorado, Virginia, Connecticut, Utah, and other states with privacy laws have rights to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information as those laws define it, and we do not discriminate against anyone who exercises a right.
If you are outside the United States, note that all processing happens in the United States.

7. Security

Cookies are signed with a server-side secret, marked HttpOnly and Secure, and verified on every request. Unlock tokens are unique per device and individually revocable. The engine, the playbook, and the AI prompts run only on the server and never reach your browser. All traffic is HTTPS with HSTS, a strict Content Security Policy, and no-store caching on every API response. No system is perfectly secure, but we have designed this one to hold as little as possible so there is little to lose.

8. Age

The Service is for adults 21 and older. We do not knowingly collect information from anyone under 21, and under 18 is never permitted. If you believe someone under age has used the Service, contact us and we will revoke their access.

9. Changes

We will update this policy when our practices change and bump the effective date above. Material changes will be announced in the Patreon Discord or in the app.

10. Contact

support@jayfructose.com. See also the Terms of Use and Responsible Play.

What we keep. What we don't.