Privacy Policy

Last updated: 18 October 2026

This policy explains what BigWinMaxxing (bigwinmaxxing.com) collects, why, who else handles it and how long we keep it. We wrote it from what the site actually does today, and we update it when that changes.

The short version: we collect what you need to have an account and post, we do not run ads, analytics only run if you say yes, we do not sell data, and we try to keep as little as we can for as short a time as we can.

Who we are

BigWinMaxxing is a community site about online slots: Engine game data, Bonus Hunts, Wins and discussion. It is not a casino. You cannot gamble, deposit or pay on BigWinMaxxing.

For anything about your data, email [email protected] and say that it is a privacy request.

What we collect

Your account

Your email address and password. We store the password only as a secure hash, never in readable form.
Your handle, your display name and your bio, if you write one. These are public.
When you joined, and an early member badge if you joined while it was offered.
When we last sent you a password reset email, so we can limit how many are sent.

We do not ask for your real name, date of birth, address, phone number or payment details. Your profile picture is an initial and a colour generated from your handle, so there is no photo of you unless you post one.

What you post

Posts, comments and likes. Posts and comments are public with your handle and display name. A like is stored with your account.
Wins. Images and short videos you upload. Before we store them we remove hidden metadata such as location, camera details and recording times. Only the colour profile of an image is kept.
Found Wins. A link to a win you found elsewhere, the platform and the winner’s name as text. We never download media from those links.
Bonus Hunts. Your hunts, games, bets and results. A hunt is private until you publish it. Other members cannot see a private hunt, and it is not counted anywhere public.
Stream Overlay. If you turn it on, a secret link for OBS that shows your current hunt. You can pause it or replace the link at any time.
Reports. If you report a post or a profile we keep who reported it, what was reported, the reason, your note and the moderation decision. Reports are seen only by moderators.

Your public profile shows your handle, display name, bio, badge, when you joined, your Maxxer Level and stats from what you chose to publish. Your Maxxer Level comes from taking part, never from money or bets, and the detailed breakdown is visible only to you.

The Random Slot Picker and the hunt calculator store nothing.

Analytics, only if you say yes

If you press Accept on the cookie choice, we use Google Analytics to see which pages and features get used, so we know what to improve. Nothing from Google loads until you press Accept. Decline or close the choice and it stays off.

What it counts. The type of page you open (for example “a profile” or “a post”, never which one), the site that sent you and a few actions: joining, starting or finishing a hunt, creating a post, turning on the overlay, connecting Kick, rolling the Random Slot Picker and opening a share to X. It also gets your browser, device type and rough location (country or city) from your connection.
What it never gets. Your email, handle, display name, the text you write, what you upload, your bets, wins or losses, your hunts, your Kick account or which profile or post you looked at.
How. Google Analytics sets cookies starting with “_ga” that let it recognise a returning browser. They last up to 2 years unless you clear them or withdraw. Google Signals and advertising features are off, and Google Analytics does not store your IP address.
Changing your mind. “Cookie settings” at the bottom of every page reopens the choice. If you withdraw, Analytics stops and we delete its cookies from your browser.

We keep your choice in your browser for 6 months, then ask again.

Technical data

Server logs. Like any website, our server logs each request with the IP address, the page, the time and your browser’s description. We use the logs to keep the site running and secure and delete them after 14 days. Application error logs are kept for up to 8 weeks.
Abuse limits. To stop spam and password guessing we count recent attempts to join, log in, ask for a password reset, comment and post. The counter is linked to a code made from your IP address and is deleted automatically, within an hour at most.
Comments. WordPress normally stores the IP address and browser of each commenter. We clear both as soon as a comment is saved.

What we do not collect

No advertising, no tracking pixels and no social media widgets, and no analytics unless you say yes (see Analytics above). Our fonts are hosted on our own server. Cloudflare, which delivers the site for us, can add small technical features of its own, for example a script that hides our email addresses from spam bots, or a check that a visitor is not a bot. We do not use them for advertising or to track you. Share links add only a small “ref=x” marker to our own links so a page knows it was opened from X. We do not record who clicks them.

Why we use it

To run your account and show what you post, because that is the service you signed up for.
To keep BigWinMaxxing safe: stopping spam, abuse and break-in attempts, handling reports and enforcing the community rules. We have a legitimate interest in doing this.
To understand which pages and features get used, through Google Analytics, only with your consent. You can withdraw it at any time in Cookie settings.
To send the emails your account needs: a password reset when you ask for one and a notice when your password changes. We do not send newsletters or marketing.
To meet legal obligations, for example if a court or authority lawfully asks us for information.

We do not use your data for automated decisions that affect you legally or significantly, and we do not build advertising profiles.

We do not sell or rent personal data. These service providers process it on our behalf, only as needed to provide their service:

DigitalOcean hosts our server and its backups in Amsterdam, in the European Union.
Cloudflare sits in front of the site to deliver it quickly and block attacks, so it handles every request, including your IP address. Cloudflare runs a global network, so this can happen outside the European Union.
Brevo sends our account emails (password reset and password changed). It receives your email address and the message. We have turned off its open tracking.
Zoho hosts our support mailbox. If you email us, your message is stored there.
Google runs Google Analytics, only if you accept it. Google processes this data for us and can process it outside the European Union, under the EU Standard Contractual Clauses.
Kick, only if you connect your Kick account. See Kick connection below.

When you choose to share something on X, X opens with the text and link and X’s own privacy policy applies. Game data on BigWinMaxxing comes from Engine’s public data. We send Engine no personal data.

We may disclose information if the law requires it, or to protect people from serious harm.

How long we keep it

Your account and what you post: until you delete it or ask us to delete your account.
Reports: as long as needed for moderation and to deal with repeated abuse.
Server logs: 14 days. Application error logs: up to 8 weeks.
Abuse counters: up to an hour.
Google Analytics data: 14 months, then Google deletes it.
Emails to our support mailbox: as long as needed to answer and follow up.
Backups: our server keeps nightly backups for 14 days, and backups taken before an update or by hand for 30 days. DigitalOcean also backs up the whole server once a week and keeps each of those for 28 days. When we test updates or a restore, we sometimes copy the site to a private test copy that only we can reach, with Kick connections removed. That copy and its weekly backups are kept for up to 8 weeks. All of these are deleted automatically, so deleted data can stay in a backup for up to about three months before the last copy is gone.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, to object to how we use it, or to receive it in a portable format. You can change your handle, display name and bio yourself in your settings.

Email [email protected] from the address on your account so we can confirm it is you. We aim to reply within one month. If you are unhappy with our answer, you can complain to your local data protection authority.

Deleting your account

Email [email protected] from the address on your account and ask us to delete it. We confirm by email when it is done. This is what happens:

Deleted: your account, profile (handle, display name, bio, badge), login sessions, Bonus Hunts, Wins and the photos and videos you uploaded, likes, your Stream Overlay link, and your Kick connection (we disconnect it through Kick first).
Deleted: your posts and comments, unless other members are part of the conversation.
Kept without your identity: a discussion or Found Win other members commented on, and a comment someone replied to. They stay so the conversation still makes sense, shown as “Deleted member” or “@deleted” with no link to you. If you want any of them removed too, say so in your email.
Kept without your identity: reports you made and moderation decisions about your content, for the moderation history.

Copies in backups are deleted automatically, as described in How long we keep it.

Cookies and storage

We use only what the site needs to work:

Login cookies, set when you log in or join, so you stay logged in. They last up to 14 days, or until you log out.
A short-lived cookie during a password reset, removed when the reset is done.
A note in your browser’s session storage that you already saw the logo intro, cleared when you close the tab.
Your cookie choice, kept in your browser’s local storage for 6 months. If you close the choice without answering, a note in session storage stops it asking again until you close the tab.

With your consent only: Google Analytics cookies, see Analytics. There are no advertising or tracking cookies. Cloudflare may set a strictly necessary security cookie if it needs to check that a visitor is not a bot.

18+ only

BigWinMaxxing is for adults aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a minor has an account, tell us at [email protected] and we will remove it.

Security

The site runs over HTTPS only. Passwords are hashed, Kick tokens are encrypted, access to our server is restricted, and uploads are checked and cleaned before we keep them. No system is perfect. If we ever have a breach that puts your data at risk, we will tell you and the authorities as the law requires.

Changes

We update this page when what we do changes and change the date at the top. If a change matters for how we use your data, we will also say so on the site.

Kick connection

Connecting a Kick account is optional. You start it from your BigWinMaxxing settings and approve it on kick.com. We use it to show your Kick channel on your profile and, if you turn it on, to run a chat bot for your Bonus Hunt.

What we keep

While your Kick account is connected we keep:

your Kick user ID, Kick username and channel name, which we need to keep the connection working and to link your profile to your channel
the permissions you approved on Kick
the access and refresh tokens Kick issued to us, encrypted with a key that is kept outside our database
when the tokens expire and when you connected
your chat bot settings: whether the bot is on, which commands it answers and whether it may answer hunt commands without your Stream Overlay

We refresh your Kick username and channel name from Kick regularly, so we only show current details.

What we do not keep

Your Kick password: you enter it only on kick.com and we never see it. Your Kick email address: Kick includes it when you connect, and we discard it immediately. Chat messages, chat history, viewer usernames or viewer Kick IDs.

Live status

While you are connected we ask Kick every two minutes whether your channel is live. We keep only the latest answer and the stream title, and we treat it as unknown after 10 minutes. Your public profile shows “Kick connected” with a link to your channel, and “LIVE ON KICK” while you stream.

The chat bot

The bot is off until you turn it on. Turning it on asks Kick for two more permissions: receiving the chat messages of your channel and sending chat messages. The bot only answers commands while your Kick channel is live.

While the bot is on, Kick sends us each message posted in your channel’s chat. We only check whether it starts with one of the bot commands, and every other message is discarded as soon as it arrives.

When a viewer uses a command, we use their Kick user ID once to apply a short cooldown. It is turned into a one-way code with a key that changes every day, the code expires after 30 seconds, and it is deleted from our server within a few minutes. We keep the IDs of the messages Kick sends us for about 10 minutes, only to ignore duplicates.

The bot’s replies are posted in your Kick chat by the BigWinMaxxing bot account. They are public on Kick, where Kick’s own terms and privacy policy apply.

Hunt figures in chat

Your Bonus Hunts are private on BigWinMaxxing unless you publish them. The bot answers hunt commands (!hunt, !avg, !be, !next) only while your Stream Overlay is on, or if you chose to let it answer without the overlay. Those answers include your hunt’s name and figures. The !level command shows your Maxxer Level.

How long we keep it, and how to remove it

We keep your Kick connection until it is removed:

You can disconnect Kick in your BigWinMaxxing Kick settings at any time. We stop the bot, ask Kick to remove our event subscriptions and revoke our tokens, and delete the connection data straight away.
If you remove BigWinMaxxing from your Kick account instead, our daily check notices that Kick no longer accepts the connection and deletes it the same way, usually within a day.
Deleting your BigWinMaxxing account deletes your Kick connection too.

Our database backups may still contain a copy of your Kick connection after you disconnect, for as long as the backup periods described in How long we keep it. Tokens remain encrypted in those backups, and the backups are deleted automatically when their retention period ends. The short-lived bot data described above is never included in backups.

What we send to Kick

BigWinMaxxing sends requests to Kick to maintain the connection, check your channel’s status, manage the bot’s event subscriptions and post bot replies when you have turned the bot on.

We use Kick data only to provide the Kick connection and the bot you set up, and only while they stay connected. We do not sell it or use it for advertising. The Kick connection adds no cookies. More about how the integration works: Kick on BigWinMaxxing.

Contact

Privacy questions, data requests and account deletion: [email protected].