Privacy Policy
Last updated July 2026
FoundInVegas Tracker ("FoundInVegas", "we", "us") is a personal casino bankroll & session tracker. This policy explains what we collect, why, and the control you have. Plain language, no dark patterns.
What we collect
Account info: your email address, a display name you choose, and your password (stored only as a salted scrypt hash — we never store or can see your actual password).
What you log: the trips and sessions you enter — game, buy-in, cash-out, time played, table minimum, casino, notes, and dates. This is your data.
Technical: a single signed, httpOnly session cookie to keep you logged in. We do not use third-party analytics, advertising trackers, or pixels.
How we use it
To run the app: authenticate you, store your sessions, and show your stats and charts.
To power the public leaderboard — but only if you opt in. See the next section.
The leaderboard (opt-in)
If you enable "Show me on the public leaderboard" (a checkbox at sign-up, toggle in your account), your display name and aggregate stats (net, ROI, win/loss record, session count, biggest single win) may be shown publicly and to logged-out visitors.
Your email is never shown. Aggregate site stats (totals across all players) may be shown without identifying you. Turn the toggle off anytime and you are removed from the board immediately.
Sharing
We don't sell your data and we don't share it with advertisers. Data is stored with our hosting/database provider (Railway) solely to operate the service.
Your controls
Export: download everything you've logged as JSON or CSV from your account page at any time.
Deletion: deleting a trip removes its sessions. To delete your account and all associated data, contact us and we'll remove it.
Age
FoundInVegas is intended for adults of legal gambling age in their jurisdiction (21+ in Nevada). It is a tracking tool only — it does not offer gambling or handle any money.
Changes & contact
We may update this policy; material changes will be reflected by the date above. Questions or deletion requests: reach the site operator through the account this instance is deployed under.