twentynine.io Privacy Policy

Last updated: 17 October 2026

This Policy explains how twentynine.io handles information when you use its games, account features and Bitcoin wallet. For privacy questions or requests, email [email protected].

We currently accept Bitcoin (BTC) only. We may support other cryptocurrencies in the future. Before processing information for any additional supported asset, we will update this Policy and provide any notices and choices required by applicable law.

1 No KYC documents

We do not perform Know Your Customer identity verification, and we will never ask you to submit KYC documents. Do not send us a passport, national identity card, driving licence, identity selfie or proof-of-address document.

No KYC does not mean that we collect no information. Account records, browser information and public Bitcoin transactions can identify you or become linked to you. Passwords and authenticator checks verify access to an account, not a person's legal identity.

If a service cannot lawfully be provided without identity verification, we will restrict or discontinue the affected service. Our no-KYC policy does not override applicable law.

2 Information you provide

Account information. We store your username, display name, account identifier, creation and update times, and an email address if you choose to add one. When you create an account, we also record the version of the Terms, Privacy Policy and AML Policy presented to you and the time you confirm the account-opening agreement and minimum age statement. This records your declaration, not identity or age verification. We record email verification status. A verified email address enables password recovery and transactional account notifications.

Security information. If you set up account security, we store a password hash, an encrypted authenticator secret, authenticator setup status, hashed recovery codes and records of their use. The password you enter is processed to authenticate you; the account record stores its hash rather than the readable password. Session records include a token hash, browser user-agent description, expiry and revocation information.

Games and chat. We store participation, room and queue information, moves and other actions, results, relevant timing, fairness records and chat messages. Account records also include a selected game-exclusion end date.

Wallet information. We store account-linked deposit addresses, Bitcoin transaction identifiers and outputs, amounts, confirmation and block information, balances, reserved amounts, withdrawal destinations, fees, statuses and request times. Ledger records connect those activities to your account.

Support messages. If you contact [email protected], your message can include your email address, username, transaction identifiers and any other information you choose to provide. Do not send identity documents, private keys, seed phrases, passwords, authenticator codes or recovery codes.

3 Information received automatically or from other sources

Your browser sends technical information when it connects, including an IP address and browser request information. The application uses the signup connection's IP address to limit repeated account creation and saves browser user-agent information with sessions. Hosting and network services may also process request and error information to deliver and protect the site.

We obtain Bitcoin transaction and confirmation information from the public Bitcoin network through our node connection. We also retrieve public randomness used by certain fairness features. A public transaction can become personal information when it is associated with an account or other identifying information.

The site currently loads fonts from Google Fonts. When your browser requests those resources, Google receives the network information needed to serve the request, including your IP address and request headers. Google's handling of those requests is explained in its Privacy Policy.

4 Why we use information

We use account and session information to sign you in, maintain account access and apply security settings. We use game records to operate games, recover interrupted sessions, display history and check fairness evidence. We use wallet records to recognize deposits, maintain balances, prevent duplicate withdrawals and process Bitcoin transfers.

We also use relevant records to investigate errors and misuse, respond to support requests, administer account restrictions and meet our legal obligations. We will not use this Policy to justify collecting information for unrelated purposes.

Where applicable data protection law requires a legal basis, we process information necessary to provide the account, game or payment service you request to perform our agreement with you. We may rely on legitimate interests for security and abuse prevention where permitted, after considering the impact on your rights. We rely on legal obligations only when a specific requirement applies to us. If optional processing requires your consent, we will ask for it separately; using the site does not give blanket consent to every use of your information.

You need to provide the account and transaction details necessary for a feature to work. An email address is optional for ordinary account creation. If information necessary to process a payment or establish control of an account is missing, we may be unable to complete that request. This does not create a requirement to submit KYC documents.

5 Cookies and browser storage

The site uses two account-security cookies: tn_session keeps you signed in and tn_csrf helps protect account actions from unauthorized requests. Their configured lifetime is normally 30 days. Logging out clears these cookies and revokes the current session; it does not delete the underlying account records.

Browser local storage remembers your sound preference and game-mode choice. It also stores game seeds, fairness receipts, observed game information and pending actions needed to recover or verify your play. Some retained evidence can include your own cards or other private game observations. Deposit notification history stores transaction-output identifiers, associated with the account and Bitcoin network, to avoid repeating alerts.

Some interrupted withdrawal details and unfinished game choices are stored for the browser session. Persistent local storage has no fixed time-based expiry. It remains until the site replaces it, the browser removes it or you clear site data. Logging out does not necessarily remove these retained browser records.

You can use your browser settings to clear or block storage. Doing so may sign you out, remove saved preferences and destroy locally retained fairness evidence or request-recovery details. Clearing browser data does not delete server records or reverse a payment. Use care on a shared device.

The site does not currently use advertising or analytics trackers. Google Fonts creates an external resource request as described above. If we introduce optional tracking, we will explain it and provide any legally required choices before that tracking starts.

6 Information visible to others

Your display name, game participation and information shown in a game or room may be visible to other users. Messages posted in Lounge or Help chat are visible to room viewers. Do not use those rooms to send confidential account or payment information.

Completed fairness records may be available to participants or other viewers depending on the game. If you download or share a receipt, its game data can be seen by the recipient. Do not share private hands, game secrets or other confidential information in public chat.

Bitcoin addresses, transfers, amounts and transaction timing are recorded on a public blockchain. Anyone can inspect that network data and potentially connect it to information from other sources. We cannot erase, make private or recall information already recorded on Bitcoin, including after an account is closed.

We use Resend to deliver verification, welcome, password-reset, deposit and withdrawal emails from [email protected]. Resend processes recipient addresses, email contents and delivery metadata to provide this service. Payment notification emails can include amounts, status and transaction or request identifiers. We store hashed verification and reset tokens, expiry and use records, and delivery records to retry failed messages and prevent duplicates. Pending email contents are encrypted in our delivery queue and removed after successful sending, cancellation or expiry. These are service messages, not marketing subscriptions.

Information is processed by the people and infrastructure needed to operate the site, including hosting, network, storage and email providers. We will limit the information shared with service providers to what they need for their work. Google receives font requests directly from your browser as described above. Broadcasting a payment shares its transaction data with the Bitcoin network and the destination's operator or wallet provider where applicable.

We may disclose relevant information in response to a valid legal requirement, to protect against a security incident or fraud, or to establish or defend a legal claim where permitted. We will assess the request and limit disclosure to what the circumstances and applicable law justify.

We do not sell account or wallet information or use it for targeted advertising. A service provider processing information to deliver the site is different from publishing that information to other players.

Hosting, support and external resource providers can involve access from more than one jurisdiction. We will use the transfer arrangements and safeguards required by applicable law for transfers within our control. The public Bitcoin network is distributed worldwide; its public records cannot be limited to one location. Contact [email protected] for information about hosting and transfer arrangements that apply to your information.

8 Automated processing

Software determines game outcomes under the relevant rules, validates account access, applies request limits, credits deposits and processes withdrawals. Ordinary Bitcoin deposits credit after one confirmation.

Most withdrawals may be processed automatically. Some withdrawals may take longer or require manual review and approval before they are sent. A request may remain pending while a necessary manual review is completed. Manual approval does not involve requesting KYC documents. Automatic processing and immediate payment are not guaranteed.

For a manual review, we may use relevant account, security and transaction records to assess the request and resolve a specific security concern. The full payment terms are set out in our Terms and Conditions.

These checks use account, request, balance and blockchain information. They do not establish a person's legal identity. Contact [email protected] if you believe a record or automated outcome is wrong, and request review by a person. Any additional rights concerning automated decisions depend on the law that applies to the processing.

9 Retention and deletion

We retain information needed to operate an active account, preserve transaction records, resolve disputes, protect security and meet applicable recordkeeping duties. Retention depends on the record, the purpose for keeping it, unresolved requests or disputes, and any required legal period. We will not keep personal information longer than those purposes justify. Backups may also contain copies and are subject to the same retention principles.

Logging out or allowing a session to expire does not erase account, chat, game or wallet records. Account deletion and a complete personal-data export are not available through self-service settings. To request access, correction or deletion, email [email protected]. We will assess your request against the relevant records, your rights and our obligations.

Closing an account does not erase a public blockchain transaction. Some internal payment records may also have to remain for accounting, security, dispute or legal reasons. If we cannot fully grant a deletion request, we will explain the reason unless the law prevents disclosure. We will not reuse retained records for unrelated purposes.

10 Your privacy choices and rights

Depending on applicable law, you may have rights to access your information, correct inaccurate information, request deletion or restricted processing, obtain a portable copy, and challenge certain automated decisions. Where processing relies on consent, you may withdraw that consent without changing the lawfulness of earlier processing.

You may also have a right to object to processing based on legitimate interests. Explain the processing you object to when contacting us. We will consider that request under the law that applies.

Email [email protected] to exercise a right. We may need to establish control of the relevant account using a secure account-based process so that we do not disclose information to the wrong person. We will not ask for KYC documents, and you should not email account secrets. If control cannot be established securely, we may be unable to disclose the requested information.

We will handle requests within applicable legal deadlines, subject to any lawful exceptions. You may also complain to the competent data protection authority available to you under applicable law. Contacting us first does not remove that right.

11 Security and age restrictions

The site uses password hashing, protected authentication information, session controls and additional withdrawal authorization. These measures reduce risk but do not guarantee that information or funds can never be compromised. Keep your device and account secure, and report a suspected exposure to [email protected].

The service is intended only for people aged 18 or older, or the higher minimum age required where they are located. We do not run a KYC age-verification process. If you believe a child is using an account, contact us without posting their information in public chat or sending identity documents.

12 Updates and contact

We will update this Policy when relevant practices change and communicate material changes before new processing begins where required. The date at the top shows when this Policy was last updated. Questions, requests and complaints can be sent to [email protected].

Policy version 2026-10-17.5