Privacy Policy
Last updated: 28 October 2026
In short: you can play the free demo without an account. If you create one, we store your username, email and a scrambled (hashed) password to sign you in. We never ask for payment details. Your coins and progress are saved with your account on our servers; only display settings and your age confirmation stay in your browser. We do not sell your personal information. If the Google Ads tag is active (see section 6), it measures which ads lead to sign-ups.
This policy explains how Adenira s.r.o. handles personal information. We are established in the Czech Republic, so we follow the EU General Data Protection Regulation (GDPR). Because the Service is offered to people in Australia, we also follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It is our APP privacy policy.
1. Who we are and how to contact us
Adenira s.r.o., company ID (IČO) 23514868, registered office Klivarova 354/7, Háje, 149 00 Praha 4, Czech Republic. Registered in the Commercial Register kept by the Municipal Court in Prague (Městský soud v Praze), section C, file 428036. Email: support@aurorareef.com. We are the controller (GDPR) and the entity responsible (Privacy Act) for your personal information collected through aurorareef.com.
2. What we collect and why
Playing without an account. You can play every game without giving us any personal information. Demo coins stay in your browser.
Accounts (optional). When you sign up we collect and hold:
- Account data: your username, email address, a salted hash of your password (we cannot see your password), the date you signed up and sign-in sessions (stored only as a hash of the session token).
- Game data: your free virtual coin balance, the number of rounds played, your daily bonus streak and the time of your last coin bonus. Coins have no monetary value.
- Security data: to stop automated sign-ups and password guessing we briefly keep counters linked to an email address or IP address. They expire after one hour at most. To limit Shell Shuffle games we keep a counter linked to a one-way hash of your IP address for 24 hours.
- Shell Shuffle: when you pick a shell we store a random identifier of your browser, the number of bonus coins, the time of the game and, once you sign up, the account they were added to.
- Contact form: your name, email address, message and the time it was sent, used only to answer you and kept for up to 12 months.
Legal basis (GDPR Art. 6). Account and game data: performance of the contract you enter into when you create an account (Art. 6(1)(b)). Security data, server logs and contact messages: our legitimate interests in keeping the Service secure, preventing abuse and answering you (Art. 6(1)(f)). Optional advertising measurement (section 6): your consent where the law requires it (Art. 6(1)(a)).
Purpose. We collect this information only to provide the account and game progress you ask for, to answer your messages, and to keep the Service secure and free of abuse. We do not collect dates of birth, payment card data, identity documents or sensitive information, and we do not use your information for direct marketing unless you ask us to (you can opt out at any time; see section 8).
Collection notice (APP 5). We collect personal information directly from you through the sign-up and contact forms. If you do not provide an email address you cannot create an account, but you can still play the demo. We may be required to collect certain information where the law applies, for example to respond to a lawful request.
3. Data stored on your device
The site uses your browser's local storage (not cookies) only for the items below. They are strictly necessary to provide the Service you request; you can delete them at any time by clearing your browser's site data.
| Key | Purpose | Duration |
|---|---|---|
ar_token, ar_user | Keeps you signed in (session token, and your name and email for display). Only set if you sign in. | Until you sign out, max. 30 days |
ar_bar_closed (session storage) | Remembers that you closed the sign-up bar for the rest of this visit. | Until you close the tab |
ar_wallet | Your demo coin balance in this browser. If you create an account, the balance is sent once so it can be kept. | Until you clear site data |
ar_device, ar_pick | A random identifier of this browser and your Shell Shuffle result, so the bonus coins can be added when you sign up. | Until you clear site data |
ar_recent | The games you opened most recently, for the Recently played page. | Until you clear site data |
age_ok, age_no | Your answer to the "Are you 18 or older?" question, so it is asked only once and a "No" is remembered. | Until you clear site data |
fz_lock_until, fz_reminder_min | Responsible play tools on this device. | Until you clear site data |
fz_side_collapsed, fz_slot_sound, fz_slot_turbo, fz_bet_* | Display, sound and bet-size settings on this device. | Until you clear site data |
Apart from the Google Ads tag described in section 6 (only when it is active), we set no cookies. Fonts are hosted on our own server, so loading the site does not send your data to font providers.
4. Server logs
Like any website, our hosting provider and content delivery network process technical data such as IP address, date and time, requested page and browser type to deliver the site and keep it secure. Logs are kept only as long as needed for security and are then deleted.
5. Where your information is held and overseas disclosure (APP 8)
We are based in the Czech Republic (European Union). Your information is processed by the providers below, which act on our instructions:
- Cloudflare, Inc. (United States) hosts our Cloudflare D1 database in its Western Europe region, which holds account and game data, runs our server code (Cloudflare Workers) and delivers and protects the website as a content delivery network, so it sees the IP address and technical data of each request.
- Our web hosting provider, a server hosting provider with its data centre in the United States, serves the pages of the website and keeps server logs (IP address, date and time, requested page, browser type). It does not hold account or game data.
- Google LLC (United States), only if the Google Ads tag described in section 6 is active.
Some of these providers are located in, or may process data in, the United States, which is outside the EU/EEA and Australia. We rely on the EU Standard Contractual Clauses and, where a provider is certified, the EU-U.S. Data Privacy Framework. For people in Australia this means information may be disclosed to recipients in the Czech Republic, the European Union and the United States; we take reasonable steps to ensure they handle it consistently with the APPs. We do not sell or rent personal information and we do not share it with anyone else, except where the law requires it.
6. Analytics and advertising
Google Ads conversion tag. To measure whether our ads lead to visits and sign-ups we may use the Google Ads tag (Google LLC, USA). When it is active it sets Google advertising cookies (for example _gcl_au) and sends Google the pages you visit on this site, whether you created an account (a "conversion"), the ad click identifier, your IP address and browser and device data. We do not send Google your name, email address or account details, and we do not use the tag for remarketing or personalised advertising. Google processes this data under its own policies (see how Google uses information from sites that use its services). If your browser sends a Global Privacy Control signal, the tag is not loaded. You can also manage ad settings at adssettings.google.com.
We do not use any other analytics, advertising or tracking tools.
7. Security and retention (APP 11)
We protect personal information with access controls, encryption in transit (HTTPS), hashed passwords and session tokens, and restricted access to our database. We keep account and game data until you delete your account, sign-in sessions for up to 30 days, and contact messages for up to 12 months, after which they are deleted or de-identified. If a data breach is likely to result in serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) in line with the Notifiable Data Breaches scheme.
8. Access, correction and your rights (GDPR; APPs 12 and 13)
You may ask for access to the personal information we hold about you, ask us to correct it, delete it, restrict or object to its use, or receive a copy in a portable format. You may also ask us to delete your account and all its game data. Email support@aurorareef.com from the email address of your account. We will respond within 30 days and will not charge you for a request. If you have asked to receive messages from us, every message includes a way to unsubscribe, in line with the Spam Act 2003 (Cth).
9. Children
The Service is not intended for anyone under 18. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact us and we will delete it.
10. Complaints
If you think we have breached the APPs, please write to support@aurorareef.com with the details. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.
Because we are established in the EU you can also complain to the Czech data protection authority, the Úřad pro ochranu osobních údajů (uoou.gov.cz).
11. Changes
We will update this policy when our processing changes. The date at the top shows the current version.