DiceXo

Privacy Policy

This page explains what DiceXo records about you, why, who can see it, and what you can do about it. The short version: we collect what an account needs to work — a username, an email address, a password we never store in readable form, your bets and your deposits and withdrawals — plus the IP address and browser your sign-ins come from. We use no cookies, no analytics and no advertising trackers of any kind. Some of what you do here is public to other players by default, and you can turn that off. This page describes what the site actually does today, including the parts that are done and the parts the site cannot do at all.

Last updated: 21 September 2026

Version — this is the version recorded when a player accepts at sign-up.

Who is responsible for your data

The site is DiceXo, at dicexo.com, and it is operated by XOXO. In this page, "we" means the operator and "you" means the person holding a DiceXo account.

For anything on this page — a copy of your data, a correction, a deletion request, or a question — email support@dicexo.com. It reaches the operator, who is the only person able to act on it.

The short version

• To open an account we need a username, an email address, a password and an invite code. Nothing else — no real name, no address, no date of birth.
• Every sign-in is logged with your IP address, your browser's user-agent string and a hash of a random ID your browser generates. We use that to spot the same person running several accounts and to notice break-in attempts.
• Your bets and your deposits and withdrawals are recorded permanently, including the crypto addresses and transaction hashes involved.
• By default your username, your stake, your roll and your profit or loss on every bet appear publicly in the live feed, and your lifetime totals appear on a public profile page. One switch turns all of that off.
• We use no cookies. Everything the site keeps in your browser is in local storage, listed below, and none of it is shared with anyone.
• We have no advertising partners and we do not sell or rent your data to anybody.
• Crypto deposits and withdrawals are permanently visible on public blockchains that nobody — including us — can edit or erase.

What we collect

What you give us

• Username — 3 to 16 letters, numbers or underscores. It is shown publicly unless you make your profile private, so choose one you are comfortable being seen.
• Email address — used to verify the account and, if you switch on email sign-in codes, to send you a six-digit code. It must be unique across the site.
• Password — stored only as a scrypt hash with a random salt generated for your account alone. The password itself is never written to the database and cannot be read back by anyone, including us.
• The invite code you signed up with — kept on your account, so we know which invite brought you in.
• Withdrawal addresses — every crypto address you ask us to pay out to is stored with the transaction.
• Security settings you choose — if you set up an authenticator app, your TOTP secret is stored so codes can be checked. If you register a passkey, its credential ID, public key, signature counter, transport types and the label you gave it are stored. Passkeys hold no biometric data: your fingerprint or face never leaves your own device.

What your browser sends automatically

• Your IP address — recorded on every sign-in and on sign-up, and kept as the most recent IP on your account. It is stored in full; we do not shorten or anonymise it.
• Your user-agent string — the line your browser sends identifying itself and your operating system. We keep the first 200 characters of it with each sign-in.
• A device ID — the first time you open the site your browser generates a random ID and stores it locally. We do not store that raw ID with your sign-ins; we store a hash of it, which lets us tell that two accounts used the same browser without the ID itself being readable in our records. A full hash is also kept in a list of devices you have already verified, so a browser you have used before does not have to re-enter an email code.
• Sign-in history — for every sign-in we keep the time, the IP, the user-agent, the device hash and how you signed in (registration, password, or passkey). This history is indexed by IP and by device, so accounts sharing either can be linked.
• Your clock offset — when you open the Safer gambling panel, your browser's timezone offset is sent and stored, so that limit reset times can be shown in your own local time.

What playing creates

• Every bet, forever. Stake, coin, the dollar value at the moment of the bet, your chosen win chance and target, the roll, whether it won, the payout, the profit and your balance afterwards. Bets are never deleted.
• Every transaction. Deposits, withdrawals, swaps, swap spreads, bonuses and balance adjustments — with the amount, the coin, the network, the crypto address, the on-chain transaction hash, the XRP destination tag where one applies, the dollar value at the time, and timestamps.
• Fairness seeds. Your server seeds, their hashes, your client seeds and the nonce. A retired seed that has real bets behind it is never deleted, because deleting it would destroy your ability to verify those bets.
• Account totals — lifetime bets, lifetime amount wagered, lifetime profit or loss, VIP tier progress, accrued rakeback, outstanding rollover, daily-bonus streak, and your balance in each coin.
• Safer-gambling records — any deposit, loss or wager limits you set, any cool-off or self-exclusion you start, your reality-check interval, and a record of each time a limit or a break actually blocked something, including the amounts involved.

Identity checks, only if we ask for them

There is no identity check when you sign up. If we do ask you to verify your identity later, the record we keep of it holds your full name, date of birth, country, which type of document you showed, only the last four characters of the document number, the document's expiry date, how the check was carried out, who carried it out, and any notes or a reason it failed. We also keep a record of which documents we asked for, through which channel, and by when. The AML & account checks page explains when this happens.

No images of your documents are stored in the site's system. If you send a photograph of a document, it stays wherever you sent it — an email inbox, a chat — and that is outside what this site controls. Because there is no upload page, anything you send stays in the mailbox or the chat you sent it to, outside this site and outside anything the site can control or delete. A genuine request will come from support@dicexo.com, and no genuine request will ever ask for your password, your wallet's seed phrase or your private keys.

What the back office records about your account

The back office lets us attach internal notes and tags to your account, record support conversations (the channel, the outcome and free text), log security events on your account, and raise risk flags. Some of these are pruned automatically after a while; most are not. Internal notes are never shown to you: when a deposit claim is rejected, a withdrawal is held or a balance is adjusted, you see a short standard message and the real reason stays in the internal record.

Every action in the back office that changes something is written to an audit log with the time, the admin session, the IP address, the browser, what was called, what changed before and after, and a reason. Passwords, codes, tokens and secrets are replaced with dots before anything is written there.

What we do not collect

• No cookies — the site sets none at all, and there is no cookie banner because there is nothing to consent to.
• No analytics, no advertising pixels, no session recording, no third-party scripts, no third-party fonts. The only script the site loads besides its own is a passkey helper library served from dicexo.com itself.
• No card numbers, no bank details — there is no payment gateway here.
• No real name, postal address, phone number or date of birth at sign-up.
• No marketing or newsletter email, and no mailing list. Email works and the site uses it for exactly two things: the code that verifies your address, and the six-digit code that signs you in from a browser we do not recognise. Both are sent from no-reply@dicexo.com. Anything else you hear from us is a person replying to you at support@dicexo.com.

What other players can see

Three things about you are public by default:

• The live bet feed. Every bet you place appears in real time to everyone on the site, showing your username, your stake in US dollars, your win chance and target, the roll, whether you won, and your profit or loss on that bet.
• Your player profile. Anyone who taps your name sees your total amount wagered, your net profit or loss, your win rate, your number of bets, your biggest win, your VIP tier and the date you joined. Your balance and your transactions are never shown, to anyone, on any page.

To switch this off, open the user menu → Security → Public profile. When it is off, you appear as "Hidden" in the live feed, your rows are no longer clickable, and your profile page returns nothing to anyone but you. Your own view is unchanged — you always see your own name.

Two honest notes about the feed. First, turning your profile private hides your name, not the bet: a row still appears, it is just not attributed to you. Second, the live feed also contains simulated activity generated by the site alongside real players' bets, so the names beside yours are not all people.

What the site stores in your browser

DiceXo sets no cookies. Everything below is kept in your browser's local storage, stays on your device, is readable only by pages on dicexo.com, and is sent to nobody. Clearing your browser's site data for dicexo.com removes all of it — which will also sign you out and make your browser look new to us, so you may be asked for an email code the next time you sign in.

Who else sees your data

We do not sell your data, rent it, or hand it to advertisers. These are the only places data goes outside our own server:

The operator can also download a complete copy of the site's database as a file. Live sign-in material — session tokens, admin sessions and unused email codes — is stripped out of that copy, but it otherwise contains every player's email address, IP history, transactions, bets and any identity-check fields. Once that file has been downloaded it is outside anything the site controls, and only the operator has it.

Beyond that, we would disclose account data if we were legally required to — for example a valid order from a court or authority that applies to us.

Public blockchains — the part we cannot control

This is worth reading twice. Every crypto deposit and withdrawal is a transaction on a public blockchain. Those records are permanent, public, and completely outside our control. Nobody can delete them, edit them, or make them private — not you, not us, not a court.

That has consequences we cannot undo:

• Anyone who knows an address you used can see every transaction it has ever been involved in, in both directions, forever.
• Because withdrawals go from our wallets to your address, and deposits come from your address to ours, anyone looking at the chain can connect the two, and connect your address to this site.
• If Bitcoin deposits use an address derived for you alone, that address belongs to your account and only your account.
• XRP deposits share one address and are told apart by a destination tag, and that tag is your account's internal ID number — it is visible on the XRP Ledger with your transaction.
• If your address is also used on an exchange that knows who you are, the link between this site and your real identity exists on the chain whether or not we ever learn your name.

Deleting your data from our database, if we ever do, would not change any of this. If blockchain privacy matters to you, that has to be handled on your side, before the coins reach us.

How long we keep it

We are being direct here: the site has no retention policy yet. Apart from a handful of automatic clean-ups, nothing is deleted on a schedule, which in practice means most of what is described on this page is kept indefinitely.

What is deleted automatically today:

• Sign-in sessions, once they pass 30 days.
• Unused email sign-in codes, as soon as they expire (10 minutes) or are replaced.
• Records of failed sign-in attempts used for risk checks, after 8 days.
• Records of security changes used for risk checks, after 31 days.
• Withdrawal-security events, after 60 days.
• Account security events, after 180 days.

What is currently kept with no end date: your account record including your email address and IP addresses, every bet, every transaction, your full sign-in history, your known devices, any identity-check fields, your safer-gambling records, internal notes and tags, and the audit log. If your account is "reset" from the back office, your bets, transactions and seeds are moved into archive tables rather than erased — you would show zero, but the records still exist.

What we will say plainly rather than dress up: records are kept while your account is open, and for as long as they are needed afterwards. The financial and fairness records — bets, transactions and seeds — are the ones we are least willing to remove, because they are what lets you verify an old roll and lets us answer a question about an old payment. If you want to know what we hold about you, or want something removed, email support@dicexo.com and ask.

Your choices and your rights

Depending on where you live you may have rights to see your data, have it corrected, have it deleted, or object to how it is used. We would rather tell you exactly what the site can do today than list rights we cannot honour.

What you can do yourself, right now

• Make yourself private — Security → Public profile. Takes effect immediately.
• See your recent activity — your wallet history shows your most recent 50 transactions, and "My bets" shows your most recent 35 bets. Your lifetime totals are in My Stats. There is no way to see or download your whole history from inside the site.
• See and rotate your fairness seeds — your active seed's hash, your last ten revealed server seeds, and your own choice of client seed.
• Verify your email, and turn email sign-in codes on or off.
• Add or remove two-factor authentication and passkeys, and remove a passkey you no longer use.
• Sign out, which deletes that one session token.
• Set limits or take a break in Safer gambling.

What you cannot do yourself

• You cannot delete your own account. There is no such button and no such request in the site. The back office can fully delete an account only if it has no balance, no transactions and no bets — an account that has actually been used cannot be erased that way; it can be closed, which leaves the records in place.
• You cannot change your password, change your email address, or reset a forgotten password. None of those exist on the site. If you lose your password and have no passkey, you are locked out, and the only route back is to email support@dicexo.com and ask. What the operator will do about that is still being decided — it is one of the open points marked in section 4 of the Terms.
• You cannot export your data. There is no download.
• You cannot see your own sign-in history, your recorded devices, or anything written about your account internally.

So a request to see, correct or delete your data goes through support. To make one, email support@dicexo.com from the address on the account and say what you want. It is answered by the operator — there is no team and no ticket system — and if there is something we are not going to remove, we will tell you plainly what it is and why.

Be aware that some data cannot be deleted without breaking something you may want. Deleting the seeds behind your old bets destroys your ability to verify those bets. Deleting transaction records removes the trail behind your own deposits and withdrawals. And nothing we delete touches the blockchain.

Closing an account does not erase your data, and it does not pay out or remove the balance in it. An account can only be deleted outright if it has never held money, never placed a bet and has no transaction history. What happens to the balance of a closed or suspended account is an open point marked in section 17 of the Terms — which is the reason to withdraw your money before you ask for an account to be closed.

How your account is protected

What is actually in place:

• Passwords are hashed with scrypt using a random salt unique to your account. The plain password is never stored. Sign-in does the same amount of work whether or not the username exists, so timing cannot reveal which accounts are real.
• Optional two-factor authentication with an authenticator app. Once on, it is required to sign in and to withdraw.
• Optional passkeys, for passwordless sign-in. You can register more than one.
• Optional email sign-in codes from an unrecognised browser. Codes are stored hashed, expire after 10 minutes, allow five attempts, and are rate-limited to one email every 30 seconds.
• Sessions expire after 30 days, absolutely — there is no sliding renewal. Expired sessions are cleared out hourly. The operator can force every session on an account to sign out at once. Note there is no idle timeout: an unattended signed-in browser stays signed in.
• Rate limits on sign-in attempts, withdrawals, swaps, deposit claims, two-factor and passkey changes and seed rotations, to blunt brute-force and abuse.
• Secrets are stripped from the audit log before it is written.
• Sign-in material is removed from any copy of the database that is exported.

And what we are not going to claim: nothing on this page promises that your data cannot be stolen. Anyone who gets your session token or your password can use your account, so use a password you use nowhere else and turn on two-factor authentication or a passkey.

Age

This site is for adults only. The minimum age to hold an account is 18. The site does not ask your date of birth and does not check your age when you register, so this is a rule you confirm rather than one the software enforces; the one place it bites is an identity check, which the back office will not record for anyone under 18. If we find out an account belongs to someone under age we will close it and delete what we can.

Changes to this page

If we change how we handle your data we will update this page and change the date at the top. For a change that matters we will also put a notice in the announcement banner on the site, which is the one channel that reaches every signed-in player.

Contact

Questions about anything on this page, or a request about your own data: support@dicexo.com. It goes straight to the operator.