Privacy

The short version

Niekie scores online casinos. You can read every score without an account and without telling us who you are. Analytics cookies are only set if you accept them on the cookie banner; decline and none of them load.

An account is only needed to post, submit evidence, use the member tools or set play controls. The browser extension and the Android app both work signed out, and neither reports your browsing to us.

We do not sell personal data, and we do not share it with advertisers or data brokers.

The website

Reading the site. Public pages are served without a login. Our host records standard server logs (IP address, user agent, requested URL) for security and reliability.

Analytics, only if you say yes. The first time you visit, a banner asks whether we may use analytics cookies. Nothing below loads unless you choose Accept, and you can change your answer at any time from the Cookies link in the menu or at the bottom of any page. If you accept, we use Google Analytics to count traffic, Microsoft Clarity to see how pages are actually used, and the Meta pixel to measure whether our own ads and posts bring anyone here. All three set their own cookies and record approximate location and the pages you viewed. The Meta pixel reports that visit back to Meta, which may match it to a Facebook or Instagram account if you have one. Microsoft Clarity records how you move through a page, including mouse movement, scrolling and clicks, and can replay that session to us; it is configured to mask text input, and we use it to find broken layouts and confusing pages rather than to identify anyone. Nothing on the public pages is personalised to you by us.

Accounts. If you sign up we store your email address, the username you choose and, if you connect one, your wallet address. Authentication is handled by Supabase, which stores your session tokens. We use your email to sign you in and to reply to something you sent us, not for marketing you did not ask for.

Your location, if you confirm it. During setup we suggest a location so we can show casinos relevant to where you are. It is worked out by our own host from the network your request arrives on: country, region and nearest city. It is not your GPS position, and no third-party lookup service is involved. It is only saved to your account if you confirm it, you can skip the step, and you can change it later. The reasons you picked for using Niekie are saved the same way.

What is public, and what is not. Your username, public profile, forum posts and your place on the leaderboard can be seen by anyone. Your email address never is. Direct messages are stored so they can be delivered and are visible to the people in the conversation.

Contact form. Messages you send through the contact form are stored with the email address you give, so we can reply.

Links to operators. Some links to casinos go through niekie.app/go/ and some of those are paid links, labelled where they appear. We do not record who clicks them. The operator or its affiliate network may set its own cookies once you arrive on its site, under its own privacy policy.

Notifications. If you turn on push notifications in an app that offers them, we store the device token Google's Firebase service issues, so a notification can reach that device. It is deleted when it stops working.

Submissions. If you submit a payout report, complaint, correction or other evidence, we store what you sent, including any screenshot, and link it to your account so a moderator can review it and so it can be credited to you. Accepted evidence feeds the payout-reliability part of a casino's score. We publish the aggregate result, never your email or wallet.

Operator submissions. If you apply on behalf of a casino for verification, we store the business contact details on the form so we can process and respond to the application.

The browser extension

The Niekie extension looks up a casino's safety score and, if you choose to use them, keeps play limits and a gambling-site block. The two builds differ in one way and it matters here: the Firefox build can see the casino page you are on, so it shows the score there. The Chrome build has no access to gambling sites at all and cannot read the page you are on, so there you type the operator's name instead. Everything below that begins with the site you are on, page content, or time played applies to the Firefox build only. What it collects, precisely:

• The site you are on. The extension downloads our public casino directory and caches it locally for 12 hours. Matching the site you are on against that list happens entirely on your machine, so simply browsing does not tell us where you have been. When you open the badge or the toolbar popup, the hostname of that tab is sent to our lookup API to fetch the detailed report. That request carries the hostname only, not the full URL, the page content or anything you typed.
• Page content, only when you ask. If you are signed in and choose to submit payout evidence, clicking "Capture screenshot" takes an image of the visible tab, and clicking "Submit contribution" uploads it. Nothing is captured or uploaded without those two deliberate clicks. The extension never reads page text, form fields or keystrokes.
• Your email and session. Signing in inside the extension uses a one-time code sent to your email. Your session tokens are stored in the extension's local storage on your device so you stay signed in.
• Amounts you enter. A payout submission can include the withdrawal amount and how long it took. You type these; we do not read them from the page or from any account.
• Term Slayer, when you use it (Firefox only). Asking Term Slayer to read a casino's terms sends that casino's hostname to niekie.app. Our server then fetches the operator's own public terms page, not your copy of the page and nothing from your session, and, if you are signed in, has an AI model read those terms and summarise them for you.
• Local settings. The cached casino list, a "dismissed until" timestamp so a closed badge stays hidden for a day, and your light or dark theme preference. These stay on your device.
• Time played, if you turn on play controls. While a casino we rate is the tab in front of you, the extension counts the seconds. When you stop, it saves how long and which operator, to your account. It records minutes and a name, never a web address, never page content, and nothing at all on sites we do not rate. Turning the feature off stops the counting.
• Deposits you type in. If you set a monthly deposit budget, the extension asks what you deposited when you leave a casino. We cannot see your money and we do not try to; the figure is whatever you enter, and entering nothing is a valid answer.
• That you set a block, and until when. Blocking is tied to your account so it survives a reinstall, which means we hold a record that you asked to stop gambling for a period. We treat that as the sensitive thing it is: it is readable only by you, it is never used for marketing, it is never shared or sold, and deleting your account deletes it along with everything above. You can ask us to delete it at any time without closing your account.
• What the block list is not. The list of gambling domains is downloaded from niekie.app, the same list for everyone, and kept in your browser. The blocking itself happens in your browser. We are not told which sites you tried to open while blocked, because nothing reports that anywhere.

The extension talks to two hosts only: niekie.app and our Supabase backend. It contains no third-party analytics, no advertising code and no remote code: all of its JavaScript ships inside the extension package.

It does not request access to all sites. The manifest names the operators we rate, so on every other page the extension is not loaded at all rather than loaded and silent. Adding an operator therefore needs an extension update, which is a fair price for an extension that is structurally incapable of seeing your bank.

The Android app

The app shows the same scores as the site and reads them without an account. Signing in is only needed for the member tools, and it is the same account as the website.

Downloading it from niekie.app. We count downloads of the app from our site: which version, whether it was a first install or an update, and when. Nothing about who downloaded it is recorded with that count, not your IP address, not your device.

Updates. The copy downloaded from niekie.app keeps itself up to date. When you open it, at most every six hours, it asks niekie.app whether a newer version exists, which is an ordinary web request carrying nothing about you or your account. A newer version is downloaded from niekie.app and installed only after the app has checked that it matches the published SHA-256 fingerprint and is signed with our key. The copy from Google Play, where available, is updated by Google Play instead and contains no updater.

Play controls use a VPN, and here is exactly what that means. Blocking gambling sites across a whole phone is only possible through Android's VPN interface, so while a block is running Android shows a key icon and the app holds a VPN connection. It is not a VPN service in the usual sense: nothing is routed to us, no traffic is proxied through our servers, and your IP address is not changed. The connection exists so the app can answer DNS lookups on the device.

What the VPN sees and what it keeps. It sees the domain names your phone looks up while a block is running. A name on the block list is answered with "does not exist" and the request goes nowhere. Every other name is forwarded to your normal DNS resolver unchanged. None of it is written to a log, stored on the device, or sent to us or to anyone else. The block list itself is downloaded from niekie.app, the same list for everyone, and kept on the phone, so checking a lookup against it never leaves the device. We cannot tell you which sites you tried to open while blocked, because nothing anywhere records it.

When it runs. Only while you have an active block. Starting one asks for Android's VPN permission first, and the connection stops when the block ends. Removing the app also removes it.

Deleting your account. Account settings in the app deletes your account and everything attached to it. Payout reports and forum posts you contributed stay published with your account removed from them, because other people's scores are computed from them, and a row with no account attached is no longer about you. If a block is running, deletion waits until it ends, so that deleting an account cannot be used as a way around a block you set.

What we never do

• Sell or rent your personal data.
• Transfer your data to third parties except the processors below, who act on our instructions.
• Use your data to assess creditworthiness or for lending.
• Use your data for anything unrelated to showing you casino safety scores and running your account.
• Let a casino pay to change, remove or influence its score, or to learn who reported it.

Who processes data for us

• Supabase, database, authentication, and file storage for screenshots and for the Android app's download files.
• Vercel, hosting and server logs.
• Google Analytics, aggregate traffic measurement on the public site. Not used in the extension.
• Microsoft Clarity, session analytics on the public site. It records page interactions and can replay a session to us, which is how we find layout faults. Not used in the extension.
• Meta, the Facebook pixel on the public site, used to measure whether our ads and posts bring visitors. Not used in the extension.
• Google Firebase, delivery of push notifications to devices that have turned them on.
• Anthropic, the AI models used to read public operator pages, registry records and casino terms (including terms you ask Term Slayer to read), and to check public information about casino wallet addresses. We do not send it your personal data.

How long we keep things

Account records last until you delete the account. Submitted evidence is kept while the score it supports stands, because a score has to remain auditable. Contact form messages are kept until you ask us to delete them. Server logs roll off on our host's normal schedule. The app download count holds no personal data and is kept as a running total. Extension and app storage lives on your device and is cleared when you remove them.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Deleting your account removes your email, wallet and session. Evidence you submitted may be retained in anonymised form where a published score depends on it; if that is not acceptable to you, say so and we will discuss it.

Use the contact form for any of this. Niekie is operated from South Africa, where the Protection of Personal Information Act applies and you may complain to the Information Regulator. If you are in the UK or EU you also have the right to complain to your own data protection authority.

Children

Niekie is for adults. It is not directed at anyone under 18, and we do not knowingly collect data from anyone under 18. Gambling carries real financial risk, and nothing on Niekie is a recommendation to gamble.

Changes

If this policy changes in a way that affects what we collect or why, we will update the date at the top and, for anything material, say so on the site.