The current experience
A development notice, not release approval
This page describes the current local MelonsPlay build. The operator and data controller have not been confirmed, and there is no verified privacy contact. Production processing and legal review remain open. See what must be confirmed before publication.
MelonsPlay offers ten active social-casino games for adults aged 18 or over. The static guest preview has no account processing. An optional loopback-only PHP server adds email/password accounts and server-side sessions as described below. Payment, support forms and cross-device game profiles remain unavailable. The games use separate virtual coins or credits with no cash value. There are no purchases, withdrawals, redemptions or real-world prizes.
Guest play does not require a name, email address, date of birth or payment details. The optional Contact Us preview uses private server storage when enabled, or page memory in static preview, as described below. Confirming “18+” is a self-declaration, not identity or age verification.
What is stored in your browser
| Record | What it does | Storage |
|---|---|---|
| Age confirmation | Remembers that you selected “Yes, I am 18+”. It does not store your birth date. |
Session storagepd-age-confirmed
|
| Storage notice | Remembers that you acknowledged the notice. It is not an analytics preference or a record of consent to every storage use. |
Session storagepd-cookie-notice
|
| Game-local state | Virtual coin balances, selected coin amounts, wheel multipliers and the last free-spin timestamp, and aggregate game counters. Not a complete play history or a member account. | Local storage. See the full key inventory. |
Lantern Trio, Parlour Twenty-One and Reward Wheel share one local coin balance. Peak Slots, Peak Blackjack and Peak Dice share another. The Peak games also share a statistics record which a game's update can replace. These source-family records are not a unified MelonsPlay balance and do not sync to another device.
The local game frames use this site's origin and can access the same browser storage. They are not an isolation or security guarantee. Their reuse rights and production integration still require review.
Search, requests and external services
Game search and categories are reflected in the Games URL as
q and category. Filtering runs in
the browser. The site does not save a search-history record to
browser storage. A URL can remain in your browser history or
be copied and shared, so avoid entering personal information
into game search.
Opening or reloading a page sends its path and any query string to the server serving this build, together with normal HTTP request and connection information. Launching a game requests its local manifest, entry, styles and scripts. Browser storage values are not automatically attached like cookies, and the audited code has no endpoint that uploads the stored coin or statistics records.
The current local server logs requests to its output. The site code defines no log-retention schedule. Production hosting, request logs, processors, recipients, international transfers and retention have not been established.
No analytics, advertising tags, marketing trackers, remotely hosted fonts or external game-provider requests were found in the audited shell and ten admitted titles. Artwork, game code and styles are served locally. Links to independent information sites load those sites only when followed; their own privacy practices then apply.
How long records remain
- Age and notice settings: tied to the browser's page session. They survive reloads. Ending the tab session normally clears them, but browser restoration can preserve session data.
- Game-local saves: no expiry or automatic retention limit is programmed. They can remain between visits until cleared, overwritten or removed by the browser. Private browsing and browser storage restrictions can change this behavior.
- Search URLs: retained according to your browser history settings. A requested query may also appear in server logs; production retention is unresolved.
The optional development account database persists until the local developer removes it. There is no self-service account-deletion UI. This does not establish the eventual hosting provider's processing or retention practices.
Reviewing and removing local data
Cookies & Storage explains the browser records and how to clear site data. Cookie choices on that page reopens the actual notice; it does not disable analytics that are absent or switch off game saves.
Close active MelonsPlay game tabs before clearing site data in your browser. This can reset virtual coins, counters, selected amounts and notice/age settings on this origin. Browser history must be cleared separately. Removing browser records does not remove server logs or information held elsewhere.
Privacy questions and rights
No verified operator/controller or privacy contact is available in this development build. There is no privacy-request form and no claim that a request can be delivered or processed here.
Before release, the notice must identify the controller, actual processing purposes, lawful bases, recipients, retention and applicable rights and request routes. For independent information, consult the ICO's public guidance on information rights. These local clearing instructions do not replace a rights request to a verified controller.
Account identity and sign-in
Accounts are available on the account server and in protected staging. Registration uses an email address and password. Game bundles remain on a separate host and never receive account credentials; their coins and game-local records are not attached to accounts.
| Record | Purpose and location | Retention |
|---|---|---|
| Account identity | Normalised email address, internal account ID, Argon2id password hash and creation timestamp in private SQLite storage. New registration records the time of the 18+ confirmation, Terms acceptance and Privacy acknowledgement, with document version identifiers. Legacy aliases remain internally for migration compatibility. No birth date is stored and email ownership is not verified. Passwords are submitted in POST bodies and are never displayed back. | Until the deployment maintainer deletes the private account record or database. No automatic account expiry or self-service deletion. |
| Server session | Internal account ID, sign-in/activity timestamps and CSRF token in private server-side files. The browser receives an opaque HttpOnly session cookie; not a password or account record. | Access expires after 30 minutes idle or 8 hours from sign-in. Logout destroys the active session. Old files are eligible for PHP cleanup after 8 hours; cleanup runs on subsequent session starts, not on a guaranteed wall-clock schedule. |
| Saved game choices | Internal account ID, a valid catalogue game ID and the time it was saved, stored in SQLite. These provide your saved collection across sign-outs and later sign-ins. No gameplay, scores, balances or recent activity are collected by this feature. | No automatic expiry. Remove a title from your Saved Games page to delete that saved entry, or the local developer can remove the private database. Signing out or clearing cookies does not delete these choices. |
| Recently opened games | Internal account ID, validated catalogue game ID and latest opening timestamp in SQLite. Only an intentional, signed-in Open game action records an entry before redirecting to guest Play. Repeat openings update the same entry. Direct guest visits, game outcomes, scores and duration are not recorded by this feature. | No automatic expiry; at most one entry per account and catalogue title. Unavailable history entries can be removed individually; active history has no individual deletion control yet. The local developer can remove the private database. Logout and clearing browser data do not erase this history. |
| Attempt counters | Hashed normalised email and hashed network-address buckets, action type and timestamps in SQLite. These limit repeated registration/sign-in attempts; hashes are not a claim of anonymity. | A rolling 15-minute window; older rows are removed on the next authentication attempt. |
The PHP development server prints request/connection metadata to its local console, not submitted passwords or form bodies. Hosting logs and production retention are unresolved. No email is sent, verification is unavailable and a forgotten password cannot currently be reset.
Clearing the session cookie or signing out does not delete the account database, saved game choices, recently opened entries or game-local records. Saved choices can be removed individually on the protected Saved Games page; removing a choice does not clear a game’s own coins or counters. The developer can stop the account server and remove its private test database and session files; there is no public deletion/contact service. Cookies & Storage explains the cookie. This private staging setup is not a secure public deployment.
Before public release
Publication remains blocked. The operator/controller, contact channel, deployed processing, storage/consent assessment and retention must be confirmed. The local account processing below is development evidence only; production account and support processing still require review. Qualified UK-market review must check the finished behavior and wording.
This notice was checked against the current code on . It is not legally approved or production-ready. The ICO's privacy-information guidance informs the outstanding review requirements.
Neon Orchard game storage
Neon Orchard uses pd.neon-orchard.v1 in
localStorage on the guest game origin to keep its virtual
credits, selected bet, and last settled grid, bet and award.
It is separate from every other game balance and from your
account. The record has no automatic expiry; clearing this
site’s browser data deletes it. Reload restores the settled
result without charging or awarding it again.
If storage or browser tab coordination is unavailable, the game clearly switches to memory-only play; reload may restore an older readable save or start with 1,000 credits if no save is readable. No analytics, remote provider or external game requests are added. Saving or opening its title through an account uses the existing member records, not credit synchronization.
Coral, Pirates and Roulette storage
Coral Postcards uses pd.aqua-slot.horrell.v2;
Bloody Pirates uses pd.bloody-pirates.horrell.v2;
Velvet Roulette uses pd.velvet-roulette.v1. Each
localStorage record holds its own credits, selected bet or
chip, and last settled result. Roulette also keeps the bets
belonging to that settled result; uncommitted table bets stay
in memory. No prior engine balance is migrated.
Records have no automatic expiry. Clear browser site data to delete them. Reload restores a completed result without a second deduction or return. Storage or tab-coordination failure uses temporary memory play; reload may restore an older readable save or start at 1,000. Nothing is sent to an account, game provider or analytics service.
Archived Alladin Slot and Tidal Tiles are no longer launchable. Existing Saved and Recently opened entries remain with the account; unavailable entries can be removed through their protected account controls.