Bolso.Bet is a satire project by Desperate Media GmbH (Postgasse 8b, 1010 Vienna, Austria). Nobody bets real money: Ra$hadinha can't be bought or cashed out.
We keep only what the game needs to work, on our own servers, and we never sell or lend your data. No fingerprinting. We count visits with Cloudflare Web Analytics and with Umami, on our own server (analytics.desperata.com). Neither uses cookies or identifies you: Umami records the page, referrer, browser, country and actions such as placing a bet or finishing a lesson, without storing your IP. The site shows Google AdSense ads, but Google's ad cookies only come with your yes (see Cookies, below). Without it, you only see our own fake ads.
3. What we store
Email: for sign-up, account confirmation and password resets and, if you ask for them, the weekly B.O., news, Birolingo reminders and market-resolved notes. Encrypted in the database (AES-256-GCM).
Username and password: the password only as a hash; nobody here can read it.
Bets and Ra$hadinha: who you bet on, how much, when and the outcome, to work out your balance and ranking.
What you post: comments on cards, and messages, reactions and poll votes in the Zap. They appear under your username.
Game progress: completed Birolingo lessons and GTAVião missions.
Technical logs: the server logs requests (IP address, browser, page) for security and debugging. These logs are size-capped: the oldest are discarded as new ones arrive.
We receive no payment data, because there is no payment.
4. Who helps us
A few services process data on our behalf, each only for its own job:
Hetzner: hosts the site, database and cache on a server in Germany (EU).
Cloudflare: delivers the site (DNS, proxy and abuse protection), runs the Turnstile captcha on sign-up and password reset, and counts visits (Web Analytics: page views, country, browser and referrer, in aggregate, with no cookie).
Brevo: sends the account emails and, if you ask for them, the list emails (EU). No open or click tracking.
Google (AdSense): shows ads on the board, at the end of some Birolingo lessons and on /apostar, only after your yes. For the ads, Google decides on its own how it uses the data, as an independent controller. How Google uses data from partner sites
5. Legal bases (GDPR Art. 6)
Contract (Art. 6(1)(b)): creating and running your account, recording bets, balance and progress.
Legitimate interest (Art. 6(1)(f)): security, abuse prevention and the technical logs.
Consent (Art. 6(1)(a)): measurement and ad cookies (Google AdSense), only after your yes in the cookie notice (in Austria, § 165(3) TKG 2021). You can withdraw it any time under Cookies.
Consent, emails (Art. 6(1)(a)): the weekly B.O., news, Birolingo reminders and market-resolved notes, only with your yes, confirmed by a click in an email (in Austria, § 174 TKG 2021). One click in any of them, or the settings, takes you off.
Users in Brazil also have their rights under the LGPD (Law 13.709/2018).
6. How long
Account data stays for as long as the account exists. You can delete your account in your profile settings or by email ([email protected]); we then delete the account and everything tied to it. Confirmation and reset tokens expire on their own.
The proof of your yes and your no to the email lists (the date, where it came from and the text you saw) stays while you are on the list and for 3 more years after you leave, so we can show we respected your choice.
7. Your rights
You can ask for access, correction, deletion and portability of your data, and object to or restrict processing. Write to [email protected]; we answer within 30 days. You can also complain to a data protection authority: in Austria the Datenschutzbehörde (dsb.gv.at), in Brazil the ANPD (gov.br/anpd).
8. Cookies
On your first visit a notice asks what you accept. The necessary ones are always on; the others only with your yes, and the site works the same if you say no. Until you choose, everything optional stays off.
Your choice lasts 12 months. You can change or withdraw it any time under Cookies, in the footer or with the button below.
Necessary (always on)
Session (authjs.session-token): keeps you signed in. HTTP-only and secure; expires after 30 days.
Language, country and look (bahnbet-lang, bahnbet-country, bahnbet-design): remember your site preferences for up to a year.
Your cookie choice (bolso-consent): stores what you chose in the notice, with its version and date, for 12 months.
Cloudflare Turnstile: a short-lived cookie during the sign-up and password-reset captcha.
Measurement (only with your yes)
Usage statistics with cookies: we use none today. Cloudflare's visit count uses no cookie and stores nothing on your device.
Ads (only with your yes)
Google AdSense: with your yes, Google and its partners set and read cookies and identifiers in your browser to choose, cap and measure the ads, and may personalise them based on your use. This data may leave the EU and Brazil. How Google uses this data
In the EU and EEA, the UK and Switzerland, you choose in Google's consent message, certified under the IAB TCF, and change your choice under Cookies in the footer. Everywhere else, you choose in our own notice.
Without your yes, AdSense doesn't even load: the ad spaces show our own fake ads, which use no cookies and track nothing. The Zap never has Google ads.
Sound on/off and some games' local progress live in your browser's localStorage, which is never sent to the server.