Security policy

This Security policy (the "Policy") explains how the Operator protects the Site, the Service, the Accounts held on it and the money and data recorded in them; which security tools you can use and when we ask you to use them; what you must do to keep your Account and your Steam account safe; how to recognize and deal with the scams most often aimed at players; how we respond to a Security Incident; and the terms on which any person may look for and report a Vulnerability.

This Policy forms part of the Terms of service (the "Terms") and is to be read with the Privacy policy and the Cookie policy. If this Policy and the Terms conflict, the Terms prevail.

This Policy applies to every use of the Site and to every Account, including an Access Code Account and any Account opened before the Launch Date. Sections 17 and 18 also apply to every Researcher, whether or not that person holds an Account.

The Site and the Service are operated by 3-102-136856 Limitada, the company named in clause 3.1 of the Terms. In this Policy, "we", "us" and "our" mean the Operator, and "you" means the person using the Site or holding the Account concerned.

We process Personal Data for the purposes of this Policy as the Privacy policy describes. The measures in this Policy form part of the technical and organizational measures by which we meet the duty to keep Personal Data secure under Law 8968 on the protection of persons with regard to the processing of their personal data and its regulation.

This Policy describes the measures we apply and the steps we require of you. It is not a promise that the Service is free of every flaw or that unauthorized access can never occur. Section 19 and the Terms set out the limits of our responsibility.

Words with capital letters that this Policy does not define have the meanings given to them in the Terms, including Access Code Account, Account, Applicable Law, AssetPay, Balance, Bet, Business Day, Cashier, Connected Person, Deposit, Fun play, Game, Game Aggregator, Launch Date, Masking Tool, Network Check, Operator, Originals, Play break, Provably fair, Restricted Territory, Round, Seeds, Self-exclusion, Service, Site, Skins, Steam, Step-up Check, Studio, Studio games, Support, Tip, Trade URL, Vault, Verifier and Withdrawal. "Personal Data" is used as the Privacy policy defines it.

In this Policy:

• "Authenticator App" means an app on a device you control which, once linked to your Account, produces a new six-digit code every 30 seconds;
• "Change Notice" means an email we send to the address on your Account, or to your previous address where clause 8.5 says so, to tell you that a Credential, a security setting or a linked account has changed;
• "Credentials" means every means by which the Service recognizes you as the holder of your Account, including your password, the codes produced by your Authenticator App, your Recovery Codes, your Passkeys, the links in the emails we send you about your Account, the session cookie held by your browser and, until the Account is finished, the access code of an Access Code Account;
• "Official Channels" means the websites, addresses, accounts and senders listed in clause 12.1;
• "Passkey" means a login credential held on your device, in your password manager or on a physical security key, which you unlock with your fingerprint, your face, your device's screen lock or the key itself;
• "Recovery Codes" means the set of ten single-use codes we issue when you turn on Two-step Login, link a new Authenticator App or ask for a new set;
• "Report" means a report of a suspected Vulnerability made under clause 17.7;
• "Researcher" means any person who looks for, tests or reports a Vulnerability;
• "Security Incident" means any event that compromises, or is reasonably likely to compromise, the confidentiality, integrity or availability of the Service, of an Account or of data we hold;
• "Session" means the period during which a browser on a device is logged in to your Account;
• "Two-step Login" means the setting under which a login with your password is completed only after you also enter a code from your Authenticator App or one of your Recovery Codes; and
• "Vulnerability" means a weakness in the Service or in its configuration through which a person could reach an Account or data without authority; alter a Balance, a Bet, a Tip, a Withdrawal or the result of a Round; get around a control described in this Policy or in the Terms; or otherwise compromise the security of the Service.

Headings are for ease of reference and do not affect meaning. Words such as "including" and "for example" introduce illustrations and do not limit the words that precede them.

The Site is served over HTTPS, so that what passes between your browser and the Site is encrypted in transit with Transport Layer Security (TLS). The Site refuses connections that use a version of TLS older than 1.2.

Cloudflare stands in front of the Site and handles traffic before it reaches our servers. It helps protect the Site against floods of requests and automated abuse, and it may set the security cookies described in the Cookie policy.

With every page, the Site instructs your browser:

• to run only the scripts that the Site has authorized for that page, and to load no plug-ins;
• not to show the Site inside a frame on any other website, so that no other page can lay a hidden copy of the Site under your clicks;
• not to tell a website you open from a link on the Site which page of the Site you came from;
• not to let any page of the Site use your camera, your microphone, your location or the browser's payment features; and
• to treat each file only as the type of content the Site declares for it.

Our servers refuse any request that would change an Account, a Balance or a setting unless it comes from a page of the Site itself. Another website therefore cannot use your logged-in browser to act on your Account without your knowledge.

Our servers apply their own checks to every request, whatever checks your browser has already made, and refuse any request that is larger than its purpose needs or that takes too long to arrive.

We limit how many times an action may be attempted within a given period. The actions limited include logging in, entering a two-step code, opening an Account, asking for a reset link, confirming a password and sending a Tip. Attempts on an existing Account count against that Account, and attempts to log in or to obtain a reset link also count against the email address or username entered. When a limit is reached, further attempts are refused until the period ends, the message says when you can try again, and nothing else on your Account changes. If you meet such a refusal without having made the attempts yourself, someone may be trying to guess your password: once you can log in, change your password, turn on Two-step Login and tell Support. The counters we keep for this purpose hold only a one-way code of what they count, such as an Account or a login name, and they are deleted automatically one day after their period ends.

A failed login receives the same answer whatever caused it, and every request for a reset link receives the same answer whether or not the email address or username given belongs to an Account, so neither answer shows whether a particular person holds an Account. Opening an Account, or changing the email address on one, is refused where the address is already registered, so those two forms can show that an address is in use.

While the Network Check is switched on, we run it at sign-up, at login, when you enter an access code, each time a logged-in player opens the Site, and when you make a Deposit or request a Withdrawal. It compares the network you connect from with published lists of Tor exit relays, VPN services and hosting networks, which refresh automatically at least once a day, and, where one is switched on, with information from a network intelligence provider. A connection that the check finds to come through Tor, a VPN, a proxy or a hosting network is refused, and the Site shows "Not available on a VPN or proxy" and asks you to switch the tool off before you try again; we may instead run the check so that it only records such findings for review. A device time zone that does not match the location of your network is recorded against the Account concerned but does not by itself lead to a refusal, and a connection through iCloud Private Relay is neither refused nor recorded on that ground alone. The rules on Masking Tools, and the consequences of using one, are in section 5 of the Terms and in the Restricted countries and VPN policy.

Messages that the Game Aggregator sends to our servers to settle Rounds of Studio games are acted on only when they arrive from an address we have listed for it and carry a key or signature made with a secret that it shares with us. Messages that AssetPay sends to report the progress of a Skins trade are acted on only when they bear a valid signature, made with a secret shared between AssetPay and us, that covers both the message and the time at which it was sent.

We review the code and the configuration of the Service for security weaknesses when we change them and in reviews of the whole code base, and we correct confirmed weaknesses in order of the risk they present. We follow the security notices published for the software on which the Service is built, including its framework, its libraries, its database and the operating systems of its servers, and we install security fixes.

Our database accepts connections only from our own application and background services, over a private network, and cannot be reached from the internet. The application receives traffic from the internet only through Cloudflare. Our application and background services run with the fewest system permissions they need and cannot alter their own program files, and the passwords and keys they use are kept apart from the code and from the database.

We keep records of security events, including logins and log-outs, failed two-step codes at login, failed Passkey checks, connections from an Account that the Network Check refuses or flags, changes to Credentials and to security settings, and the actions of our staff, and our staff may review them for patterns that suggest an attack or a taken-over Account, such as a change of email address followed by a Tip or a Withdrawal.

We do not store your password. We store a one-way scrypt hash of it, made with a random salt unique to that password, from which the password cannot be worked out. Each time you log in, we hash the password you enter and compare the two hashes.

We hold the following data only in encrypted form, using AES-256-GCM, with each encrypted value tied to the record it belongs to, so that it cannot be decrypted if it is copied into another record:

• your first and last names and your country, which you give at the first stage of identity verification;
• the secret that links your Authenticator App to your Account, which is encrypted under a separate key derived for that purpose only;
• your Trade URL;
• the server seed of each pair of Seeds, until it is revealed; and
• the content of every email we send you, from the time it is queued until it has been sent, after which the queued copy is cleared.

Your date of birth and address from that stage, your answers to questions about the source of your funds and any document you send through the Site are sealed with a public key before they are stored, using X25519 key agreement and AES-256-GCM, so that they can be read only with a private key that the Site itself does not hold, as clause 18.2 of the Identity verification policy describes.

We hold your Recovery Codes, the token in your session cookie, the tokens in the links we email you and the access codes we issue only as one-way hashes. None of them can be read back from our database, by our staff or by anyone who obtains a copy of it, except that a link waiting to be emailed is held, encrypted, inside its queued email until that email is sent or the link expires.

Every change to a Balance is entered in our ledger as a journal whose entries must add up to zero. Our database refuses any attempt to edit or delete a ledger entry, a journal, a Vault instruction or a record of a staff or security action, and refuses any Balance that the ledger does not support. An error is corrected by a new entry recorded next to the original, which stays in place.

No staff tool lets a member of staff edit a Bet or a ledger entry, log in to your Account or act in your name. Until the Skins cashier opens, no staff tool changes a Balance either. Once it opens, staff can change a Balance by hand only through a recorded command that names the member of staff and gives the reason, under the rules in clause 5.8 of the Anti-money laundering policy.

Before you bet with a pair of Seeds on an Original, the server seed is fixed and its hash is shown to you. The server seed stays encrypted until you rotate your Seeds, when it is revealed and you can check every Bet made with that pair in the Verifier. Crash works differently: each Round of Crash has its own server seed, whose hash is shown before the Round starts and which is revealed when the Round ends. This is how you can confirm for yourself that a result was not changed after your Bet was placed. The Fairness policy describes the method in full.

Messages exchanged through live support on the Site are kept in a form that cannot be edited or deleted in the ordinary course of operation, so that the record of what was said stays complete.

We back up our database and test that we can restore the Service from a backup.

If we have to restore the Service from a backup, we check each Balance against the ledger and against the records that AssetPay and the Game Aggregator hold for the same period. Where activity between the backup and the failure cannot be recovered, we tell each player affected and correct the Balance with new ledger entries under clause 4.4.

Our staff can reach player records only through our staff tools, and only within the permissions of their role. Each role carries only the permissions its work needs. Seeing a player's email address needs a separate permission of its own, but staff whose role lets them read our security records can see the earlier usernames that those records hold and the prefix of each network address in them. The records keep a keyed one-way code in place of the full address, so no staff tool shows it.

A member of staff can open the staff tools only after logging in with an Authenticator App or a Passkey, and must confirm with a Passkey before making a change through them; each confirmation lasts five minutes. A support shift lasts at most eight hours, and a shift left idle for 30 minutes needs a new confirmation before its holder can reply again.

Staff must give a reason for each sensitive action, including suspending or restoring an Account, issuing a reset link, resetting a username, pausing or restarting an Original, a Studio game, a Studio or all Studio games, and switching a Studio, payment or identity provider connection on or off, or between test and live use. The action, the person who took it and the reason are kept in a record that cannot be edited or deleted.

When the role of a member of staff changes or ends, every Session of that person ends immediately.

Staff must keep confidential what they learn in the course of their work and must use it only for that work.

A member of staff who settles a Skins trade by hand is subject to a daily limit on the total value they settle, and a settlement above a set amount takes effect only once a second member of staff has approved it.

We rely on suppliers for parts of the Service: a hosting provider for our servers and database, as clause 5.12 describes; an email delivery provider; Cloudflare; a network intelligence provider, where one is switched on; the Game Aggregator and the Studios for Studio games; AssetPay for Skins Deposits and Withdrawals; and, once connected, the Identity Partner. Each receives only the data its part of the Service requires, as the Privacy policy describes. Before a supplier receives Personal Data or any access to the Service, we review how it protects data. Our terms with each supplier that handles Personal Data for us require it to keep that data confidential and secure, to use it only to serve us, to tell us without delay of any Security Incident that affects our data or the Service, and to delete or return the data when its service ends, as clause 11.3 of the Privacy policy sets out. A Security Incident at a supplier that affects our players is handled under section 16.

We hand account emails to our email provider only over a connection encrypted with TLS 1.2 or later, and only after verifying the provider's certificate.

Studio games run on the systems of the Game Aggregator and the Studios and open inside a frame on the Site. The Game Aggregator and each Studio are responsible for the security of their own games and systems. Steam, Discord and the other services you reach through links on the Site are run by others under their own rules, as section 18 of the Terms explains.

Some views of player data in the staff tools are recorded with who opened them and when, in the record described in clause 5.3: opening a player's details beside a support conversation, and viewing or exporting records of Skins trades. Opening personal details without a reason connected with that person's work breaks clause 5.5.

Before a member of staff receives access to the staff tools, and at least once a year after that, we train them in this Policy, in recognizing phishing and impersonation aimed at staff, and in the checks to make before issuing a reset link or acting on a request about an Account.

Our servers and database run in data centers operated by our hosting provider. The provider controls entry to its buildings and to the machines in them, and our staff have no physical access to them.

You log in with your email address or your username and your password, or with a Passkey. You cannot log in through a social media account or any other third-party account.

Your password must be between 12 and 128 characters long and include at least one upper case letter, one lower case letter and one symbol. A long passphrase of several unrelated words, or a password generated by a password manager, is stronger than a short password that merely meets these rules. Do not build your password from your name, your username, your email address or your date of birth, or from a word or phrase that people who know you could guess, and do not use again a password you have used before.

Your Account allows one live Session at a time. A new login on another browser or device ends the earlier Session at once, and the browser where it ended shows "Logged out. Your account was logged in on another device." The same message appears on your other browsers and devices after you change or reset your password, or finish an Access Code Account, on another device. If the message appears when you have done none of these things, follow section 14 without delay.

A Session ends when you log out and in any case seven days after it began. Changing your password, turning Two-step Login on or off and finishing an Access Code Account each start a new Session for the browser you used. The Security section of your Account settings shows when the Session of the browser you are using began.

Your Session is carried by a cookie that scripts on a page cannot read, that your browser sends only to the Site and, where the Site is reached over HTTPS, only over an encrypted connection. The Cookie policy lists the cookies the Site uses.

We record against your Account each login and the way it was made, each log-out, each failed two-step code at login, each failed Passkey confirmation during a Session and each Session ended by another login or by a change or reset of your password, and we use these records to investigate Security Incidents and reports made to Support. You can ask Support for the record of logins to your Account, which we send as the Privacy policy describes. If the record shows a login you did not make, follow section 14.

An Access Code Account that has not yet been finished has no password. Until you finish it by setting a password, its access code is a Credential, and you must keep it secret.

You can turn on Two-step Login in the Security section of your Account settings. You must first enter your current password, and also confirm with a Passkey if you have registered one. You then add the key we display to your Authenticator App and enter a code it produces within ten minutes. After five wrong codes the setup ends and must be started again.

While Two-step Login is on, each login with your password must be completed with a current code from your Authenticator App or with a Recovery Code. A code is accepted only once and only during its own 30-second period or the period immediately before or after it. After five wrong codes the login attempt ends.

When you turn on Two-step Login, we display ten Recovery Codes once only. Each Recovery Code works once. A request for a new set cancels every code in the earlier set. Keep your Recovery Codes apart from the device that holds your Authenticator App, for example written down and stored somewhere safe.

If you enter a Recovery Code at login, you may either complete the login with it, which uses the code up, or link a new Authenticator App, which also issues a new set of Recovery Codes. You must finish either step within ten minutes.

To turn Two-step Login off, or to ask for a new set of Recovery Codes, you must confirm with a Passkey or enter both your current password and a code from your Authenticator App.

When Two-step Login is turned on or off, every other Session of your Account ends and only the browser that made the change stays logged in.

You may register up to eight Passkeys and give each one a name. A Passkey works only at the Site's own address, so a website at any other address cannot use it, however closely it imitates the Site. Each Passkey login requires you to unlock the Passkey on your device.

To add or remove a Passkey, you must have logged in or confirmed your password within the previous five minutes and, if Two-step Login is on, also give a fresh code or a Passkey confirmation. Removing a Passkey ends every Session that logged in or confirmed with it, including the Session of the browser you are using if it did.

We strongly recommend that you turn on Two-step Login. While it is on, a person who learns your password cannot log in with the password alone. We also recommend that you register a Passkey, which cannot be used on a lookalike website; on its own, however, a Passkey does not stop a login with your password.

We require a Step-up Check before each action below. A code or Passkey confirmation counts as fresh for five minutes after you give it.

• Sending a Tip: a fresh code or Passkey confirmation if you have Two-step Login or a Passkey, and otherwise your current password.
• Moving money out of the Vault, or locking the Vault: your password or a Passkey confirmation and, if Two-step Login is on, also a fresh code or Passkey confirmation; one fresh Passkey confirmation satisfies both. Moving money into the Vault needs no Step-up Check.
• Changing your password or your email address: your current password, together with a fresh code or Passkey confirmation if Two-step Login is on.
• Turning Two-step Login on or off, asking for new Recovery Codes, and adding or removing a Passkey: the confirmations set out in section 7.
• Linking, replacing or unlinking a Steam account, saving a Trade URL and requesting a Withdrawal of Skins: a fresh code or Passkey confirmation if you have Two-step Login or a Passkey, and otherwise your current password.

If a Step-up Check is not completed, the action does not take place.

A Vault lock cannot be shortened once it has started. Money you lock in the Vault therefore stays there until the lock ends, even if another person gains access to your Account in the meantime.

Changing your password ends every other Session, cancels every reset and verification link already sent to you, and leaves your Passkeys and Two-step Login as they were.

A change of email address takes effect at once. We send a link to the new address, valid for 24 hours, which you must use to verify it, and a Change Notice to your previous address, so that you hear of the change even if someone else made it. Our record of the change keeps both addresses only as one-way hashes.

We also send a Change Notice when your password changes; when Two-step Login is turned on or off; when new Recovery Codes are issued; when a Recovery Code is used to log in or to link a new Authenticator App; and when a Steam account is linked, replaced or unlinked or your Trade URL changes.

Each email we send about your Account is in plain text, carries no attachment and no unsubscribe link, comes from the address listed in clause 12.1 and reminds you that we never ask for your password or security codes. A Change Notice says what kind of setting changed and how to reach Support if you did not make the change. It never asks you to enter a Credential. The emails we send are those listed in clause 22.2 of the Privacy policy.

Account emails, including Change Notices and reset links, are sent only while email delivery is switched on for the Site.

We do not send marketing emails. An email in our name that offers a bonus, a prize, a giveaway or an increase on a Deposit was not sent by us.

If you forget your password, you can ask for a reset link from the login screen. The link works once and for 30 minutes, and stops working sooner if your email address or your password changes in the meantime.

A password reset ends every Session of your Account but does not turn off Two-step Login or remove any Passkey. Where Two-step Login is on, a person who gains control of your email account therefore cannot log in with a reset link alone.

If we cannot email you a reset link, you may write to Support from the email address registered to your Account. After making the checks it considers necessary, Support may issue a reset link that works once and expires 24 hours after issue. Each such link is recorded with the member of staff who issued it and the reason. Support cannot issue a link for a suspended Account.

If you have lost your Authenticator App, every Recovery Code and every Passkey, write to Support from the email address registered to your Account. We may restore your access only after you pass the identity checks described in section 7 of the Terms, and we will refuse if we cannot be satisfied that you hold the Account.

We do not restore access to an Account, reset a Credential or change an email address on the strength of a message received through a social network, a direct message, a ticket in our Discord server, Steam or any channel other than Support.

This section applies while Skins Deposits and Withdrawals are offered in the Cashier. The Skins trading policy and section 18 of the Terms govern Skins trades and the part Steam plays in them.

To trade Skins you link a Steam account to your Account. The Site sends your whole browser window to Steam's own login page, and Steam returns you to the Site after you log in there. We confirm Steam's answer with Steam directly before we record the link. We never ask you to log in to Steam through a form on the Site, in a pop-up or in a window drawn inside a page.

A Steam account can be linked to one Account only. You cannot replace or unlink your Steam account while a Skins trade is open.

The Trade URL you save must belong to the Steam account linked to your Account. We check it through AssetPay before accepting it, and we store it encrypted.

After a Steam account is linked, replaced or unlinked, or a Trade URL is changed, Withdrawals of Skins are held for a waiting period, currently 24 hours, during which the Cashier shows "Withdrawals open soon." The waiting period gives you time to act on the Change Notice if you did not make the change.

Every Skins trade takes place as a Steam trade offer. Before you accept an offer, check in Steam that its items match those shown for the trade on the Site. Decline any offer whose items differ, any offer you were not expecting and any offer that arrives while you have no open trade on the Site.

A person who holds your Steam API key can watch your trade offers, cancel them and send you a copy from an account made to look like the real one. No part of the Service uses your Steam API key, and we will never ask you to create or share one. If a trade offer shows as declined when you did not decline it, the Site asks you to check your Steam API key. Open the API key page on Steam's own website, revoke any key you did not create for yourself and change your Steam password.

Protect your Steam account with Steam Guard in the Steam mobile app, and confirm trades only in that app. We never ask for your Steam password or a Steam Guard code.

Keeping your Account secure is a responsibility we share with you. We are responsible for the measures in sections 3 to 10. You are responsible for keeping your Credentials secret, for the security of your devices, your email account and your Steam account, and for the steps in this section.

You must:

• use a password for your Account that you use for no other service, and change it at once if you think anyone else may know it;
• never disclose a Credential to anyone, including a person who says they work for us;
• protect the email account registered to your Account with its own unique password and its own two-step protection, because whoever controls it can ask for a reset link;
• keep your Steam account secure as section 10 describes;
• store your Recovery Codes apart from the device that holds your Authenticator App;
• keep your devices, operating system, browser and apps up to date, and install apps and browser extensions only from sources you trust;
• run security software on your devices, keep it up to date and scan with it regularly;
• protect each device with a screen lock, and lock it whenever you leave it with the Site open;
• log out when you will not use the Site for a while, on your own devices as well as on shared ones, and on any device that another person can use, log out each time you finish and do not let the browser save your password;
• keep anyone under 18 away from the Site and from any device on which you are logged in, using the parental controls and blocking tools described in section 23 of the Responsible gambling policy, as clause 13.15 of the Terms requires; and
• tell Support at once if you suspect that someone else has used, or is able to use, your Account.

Do not install any browser extension, script or program that claims to predict a Game, improve your results, play for you or change your Balance. Such tools are forbidden by the Terms, cannot predict a Provably fair result and are a common way of stealing Credentials.

When you stream, record or share your screen while using the Site, remember that your Balance shows on the screen, and keep your email address, your Trade URL, your Recovery Codes and any code or link we send you off the screen. A win shown in public can also draw the approaches described in clause 13.3.

Before you enter a Credential on a network you do not control, such as public Wi-Fi, check that the address bar shows the Site's address exactly. Do not connect to the Site through a VPN, a proxy or any other Masking Tool: the Terms forbid it, and clause 3.8 describes how the Network Check treats such a connection.

Your Account is personal to you. Sharing, selling or lending it, or letting another person use it, breaks clause 6.10 of the Terms.

As clause 6.9 of the Terms provides, anything done through your Account with your Credentials before you tell us that your Account may be compromised is treated as done by you, to the extent Applicable Law allows.

If you no longer wish to use the Service, you may ask Support to close your Account under clause 16.9 of the Terms. A closed Account can no longer be used to log in.

Our Official Channels are:

• the Site at https://peeks.gg and the subdomains of peeks.gg that we operate;
• Support on the Support page, through live support messages, whether or not you are logged in;
• the email address support@peeks.gg;
• the address from which we send emails about your Account; and
• our Discord server, which the Site links to, including its support tickets and the automated messages of its bot.

We publish any new Official Channel on this page before we begin to use it. Treat any other website, address, account or app that claims to act for us as false.

We do not offer any browser extension or desktop program. The only automatic play we offer is Autobet and Auto mode in the Originals, which section 9 of the Game rules describes, and both are used only on the Site. We publish no app in the App Store, Google Play or any other app store. You can add the Site to the home screen of your phone from your browser's menu, and the icon this creates opens the Site and nothing else. An app in any store that uses our name or logo is not ours, and you must not enter a Credential in it.

No member of our staff will ever ask you, in any channel:

• for your password, a code from your Authenticator App, a Recovery Code or a link from an email we sent you;
• to approve a Passkey prompt or a login that you did not start yourself;
• for your Steam password, a Steam Guard code or a Steam API key, or to create a Steam API key;
• to log in through a link sent in a direct message, or on any page that is not on the Site;
• to install software, a browser extension or a remote access tool, or to share your screen;
• to send a Tip, a Deposit or Skins to any person or Steam account, whether to verify your Account or for any other reason;
• to pay a fee, a tax or a deposit to release a Withdrawal, a prize or a held Balance;
• to send a copy of an identity document, a selfie, a proof of address or any other document, except through the channels described in section 11 of the Identity verification policy;
• to give your name, date of birth or address by email, in a direct message or on Discord, since you give them only on the Site; or
• to continue a conversation in a direct message or in any channel that is not an Official Channel.

Staff may answer general questions in the public channels of our Discord server, and you may open a support ticket there, including about your Account. A ticket can answer your questions, but we restore access, reset a Credential or change an email address only through Support, as clause 9.5 provides. No member of staff will open a direct message with you on Discord, Steam or a social network about your Account. Our Discord bot sends two kinds of automated direct message only: a message about an application you made in our Discord server and, when a ticket you opened closes, a copy of that ticket as a file. Neither asks for a Credential.

A person who asks you for anything listed in clause 12.4 is not acting for us, whatever name, picture, role or badge their account shows.

Before you act on a message, a website, an account or a request that claims to come from us, you can ask Support whether it is genuine. Send the address, the username or a screenshot, and do not follow its instructions while you wait for our answer. You may ask as often as you need.

Use live support on the Site, while you are logged in, for anything about your Account. Those messages travel over the Site's encrypted connection and reach only our staff. Email can pass through other systems on its way and can be forged, so never put a Credential in an email to anyone, including us, and send identity documents only through the channels described in section 11 of the Identity verification policy.

Lookalike websites. Scam websites copy the appearance of a casino at an address that differs from the real one by a letter, a word, a hyphen or an ending, and keep whatever you type. Before you enter a Credential, check that the address bar shows peeks.gg exactly. Reach the Site by typing its address or from your own bookmark, never from an advertisement, a sponsored search result or a link in a message. The padlock in the address bar shows only that the connection is encrypted: scam websites have one too, so it does not show that a page is ours. A Passkey will not work on a lookalike website, and a password manager will not offer your saved Peeks password there. If your device does not offer your Passkey, or your password manager does not offer your password, on a page that asks for them, treat the page as false and check its address.

Phishing messages. Treat as suspect any email, direct message or text message that presses you to act at once to save your Account or your Balance, offers money, a prize, a bonus or a refund, asks for anything listed in clause 12.4, links to an address that is not on the Site, or comes from a sender that is not an Official Channel. Do not open its links or attachments and do not reply to it. A sender's name and address can be forged, so a message is not genuine merely because it appears to come from us. Before you open a link, check where it really leads: on a computer, rest your pointer on it; on a phone, press and hold it; then read the address that appears. Our account emails carry no attachment and no unsubscribe link, as clause 8.7 states. Do not use an unsubscribe link in a suspect message, because doing so tells the sender that your address is in use.

Fake staff and fake support. Scammers copy the names, pictures and roles of our staff, and of known players and streamers, on Discord, Steam and social networks. They then send direct messages offering help, a reward or a "verification" of your Account. Our staff deal with you only as clause 12.5 describes. Scammers also watch public lists of wins and Tips and then contact the player, often posing as a streamer or a sponsor, with an offer to share a balance, to appear in a video or to double a win, which leads to a false website or to a request for a Tip. Feeds of Bets show only the start of your username, and Tips sent to you are not shown publicly, because your Account does not take Tips marked public. In Settings you can turn off Public profile, so that your Bets show as Hidden and you no longer appear in player search, and turn off Public stats. Treat any approach that follows a win as suspect.

Tip scams. A Tip is final once sent. No player and no member of staff can double, multiply or give back a Tip for you. Anyone who asks you for a Tip in return for a larger amount, a loan, a tip-off, a share of winnings, a giveaway entry or an Account is attempting a scam. We reverse a Tip only in the cases the Terms set out.

Predictors and bots. No tool, script, seller or so-called insider can predict or influence the result of a Round. The result of each Bet on an Original follows from a server seed that is fixed, and whose hash is shown to you, before the Bet is placed, as the Fairness policy describes. People who sell such tools want your money or your Credentials.

Fake Steam login windows. Some scam websites display what looks like a Steam login window but is only an image drawn inside the page. A genuine Steam login from the Site always moves your whole browser window to Steam's own website, as clause 10.2 explains. If a Steam login appears in a pop-up that cannot be moved outside the browser window, or the address it shows is not Steam's, close the page. If you are already logged in to Steam in the same browser, Steam's own page normally recognizes you, and your password manager offers your Steam details there. A form that makes you type your Steam details from the start is a warning sign.

Stolen API keys and swapped trade offers. A scammer who has your Steam API key can cancel a genuine trade offer and at the same moment send you a copy from a lookalike account. Follow clause 10.7, and check the trade partner and the items of every offer before you accept it.

Account sellers and recovery services. Anyone who offers to sell, rent, recover or unlock an Account, or to lift a Play break or a Self-exclusion, is not acting for us. Only Support can take action on an Account.

Reporting a scam. Tell Support about any lookalike website, fake account, phishing message or other scam you see, with screenshots and the address or username involved. Where you received a suspicious email, forward it to support@peeks.gg as an attachment, or with its full headers, without changing its subject line, so that we can see where it came from, and then delete it.

What we do about impersonation. When we learn of a website, an account, an app or a message that pretends to be us, we ask the company that hosts it, registers its address or runs its platform to remove it, and we may report it to the services that warn browsers about dangerous websites. We publish known false addresses and accounts and warn players on the Site and in our Discord server when a new scam is aimed at them. We do not tell anyone who made a report.

Your Account may be compromised if, for example, you see the message in clause 6.3 when you had not logged in elsewhere or changed or reset your password, you receive a Change Notice for a change you did not make, your history shows a Bet, a Tip, a Vault movement, a Skins trade or a Withdrawal you did not make, a trade offer is declined or canceled without your action, or your correct details no longer let you log in. Act as if your Account is compromised also if you entered a Credential on a page you now doubt, if you find malicious software on a device you use for the Site (clause 14.9), if you lose a device that is logged in to the Site or holds your Authenticator App or a Passkey (clause 14.10), or if you learn that your password or your email account has been exposed in a data breach.

If you can still log in, change your password at once, which ends every other Session; turn on Two-step Login; and check the Passkeys listed in the Security section of your Account settings, removing any you do not recognize. If a device you use for the Site may be infected, do this from a clean device, as clause 14.9 describes.

Contact Support as soon as you can, saying what you noticed and when. If you ask us to lock your Account because you think someone else can use it, we treat the request as urgent, suspend the Account as soon as a member of staff reads the request, and confirm to you when it is done. You can ask through live support while logged in, by email from the address registered to your Account or from the previous address named in a Change Notice, or through live support without logging in, in which case we may first ask you to show that you hold the Account. We may also suspend your Account on our own initiative while we look into the matter. A suspension ends every Session and stops all activity on the Account until we lift it, which we do once you have passed the checks we ask for and secured your Credentials.

Review your transactions and your Bets on the Site, and tell Support about each item you did not make.

Secure your email account: change its password, turn on its two-step protection, and check that no forwarding rule or recovery address has been added without your knowledge.

If your Steam account may also be affected, change your Steam password, use Steam's option to sign out all other devices, revoke any Steam API key you did not create, review your Steam trade history and contact Steam Support. We cannot reverse a Steam trade or take any action inside Steam.

Where the compromise involves a crime, such as theft or extortion, you may also report it to the police where you live. We cooperate with lawful requests from the authorities as the Privacy policy describes.

We investigate every report made under this section and tell you the outcome. If you disagree with it, you may complain under the Complaints policy.

Malicious software on a device can record what you type, see your screen and copy the cookie that keeps your browser logged in, and whoever holds that cookie can use your Session without your password or a two-step code. If you think a device you use for the Site is infected, stop using it for the Site. From a clean device, log in, which ends every other Session, including any copied one, then change your password and check your Passkeys as clause 14.2 describes. Clean or reset the infected device before you use it for the Site again.

If you lose a device you use for the Site, or it is stolen:

• log in from another device, which ends the Session on the lost one; if the lost device held your Authenticator App, enter a Recovery Code at login and link the app on a new device, which also gives you new Recovery Codes, as clause 7.4 describes;
• change your password;
• in the Security section of your Account settings, remove every Passkey that the lost device can use, including any that your password manager keeps in step with it, and any Passkey you do not recognize, and register a Passkey again later from a device you trust;
• if you cannot do these things, ask Support to suspend your Account until you can, as clause 14.3 describes; and
• secure your email account, your password manager and your Steam account in the same way, because the lost device may give access to them too.

When you report that someone else has used your Account, we trace where its money went. We may hold any Withdrawal from your Account that has not yet been sent, and we may suspend any Account that received a Tip from yours while we investigate. Where the records show that a Bet, a Tip, a Vault movement or a Withdrawal was not made by you, we deal with it under section 20 of the Payments policy, and where the recipient of a Tip took part in the misuse, we may reverse that Tip as the Terms allow. Any amount we restore is returned to your Balance with new ledger entries under clause 4.4. A loss we cannot recover is dealt with under clause 6.9 of the Terms, and we tell you the outcome under clause 14.8.

If Skins were taken from your Steam account and you believe they were deposited on the Site, tell Support, whether or not you hold an Account, and give your Steam ID, the items, the time they left your inventory and any report you made to Steam or to the police. We check our records of Skins Deposits. Where they match, we may suspend the Account that made the Deposit and hold the Balance it produced while we investigate. We cannot return items through Steam. What happens to the value we hold is decided after our investigation and as Applicable Law requires, and we share information with Steam, AssetPay and the police where the law allows.

To protect you, other players and the Service, we may, where the circumstances reasonably call for it:

• end any Session of an Account;
• suspend an Account, which ends every Session and stops all activity on it;
• suspend an Account for your protection where its activity suggests that someone else has taken control of it, and contact you through an Official Channel about restoring it;
• require a new password, Two-step Login or identity checks before an Account is used again;
• refuse or reverse a Tip, and refuse, hold or reverse a Withdrawal or any other transaction, as the Terms allow;
• pause a Game or a feature of the Service;
• refuse connections from a network or device linked to an attack, to a Masking Tool or to a breach of the Terms;
• reset a username that imitates our staff or another person; and
• report conduct to the police or another competent authority and give them information as the law allows or requires.

We take each measure in proportion to the risk, record it with its reason and review it when the facts change. Unless doing so would prejudice an investigation or break the law, we tell you through an Official Channel when a measure affects your Account.

Bets, results and amounts that arise from a Vulnerability, from use of an Account without its holder's authority or from a breach of this Policy are dealt with under sections 14 and 16 of the Terms.

When we become aware of a Security Incident, we act at once to contain it, establish its cause, assess its effects and restore the affected parts of the Service, and we keep a record of the facts, the effects and the steps taken.

Where a Security Incident affects Personal Data, we notify the people concerned and the Agency for the Protection of the Data of Inhabitants (PRODHAB) where section 16 of the Privacy policy requires it, and in the way that section sets out.

Where a Security Incident puts Accounts at risk, we may end every Session, require new passwords, pause Withdrawals, Tips or Games, and publish a notice on the Site stating what happened, what we have done and what you should do.

Where a Security Incident has caused a wrong change to a Balance or to the result of a Round, we correct it with new ledger entries under clause 4.4 and tell each player affected.

We welcome Reports from Researchers acting in good faith. This section sets out what may be tested and how, and section 18 sets out how we handle Reports.

You may test, within the rules in clause 17.5, the Site at peeks.gg and the subdomains of peeks.gg that we operate, including login, Two-step Login, Passkeys and recovery; the Account, its settings and its Sessions; the Cashier, the Vault and Tips; the Originals, the Seeds and the Verifier; Support; and the programming interfaces that the Site calls.

You must not test Studio games or the systems of the Studios and the Game Aggregator; Steam; AssetPay; Cloudflare; Discord, including our Discord server and bot; or the systems of our hosting, email and network intelligence providers. We cannot authorize testing of systems we do not own. If you notice a weakness in one of them while using the Service, tell us about it without testing it, and we will pass it on where we can.

We do not accept the following as Vulnerabilities unless you show how they can be used to cause real harm:

• a missing security header or cookie attribute;
• preferences about TLS settings, such as cipher order or protocol versions;
• missing or weak email authentication records, such as SPF, DKIM or DMARC;
• version numbers, server banners, error pages or detailed error messages;
• well-known public files such as robots.txt, and HTTP methods that are enabled but cannot be misused;
• framing of a page that offers no sensitive action;
• request forgery against logging out or against forms that need no login;
• script injection that only the tester can trigger, in the tester's own browser;
• open redirects, text injection and content spoofing that cannot change the code of a page or lead to further harm;
• learning through the sign-up form or a change of email address that an address is registered, which clause 3.7 describes;
• a browser's offer to save or fill in a password;
• the absence of a rate limit on an action that carries no security risk;
• output from automated scanners without a working proof of concept;
• software versions said to be out of date;
• attacks that need control of the network between the victim and the Site; and
• weaknesses that need physical access to a victim's device, a rooted or jailbroken device or an unsupported browser.

While testing, you must:

• use only your own Account, and use Fun play wherever the test does not need money;
• ask Support before you begin if your test needs a second Account, so that we can arrange one without breaking clause 6.2 of the Terms;
• stop as soon as you have shown that a Vulnerability exists, and not use it further;
• not reach, change, copy, keep or delete data that is not yours, and if you reach such data by accident, stop, tell us in your Report and delete every copy;
• not keep, stake, Tip, move or withdraw any amount gained through a Vulnerability, which is not yours and which we may reverse;
• not slow down or interrupt the Service for others, send floods of requests, or run automated tools at more than a light rate;
• not test our premises or approach our staff, players or suppliers by deception;
• not leave code, files, Accounts or changes behind on our systems;
• comply with the law of the place where you carry out your tests, which nothing in this Policy can set aside; and
• comply with the Terms throughout, including the rules on Masking Tools and Restricted Territories.

Checking your own Bets with the Verifier, and studying published results, is not testing under this section and needs no permission.

Send each Report to support@peeks.gg with the subject line "Security report". Make a separate Report for each Vulnerability, and include:

• a description of the Vulnerability and what kind it is;
• the pages, addresses or features affected;
• the steps needed to reproduce it, and how often they reproduce it;
• the browser, the device and the operating system you used, with their versions;
• your evidence, such as screenshots, a video or a script, attached to the email rather than shared by a public link;
• the harm you believe it could cause, and the rating you would give it under clause 18.3;
• your username, the times of your tests and the network addresses you used, so that we can tell your tests apart from attacks; and
• how we can contact you.

Include no Personal Data of anyone else in a Report beyond what you need to show the Vulnerability. If your evidence includes data that should not travel by ordinary email, ask us at the address in clause 17.7 for an encrypted way to send it before you send it.

If the Vulnerability lets a person take money, reach another player's Account or data, or change the result of a Round, or if you see signs that someone is already using it, also send a live support message, whether or not you are logged in, saying only that you have sent an urgent security report and when. Put no details of the Vulnerability in that message. We look at urgent reports and may pause the Game or feature concerned at once under clause 15.1.

A fault that does not affect security, such as a display error, a broken link or a spelling mistake, is not a Report. Tell Support about it in the usual way.

We acknowledge each Report within 5 Business Days. We then assess it, may ask you for more detail, and tell you whether we accept it as a Vulnerability. Until the Vulnerability is fixed we update you regularly, and we tell you when we consider the matter resolved.

You must keep the details of a Report confidential until we tell you that the Vulnerability is fixed. After that you may publish your findings once you have shown us the text in advance, leaving out any Personal Data and any detail that would still help someone attack the Service. Once a Vulnerability is fixed, we may publish a summary of it and, if you agree, name you or your username as the person who reported it.

Where we pay a reward, it is paid only for the first Report of a Vulnerability not already known to us that leads us to change the Service. We rate each accepted Vulnerability as Low, Medium, High or Critical by the harm it could cause and how easily it could be used, and the amount of a reward depends on that rating. We pay a reward, in US dollars, and never as an amount added to a Balance. No reward is paid to our staff or their Connected Persons; to the staff of our suppliers, of AssetPay, of the Game Aggregator or of a Studio; to anyone who learned of the Vulnerability through work done for us; to any person under 18; to any person in a Restricted Territory; or to any person subject to sanctions. You are responsible for any tax due on a reward.

A message that demands payment, sets a deadline or threatens to publish, use or sell a Vulnerability is not a Report under this Policy. We do not negotiate under threat, and we may refer such a message to the authorities.

Where you comply with sections 17 and 18, we treat your testing as authorized by us for the purposes of the Terms, we will not close your Account or withhold any amount owed to you because of it, and we will not file a criminal complaint or bring a claim against you on account of it. This undertaking binds us alone and cannot authorize testing of any system we do not own. If a supplier or anyone else complains about testing that complied with sections 17 and 18, we confirm to them, at your request, that we authorized it.

If you are unsure whether a test is permitted, ask us at the address in clause 17.7 before you carry it out.

We process the Personal Data in a Report under the Privacy policy. We may share the technical content of a Report with a supplier whose systems are affected, without identifying you unless you agree.

Making a Report does not make you our employee, contractor, partner or agent, and gives you no right to payment except under clause 18.3.

We may change or end the arrangements in sections 17 and 18 by amending this Policy. A Report made before a change is handled under the version of this Policy in force when you made it.

We apply the measures in this Policy with reasonable care, but no system can be made completely secure. To the extent Applicable Law allows, we are not liable for loss that results from your failure to follow section 11, or from the acts of a third party outside our reasonable control, as section 19 of the Terms provides.

Nothing in this Policy limits or excludes any liability that Applicable Law does not allow to be limited or excluded, or any right that you have as a consumer and cannot give up.

This Policy gives rights only to you and to us, except that a Researcher who complies with sections 17 and 18 may rely on clause 18.5.

This Policy does not describe every measure we take. We keep some measures confidential where publishing them would make them less effective.

We may amend this Policy in the same way and on the same notice as the Terms under clauses 1.6 and 1.7 of the Terms. The date at the top of this page shows when it last changed. We review this Policy and the measures it describes at least once a year, after every Security Incident that affects players, and whenever we change how login, recovery or the Cashier works, and we correct this page wherever it no longer matches the Service.

The laws of the Republic of Costa Rica govern this Policy, and any dispute about it is resolved under section 21 of the Terms.

You can contact us through Support or at support@peeks.gg. Send Reports to the address in clause 17.7. The details of the Operator are in section 3 of the Terms.