Privacy Policy
Updated · DMFirst
This policy explains what DMFirst stores, why, where it is kept and how you can delete it. It covers the official DMFirst website at dm1st.uk and the DMFirst game at app.dm1st.uk. It does not cover other websites or apps that copy the DMFirst name; they are not ours and follow their own rules, if any.
Last updated: .
Who We Are
DMFirst runs the official DMFirst website (dm1st.uk), with its guides, and the DMFirst colour prediction game (app.dm1st.uk), which is played with free virtual coins that have no cash value. In this policy, "we" and "us" mean DMFirst, and "you" means anyone who visits the website or plays the game. You can reach us at [email protected].
Summary
- The website stores nothing personal about you and uses no analytics or advertising trackers.
- The game stores your account on our server: username, optional email, a password hash, date of birth and coins.
- Passwords are never stored in plain text.
- We never ask for your phone number, ID documents, bank, UPI or card details, because the game has no payments.
- We do not sell or rent your data, and we do not show adverts.
- You can delete your account yourself at any time.
What the Website Itself Stores
The guide pages at dm1st.uk do not ask you to sign in and do not collect personal data. We do not run analytics tools, advertising tags or tracking pixels on the website, and our code does not set cookies.
The website registers a service worker, a small script that saves one short "you are offline" page in your browser's cache. It is shown only when your connection drops. Pages are always loaded fresh from the network, and the service worker does not read or send anything about you. You can remove it by clearing the site data for dm1st.uk in your browser settings.
What the DMFirst Game Stores on Its Server
The game at app.dm1st.uk has real accounts, so the same account works on any phone or computer. To make that possible, our server keeps the items below and nothing more.
| Item | What it holds | Why |
|---|---|---|
| Account | Username, email (only if you add one), password hash, date of birth, coin balance, the time the account was created, and whether it is a guest account | To run your account, check your age and keep your coins |
| Sessions | A hashed log-in token for each device you sign in on, and when it expires | To keep you signed in without asking for your password every time |
| Bets | Each pick: the room and round, the pick type and value, the coins staked, the coins paid back, and the time | To settle rounds, show your bet history and spot abuse |
| Bonuses | Each daily bonus or refill you claim: the type, the time and the number of coins | To give each bonus only once in its time window |
| Weekly stats | For each week you play: your net coins, wins and number of plays | To build the weekly leaderboard |
Guest accounts get a username made by the game, and instead of a real birth date the server stores a stand-in date that meets the 18+ check you passed. If you upgrade a guest, the username, password and optional email you choose replace these.
If Google sign-in is offered in the game and you choose it, we also store the ID that Google gives your Google account and, when Google has verified it and no other account uses it, your email address. We do not receive your Google password.
The game also keeps a public record of every round: the room, the round number, the commit hash, the seed and the result. These records say nothing about you; they let anyone check that results were fixed before picks closed.
What the Game Keeps on Your Device
The game saves a few small items in your browser's local storage on your own device:
- your log-in token, so you stay signed in;
- your language choice (English or Hindi);
- that you passed the 18+ age check, and the date of birth you entered there, so you are not asked again;
- for guest accounts, the guest username and password the game created for you.
Clearing site data for app.dm1st.uk removes these items. A full account stays on our server and you can log in again, but a guest account cannot be reopened once its saved details are gone.
How Passwords Are Protected
Your password is never stored in plain text. The server mixes it with a random salt and runs it through PBKDF2, a slow hashing method built to resist guessing, and keeps only the result. Log-in tokens are stored as hashes too. This means nobody at DMFirst can read your password, and we will never ask you for it.
Why We Use This Data
- To run your account: sign-up, log-in, staying signed in and your profile.
- To keep your coins: your balance, bets, bonuses and refills.
- For the leaderboard: weekly results for the top players.
- For fairness: settling every round the same way and spotting cheating or abuse.
- For age checks: your date of birth is used only to confirm you are 18 or over.
- For support: your email, if you add one, lets us confirm an account is yours when you write to us.
We do not use your data for advertising or profiling, and we do not send newsletters or marketing emails.
What Other Players Can See
The weekly leaderboard is public. If you are among the top players for a week, your username appears with that week's net coins, wins and number of plays. Your email, date of birth and bet history are never shown to other players. Pick a username that does not reveal your real name if you prefer to stay private.
What We Never Collect
- phone numbers or OTPs;
- bank, UPI, card or wallet details, because the game has no payments;
- Aadhaar, PAN or any ID document;
- your location, contacts, photos or device files.
Links to outside websites, such as public helplines, open those sites in a new tab; their own privacy rules apply there. Websites and apps that copy the DMFirst name are not run by us, and we do not receive anything you give them.
Hosting and Request Logs
The website and the game are hosted on Cloudflare, and the game's accounts are kept in Cloudflare's database service. Like any web host, Cloudflare receives standard technical details when your browser makes a request, such as your IP address, browser type (user agent), the page requested and the time. It processes these to deliver the service and protect it from abuse and attacks. If its security checks need to test a visitor, Cloudflare may set a short-lived security cookie of its own. We do not use these details to profile or advertise to you.
How Long We Keep Data
- Your account, bets and weekly stats are kept until you delete the account.
- Log-in sessions end when you log out, and expire on their own after 30 days.
- Bonus claim records hold only an internal account number, the type, the time and the coins. After you delete your account they no longer link to any username or email.
- Round records (results, hashes and seeds) are kept as the public fairness history of the game.
Deleting Your Account
Log in and open the delete account page in the DMFirst game. When you confirm, your account, sessions, bets and weekly stats are removed from our server straight away. This cannot be undone, and your coins are lost.
If you cannot log in, email [email protected] from the address saved on your account and ask us to delete it. To remove what the game saved on your device, clear the site data for app.dm1st.uk in your browser.
Children
The website and the DMFirst game are for adults aged 18 and over only. Sign-up asks for a date of birth and refuses anyone under 18. If you believe a child has made an account, email us and we will delete it. Our safety guide for players and parents has more advice for families.
Your Rights
You can ask us at any time to:
- tell you what data we hold about your account;
- correct data that is wrong;
- delete your account and its data;
- explain how we use your data.
Email [email protected] from the address on your account so we can confirm it is you. If you are not happy with our answer, you may contact the data protection authority in your country.
Changes and Contact
If the way we handle data changes, for example if a new sign-in option is added, we will update this page and the date at the top. Questions about this policy go to [email protected] or through the contact page. The rules for using DMFirst are in our terms and conditions, and you can return to the DMFirst home page at any time.