Policy
Most policy pages exist so somebody can say one exists. This one is short because the site does very little: it holds no accounts, sets no cookies, sends nothing anywhere, and has no advertising. The rest of this page explains that in enough detail that you can verify it yourself.
1. What this site is
A blackjack simulator for practice. You place bets with counters that have no value, the dealer follows the rules of a real casino table, and a strategy chart tells you whether your decision was correct.
Nothing can be paid in. Nothing can be paid out. There is no stake, no prize, no jackpot, no virtual currency you can buy, sell, trade or convert, and no mechanism by which a number on this site becomes anything else. That is a deliberate design decision, not a limitation waiting to be lifted.
2. What it is not
- Not a casino, and not a game of chance in the legal sense. Under the Swiss Federal Act on Gambling, a money game requires a stake of monetary value or the chance to win something of monetary value. Neither exists here.
- Not affiliated with any casino, betting operator, gaming platform or gambling brand. No sponsorship, no partnership, no commercial relationship of any kind.
- No links to gambling operators. Not in the content, not in ads, not in a footer, not in a "recommended" list. If you ever find one on this site, it is a mistake and I want to hear about it.
- No advertising. There is no ad slot in the code and no ad network account attached to this domain. This is not a "we may introduce ads later" clause. If that ever changed, this page would say so before it happened.
- Not gambling advice. Basic strategy reduces the house edge. It does not remove it. A perfectly played blackjack hand is still, on average, a losing bet.
3. Who runs it
The site is published under the name GreenThief. Behind it is one person: Martino Canzali, a private individual in Switzerland, running this as a personal project. It is not a company, it sells nothing, and it has no commercial activity.
Contact: hello@blankjack.com. I read everything; I answer most things.
Swiss data protection law requires the person responsible for a website to be identifiable, which is why the real name is here rather than only the handle. A postal address is not published because this site offers nothing for sale — if that ever changes, a full postal address will be added here at the same time.
4. What is stored, and where
In your browser, by the site
The game saves your progress locally using your browser's own storage. This data never leaves your device — there is no server call that could carry it away. Two entries exist:
| Key | Contains |
|---|---|
bj:practice | Your play-money bankroll, session statistics (hands played, wins, losses, decision accuracy), and your table settings (number of decks, dealer rule, penetration, whether the count is shown). |
bj:supportSeen | A timestamp, so the support message is not shown to you again for a month. |
Neither contains your name, your email, an identifier, or anything that describes you as a person. To delete both: clear site data for this domain in your browser settings, or use your browser's private window and close it. There is no copy anywhere else, so there is nothing for me to delete on my side.
On the server
The pages themselves are static files served by Render.com, which like every web host keeps its own access logs.
The API is different, and this is where self-hosting lets me make a stronger promise than a rented service could. It runs on my own machine at Oracle Cloud in Zürich, and the web server in front of it is configured to log errors only, with the IP address fields deleted before anything is written to disk. That is not a policy I am asking you to trust — it is four lines in a configuration file I would show anyone who asked.
If you email me
I keep the email, because that is how email works. I do not add you to anything.
The leaderboard
This is the one part of the site that sends anything to a server, and only if you choose to take part. Playing without claiming a name sends nothing, ever.
If you claim a name, a row is created in a PostgreSQL database running on a machine I rent and administer myself, in Zürich. No third-party database company is involved, and nobody but me can read it. The row contains:
| Field | What it is |
|---|---|
| Name | The nickname you typed. Public. Choose something you are comfortable having on a public page — it is the only thing about you that anyone else can see. |
| Identifier and secret | Two random values generated by the server. The identifier is stored as-is; the secret is stored only as a SHA-256 hash, so even a stolen copy of the database cannot be replayed to log in as you. Together they are your recovery key, and they identify a save file rather than a person. |
| Peak bankroll, hands, decision counts | Your play-money record. Public except the raw decision counts, which are shown only as a percentage. |
| Timestamps | When the row was created and last updated. Used for rate limiting. |
No email, no password, no account, no IP address in that row. Ranked sessions are also recorded — the rules you played, how many hands, and the shuffle seeds described in section 5 — so that any figure on the leaderboard can be traced back and verified.
Deleting it is one click. The "forget this name" control on the practice table removes the row from the database and the key from your browser. It is immediate and complete, and it needs no email to me and no identity check, because the key in your browser is the proof.
What still does not exist
No accounts, no passwords, no user profiles, no newsletter, no contact form, no comments, no advertising, no analytics.
5. The leaderboard, honestly
The game runs in your browser. That is what makes it fast, private and free to host — and it means the score your browser sends is a claim, not a proof. Someone who opens the developer console can send a number they never earned.
Ranked mode works differently, and this is the reason it exists. The server holds the shoe, deals every card and keeps the bankroll. The browser sends intentions — bet this much, hit, stand — and receives only what a player at a real table would see. The dealer's hole card is not in the response until it is turned over, so it cannot be read out of the network traffic. Nothing your browser does can invent a card or a payout, because your browser never produces either.
Only ranked sessions are ranked. Casual play stays entirely on your machine, offline and unrecorded, and never reaches the leaderboard.
Provably fair shuffling
You should not have to take my word that the shoe is not stacked against you either. Before a single card is dealt, the server publishes the SHA-256 hash of the secret seed that determines the whole shoe. When the shoe is finished, the seed itself is published. Anyone can hash the revealed seed, check it against what was promised beforehand, re-derive the exact card order, and confirm it matches what they were dealt.
Because the hash is fixed before the first card, the server cannot change its mind partway through: any alteration would produce a seed whose hash no longer matches what was already published. The seeds for every finished session stay available, and the verification tool is a short script anyone can read.
Names are public and moderated by hand. Impersonation, slurs and advertising get deleted or renamed without notice.
6. Cookies and tracking
This site sets no cookies. That is why you were not asked to accept any. A consent banner for a site with no cookies is theatre, and I would rather not perform it.
The two storage entries described above are not cookies: they are never transmitted with requests, they stay on your machine, and they exist only to make the game work between visits.
There is also no analytics of any kind — no Google Analytics, no Plausible, no Matomo, no pixel, no heatmap, no error reporting service. I do not know how many people visit this site, and I have made my peace with that.
No third-party requests. Every file the page loads comes from this domain: no CDN, no external fonts, no embedded video, no social buttons. Open your browser's network tab and check — the list should be short and entirely first-party. The one exception is if you click the support link, which takes you to an external payment page; from there, that provider's own terms apply.
7. Your rights over your data
Under the revised Swiss Federal Act on Data Protection, and the GDPR if you are in the EU, you can ask for access to your personal data, correction, deletion, restriction, and you can object to processing.
If you never claimed a leaderboard name, these rights are almost empty here, which is the point: apart from server logs I hold nothing about you and could not link a log entry to a person if I tried.
If you did claim a name, the data is the row described in section 4, and you can exercise every one of those rights yourself: the name is the only thing you gave me, the recovery key proves it is yours, and the delete control removes the row and every session attached to it immediately. No request to me, no waiting period. Write to the address above if the control does not work or if you want a copy of what is held.
Because the database is mine rather than a supplier's, there is no third party to ask and no data processing agreement standing between you and the deletion.
If you think I have handled your data badly, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), or to your national supervisory authority in the EU.
8. How the game behaves
- Cards are drawn from a simulated shoe shuffled with a standard algorithm using your browser's random number generator. The shoe is not weighted for or against you, and the dealer does not cheat. There is no reason to rig a game with no stakes, and the code is on the page for anyone who wants to read it.
- Results are realistic, not typical of any particular table. A short session can produce a run of wins that means nothing.
- The strategy chart is generated from the rule settings you choose, so it changes when you change the table. It reflects standard published basic strategy for multi-deck games.
- The bankroll can be reset at any time and carries no value of any kind.
9. Money and support
The site is free and complete. There is no premium version, no locked feature, no advantage bought with money.
You may see one prompt, once a month at most, mentioning that you can contribute. Contributions are voluntary gifts toward the domain and my time, processed by [PAYMENT PROVIDER] — I never see your card details, and the provider handles that data under its own policy. A contribution buys nothing, unlocks nothing and creates no obligation on either side. If you contribute by mistake, write to me and I will refund it.
10. If gambling stops being a game
Nothing here involves real money, but the game it simulates is one people lose houses to. Learning correct play lowers the house edge; it does not turn a losing game into a winning one, and anyone who tells you otherwise is selling something.
In Switzerland the national gambling helpline is 0800 040 080 — free, anonymous, 24 hours a day, in several languages.
Information and counselling: sos-spielsucht.ch (German), sos-jeu.ch (French), careplay.ch. Outside Switzerland, search for the gambling helpline in your country — most have one.
11. Wherever you are reading this
The site is run from Switzerland but is open to anyone. A few things follow from that.
Which law applies
Swiss law governs this site and this page. That does not remove protections you have at home: if you are in the European Union or the United Kingdom, the GDPR and UK GDPR apply to you as a visitor, and the rights listed in section 6 are available to you regardless of where the server sits.
Data leaving your country
If you do not use the leaderboard, essentially nothing about you crosses a border: the only record is the technical access log kept by the host, which may sit in a data centre outside your country and is never used to identify or profile anyone.
If you do claim a leaderboard name, that row lives on my own machine in the region named in section 4. Choosing a European region keeps EU and Swiss visitors' data in Europe, and there is no onward transfer to anyone: no analytics company, no database vendor, no advertising network, because none of them are part of this site.
No EU representative, and why
Article 27 GDPR requires some non-EU controllers to appoint a representative in the Union. The exemption covers occasional processing that is not large-scale and involves no special categories of data. A voluntary nickname and a play-money score, held for as long as the player wants and deletable by them in one click, sits within that exemption as I read it. If the leaderboard ever grows large enough that this reading stops being comfortable, a representative will be appointed and named here.
Gambling rules are local
What is legal to play, advertise or even simulate varies a great deal from one country to the next. This site is a simulator with no stake and no prize, which places it outside gambling law in most jurisdictions — but I cannot check every one of them. If simulated casino games are restricted where you live, that is your call to make, not mine to police.
Helplines outside Switzerland
Section 9 lists Swiss services. Most countries have an equivalent: the United Kingdom has the National Gambling Helpline, Germany has the BZgA gambling helpline, France has Joueurs Info Service, and Italy has the Telefono Verde per le Problematiche legate al Gioco d'Azzardo. If yours is not listed, searching for "gambling helpline" plus your country will usually find it in one step.
Languages
The interface is available in English, French, German and Italian, and picks your browser's language when it can. This policy page is written in English, which is the authoritative version — if translations of it are published later, they are provided for convenience, and the English text prevails where they differ.
12. Age
Because no money and no prize are involved, this is not a money game and no legal age limit applies to it. It does, however, simulate casino play, and casino play in Switzerland is restricted to adults. If you are under 18, treat this as what it is: a card game with a maths problem attached.
13. Accuracy and liability
I have taken care to get the rules, payouts and strategy chart right, and the same care will go into fixing anything reported. Even so, this is a personal project and it may contain errors. Nothing here is financial, legal or gambling advice, and no outcome at a real table is promised, implied or predictable from anything you do here. Use it at your own risk, and check anything that matters against a reliable source.
14. Changes to this page
If the site changes in a way that affects any promise above — data collected, third-party requests, advertising, a leaderboard — this page is updated first, and the change is listed below with its date. Nothing is quietly reworded.
| 1 Sep 2026 | Moved the API to self-hosted infrastructure: the database is now mine rather than a supplier's, secrets are stored hashed, the API logs no IP addresses, and ranked play is dealt by the server with provably fair shuffling that anyone can verify. Section 5 rewritten. |
| 1 Sep 2026 | Leaderboard added: new section 5 on what it stores and how far to trust it, section 4 now lists the database row, section 7 explains self-service deletion. Written before the feature went live, as promised. |
| 1 Sep 2026 | Added section 10 for visitors outside Switzerland, and the interface language setting. Identity section now names the operator behind the GreenThief handle. |
| 31 Aug 2026 | First version. |
If you spot something on this page that is wrong, unclear or out of date, tell me and I will correct it. That includes translations.