Reference

How xnova Protects Your Privacy

We built our privacy framework around the way you actually use your account — deposits through bKash, Nagad, or Rocket, session history, and personal details stay protected by encryption at every step. Access and eligibility depend on your local law and eligible regions.

Encrypted TransactionsAccount Data ControlWallet PrivacySession SecurityConsent-Based Collection
Browse the Lobby Read FAQ
xnova How xnova Protects Your Privacy
HOW WE EARN TRUST

Operational Privacy Practices at xnova

Privacy is not a single document — it is how we operate daily. These are the concrete practices we maintain across the platform.

SSL Encryption Across All Pages

Every page you visit on our platform runs through SSL. That includes the lobby, your account wallet page, and the payment gateway where you confirm bKash or Rocket transfers. No page loads without it, regardless of device or browser version.

No Third-Party Data Sales

We do not monetise your information by sharing it with advertisers or data brokers. Your gameplay patterns, deposit history through Nagad or bKash, and personal details stay within our operational environment — used only for running your account and meeting…

Regular Security Audits

Our infrastructure undergoes periodic security reviews. These audits cover database access controls, API endpoints that handle wallet transactions, and the session management layer. Findings lead to patches deployed before they become live vulnerabilities — we do not wait for incidents.

Minimal Data Collection

We ask for what we need and nothing extra. Account registration requires your mobile number, a password, and wallet preference.

Staff Access Restrictions

Not every team member can view your full profile. Access is role-based — support agents see conversation history but not payment credentials. Finance staff process withdrawals without seeing your identity documents.

Transparent Update Notifications

When we change our privacy practices, you receive a direct notification on your registered number or email before the change applies. We do not bury updates in a page footer and hope you notice.

Our Privacy Approach vs Common Industry Practices

Many platforms treat privacy as an afterthought or a compliance checkbox. Here is how our approach differs in concrete, visible ways that affect your day-to-day account use.

Data minimisation by default
Some platforms collect device contacts, location history, and browsing habits beyond their own site. We collect only account-operation data — your registered details, wallet transactions through bKash, Nagad, or Rocket, and session logs. Nothing from outside the platform enters our records.
No tracking pixels from advertisers
We do not embed third-party advertising trackers in our pages. Your visit to the lobby or a slot room like Aviator does not trigger profile-building cookies from ad networks. What you do on our platform stays between you and us — it does not follow you around the internet afterwards.
Wallet credentials never stored server-side
When you deposit through bKash or Nagad, authentication happens on the payment provider side. We receive a transaction confirmation, not your PIN or wallet password. Even if our database were breached, your payment credentials would not be in it because we never hold them.
Immediate session invalidation
Close your browser or tap away from the lobby, and your session token expires within minutes of inactivity. Other platforms keep sessions alive for days, which means anyone with device access can resume your account. We prioritise short-lived tokens over convenience to protect your wallet.
Deletion requests honoured without delay games
Request data deletion and we process it. We do not hide the option behind multiple support tickets or delay it hoping you forget. One verified request through chat or email starts the removal process. Regulatory holds in your eligible region are the only reason any data might persist longer.
Role-based internal access
On many platforms, any support agent can pull your full file. Our system segments access — a chat agent helping you with a Rocket deposit issue sees transaction status, not your identity documents. This compartmentalisation limits what any single staff member can access at once.
Pre-change consent on policy updates
We notify you before privacy changes take effect, giving you a window to review. Platforms that update terms silently and retroactively apply them put you at a disadvantage. Our approach: you see the change, you decide whether to continue. That is a basic respect we maintain consistently.
SIX PRIVACY ELEMENTS

Core Privacy Features Across Your Account

These six elements define how privacy works in practice when you use your account — from login to withdrawal, from mobile sessions to data requests.

Encrypted Wallet Transfers Every bKash, Nagad, or Rocket transaction you initiate passes through encrypted channels. The transfer data is unreadable to anyone intercepting it mid-route. This layer activates automatically — you do not need to enable anything manually in your account settings.
Device Recognition Alerts Log in from a new phone or browser and we flag it immediately. You receive a verification prompt on your registered mobile before the session activates.
Activity Log Transparency Your account dashboard shows a log of recent access events — timestamps, device types, and session durations. You can review this anytime to spot anything unusual.
Consent-Based Marketing We only send promotional messages if you opt in. Your privacy settings let you toggle notifications for new slot rooms like Slot Blenders or live table updates without receiving anything else.
Data Export on Request Want to see everything we hold? Request a data export through your profile settings or via support chat. We compile your records — transaction history, personal details, session logs — into a readable format and deliver it to your registered…
Scheduled Data Purge Cycles Inactive accounts do not sit in our database indefinitely. After a defined dormancy period, associated data enters a deletion queue unless regulatory requirements in your eligible region mandate retention.
PRIVACY HELP CHANNELS

Get Answers About Your Data Anytime

Questions about what we store or how to manage your privacy settings deserve quick, clear answers. Here is how you reach us when you need them.

Live Chat Privacy Queries Open the chat widget from your account dashboard and select the privacy topic. Our agents can walk you through data access requests, explain what records we hold, and initiate deletion processes for specific data points — all without needing you to email documents separately.
Email Data Requests Send a message to our support email with the subject line referencing your data request. We respond within a working day with a structured summary of your stored information. If you want specific records removed — old Nagad transaction logs, for instance — state it clearly and we process it after identity verification.
Account Settings Self-Service Inside your profile, the privacy tab lets you toggle marketing communications, review linked devices, and see a log of recent data access events. You do not need to contact anyone to adjust these — it is all under your control directly. Changes take effect immediately on your next session.
xnova What We Collect and Why It Stays Minimal

What We Collect and Why It Stays Minimal

When you open an account with us, we collect only what we need to verify your identity and process your payments. That means your name, mobile number, and the wallet details you provide for bKash, Nagad, or Rocket transactions. We do not store full wallet PINs or payment credentials on our servers — those stay with your payment provider. Your gameplay sessions

generate activity logs, but these exist to protect your account from unauthorised access, not to build marketing profiles. If you contact our support channel, conversation records are kept to resolve disputes and improve response quality. We never sell or share your personal information with third-party advertisers. Data retention follows a strict cycle — once your account is inactive beyond a defined period,

associated records are scheduled for deletion unless regulatory requirements in your eligible region say otherwise. You can request a summary of what we hold on you at any time through account settings or by reaching our support team directly.

PRIVACY ON MOBILE

Your Data Stays Protected on Every Device

When you open xnova on your phone, privacy protections travel with you. Mobile sessions use the same encryption as desktop, and your bKash or Nagad payment details are never cached locally on the device. If you close the browser mid-session, your login token invalidates automatically — no one picking up your phone can resume where you left off. Push notifications, if you enable them, carry no sensitive account data in their payload. You control what your device remembers through account settings, and you can revoke saved login from any device remotely.

No local credential storage
Auto session expiry
Remote device logout
Notification data masking
Open Your Account Browse the Lobby
xnova mobile gaming
Google Play App Store

Key Privacy Terms You Should Know

When reading privacy documentation, certain terms come up repeatedly. Here is what they actually mean in plain language, specifically as they apply to your xnova account.

What does SSL mean?

SSL stands for Secure Sockets Layer. It encrypts data travelling between your device and our servers so that anyone intercepting the connection sees scrambled text, not your account details or bKash transaction data.

What is data minimisation?

Data minimisation means we collect only the information necessary to operate your account — your mobile number, wallet preference, and session activity. We skip optional data like location tracking or contact list access that other platforms often request.

What does session token mean?

A session token is a temporary key your browser holds while you are logged in. It proves your identity without sending your password repeatedly. When you close the tab or stay inactive, the token expires and your session ends automatically.

What is role-based access?

Role-based access means each staff member sees only the data their job requires. A support agent helping with a Nagad deposit query cannot view your identity documents. This limits exposure if any single role is compromised internally.

What does data segregation mean?

Data segregation separates different types of your information into distinct storage environments. Your personal identity details live in one system, your gameplay logs in another. A breach in one does not automatically expose the other.

What is a data export request?

A data export request asks us to compile everything we hold about you into a readable file. This includes your personal details, Rocket or bKash transaction records, and session history — delivered to your registered email for your own review.

What does consent-based collection mean?

Consent-based collection means we ask before gathering optional data. Marketing messages, promotional notifications about new games like Football Oddszone, or analytics beyond basic operations only happen if you actively agree through your account settings.

What is a data retention period?

A data retention period is the timeframe we keep your records after account inactivity. Once that window passes, your data enters a scheduled deletion cycle — unless regulatory requirements in your eligible region require us to hold it longer.

What does KYC mean in a privacy context?

KYC stands for Know Your Customer. It is the identity verification step triggered when you reach certain withdrawal thresholds. We request documents only at that point, not during initial registration, keeping your early account experience lightweight.

What is an encryption key?

An encryption key is the code that locks and unlocks your data during transmission. Without the matching key, encrypted information — your wallet details, account credentials, session data — remains unreadable gibberish to anyone who intercepts it between your device and our servers.

Common Privacy Questions From Our Users

These are the privacy questions we hear most often through support chat and email. If yours is not listed, reach out directly and we will answer within a working day.

We collect your mobile number, a chosen password, and your preferred payment wallet — bKash, Nagad, or Rocket. No additional documents are required at signup. Further verification is only triggered when withdrawal thresholds or regulatory rules in your eligible region demand it.

No. We do not sell, rent, or share your personal information with advertising networks or data brokers. Your gameplay activity, deposit history, and personal details remain within our operational systems and are used solely for running your account.

Open live chat or send an email to support referencing your data deletion request. After verifying your identity, we begin removing your records. Regulatory holds in your eligible region may delay full deletion, but we process what we can immediately.

No. Payment authentication happens on the bKash or Nagad side. We receive a transaction confirmation — not your PIN, password, or wallet credentials. Even in a hypothetical breach scenario, those credentials would not exist in our database.

After a defined dormancy period, your account data enters a scheduled purge cycle. Personal details, session logs, and transaction records are deleted unless regulatory requirements in your region mandate longer retention. We do not keep dormant data indefinitely.

Your account dashboard shows login events, device types, and session timestamps from your side. Internal staff access is logged separately and governed by role-based permissions. If you suspect unauthorised internal access, contact support and we investigate with full audit trail.

Mobile sessions carry the same encryption and token-based protection as desktop. We do not cache your wallet credentials or login details locally on your device. Closing the browser invalidates your session token, and no sensitive data persists in the phone storage.

Yes. We send a notification to your registered number or email before any privacy practice change applies. You receive time to review the update, ask questions through support, and decide whether to continue using the platform under the revised terms.

No. Gameplay sessions generate activity logs — rounds played, timestamps, outcomes — but these do not require additional personal data beyond what you provided at registration. Your session data stays encrypted and segregated from your identity records in our system.

Open your account settings and find the privacy tab. Toggle marketing notifications off and you stop receiving promotional messages immediately. Toggle them back on whenever you want updates about new slot rooms or live table additions. No waiting period applies in either direction.

Related pages

xnova Bangladesh Slot Frenzy Teen Patti Flash bKash MobilePay Abbottabad Live Lobby