bustabit – The original crash game

[JollyGood]

Someone allegedly has some issues/misunderstandings with Bustabit. He opened a thread titled "Bustabit - scam or hacking - HELP ME"

https://bitcointalk.org/index.php?topic=5183720.0;topicseen

[devans]

Someone allegedly has some issues/misunderstandings with Bustabit. He opened a thread titled "Bustabit - scam or hacking - HELP ME"

It looks like he's already received good advice in the thread, namely to contact me via bustabit's support request form at https://www.bustabit.com/support if he has an issue with his account.

I cannot discuss other players' support requests or private information, but it's worth noting a few things: bustabit never deletes an account on its own accord. The only time an account will be deleted is if the user requests it. Both withdrawing as well as deleting an account require the account's login credentials to be entered again to confirm.

[devans]

Wish it was possible to license game because you can't imagine what happens outside your website. A lot of local casinos are so hyped with this game recently, they added it and attracted a lot of customer. This fact makes me sad that such a great website has less customers then those whom just cloned your website yesterday.

What do you mean by local casinos being hyped by bustabit? Do you mean you know of any brick and mortar casinos that have implemented a crash game like bustabit's? 😲

Btw don't you plan to make some changes in game UI? It's very, very old, as far as I remember it was never changed.

Although I'm constantly working on improving bustabit, I don't have any specific plans to revamp the user interface right now. For what it's worth bustabit–including its front end–underwent a complete rewrite from the ground up less than two years ago.

[JollyGood]

Someone allegedly has some issues/misunderstandings with Bustabit. He opened a thread titled "Bustabit - scam or hacking - HELP ME"

It looks like he's already received good advice in the thread, namely to contact me via bustabit's support request form at https://www.bustabit.com/support if he has an issue with his account.

I cannot discuss other players' support requests or private information, but it's worth noting a few things: bustabit never deletes an account on its own accord. The only time an account will be deleted is if the user requests it. Both withdrawing as well as deleting an account require the account's login credentials to be entered again to confirm.

I never doubted your honesty or your credibility. I just wanted to bring it to your attention since the claim made was hard to believe as a fault by the website.

Thank you for the clarification.

[BTCevo]

Someone allegedly has some issues/misunderstandings with Bustabit. He opened a thread titled "Bustabit - scam or hacking - HELP ME"

https://bitcointalk.org/index.php?topic=5183720.0;topicseen

Yes there is a lot of similar rumors, wondering if it has been on the samee person and many people already giving some good explanation well enough but still he said that there is a scam between them. I am wondering if this is a internal problem coming from them or not

I found another site without a license. (onehash.com/moon)

At a quick glance it doesn't look like they are using bustabit's old source code. If that's the case they don't need a license. Only bustabit's source code is protected, not the concept of a crash game itself.

At first onehash is reputable website and they are on btctalk for a long time, they wouldn't do such action for two reason: 1. Copyright 2. Forum ethics

devans
Wish it was possible to license game because you can't imagine what happens outside your website. A lot of local casinos are so hyped with this game recently, they added it and attracted a lot of customer. This fact makes me sad that such a great website has less customers then those whom just cloned your website yesterday.
Btw don't you plan to make some changes in game UI? It's very, very old, as far as I remember it was never changed.

Dont you think it is a little bit too late for now to license their own game? At the first play, they are the one starting the open source so every single person may create the similar game. So if they are going to license the game it still not worth. May be some attraction will do to help the site

[devans]

Yes there is a lot of similar rumors, wondering if it has been on the samee person and many people already giving some good explanation well enough but still he said that there is a scam between them. I am wondering if this is a internal problem coming from them or not

I'm not sure what you mean as that's the only thread about bustabit of its kind that I've seen. In any case it looks like the OP deleted the thread, so I assume that he's satisfied after getting in touch with me.

Dont you think it is a little bit too late for now to license their own game? At the first play, they are the one starting the open source so every single person may create the similar game. So if they are going to license the game it still not worth. May be some attraction will do to help the site

bustabit does sell licenses for its v1 software and a decent number of casinos use it: https://www.bustabit.com/license.txt. But to my knowledge bustabit's game concept itself cannot be protected, only the software itself. Of course I'm not a lawyer, so I might be wrong about that 😅

[malevolent]

I've noticed that bustabit and bustadice now have Terms of Service, and I also have noticed it includes some controversial clauses, so I have some questions:

1. "Users for which using the service is not legal in their applicable jurisdiction(s) are prohibited from using the service."

"To ensure that no prohibited users are using the service, the operator may demand proof of age, citizenship and residence of any user at his own discretion. If the user does not provide adequate proof at the operator's request they may be barred from further using the service."

How will you react to foreign governments requesting information about users accessing your website from foreign IP addresses?
Are you planning on using any 3rd party companies for KYCing of your users?
How long do you store user logs (IP addresses, user agents, deposit and withdrawal information) and private information used to confirm age/citizenship/residence? Can a user request the deletion of their data earlier?
Is it actually illegal to gamble and invest bitcoins in casino bankroll in the prohibited countries ("Aruba, Australia, Curaçao, France, Netherlands, Sint Maarten, United States of America")?

2. "The operator may permanently delete accounts that have not been accessed for two years and may make usernames of deleted accounts available for use with new accounts again."
[...]
"All funds of deleted dormant accounts including their balance and any bankroll investments are forfeited by the user and assumed by the operator."

Two years is a bit short, I've left some funds for this long in the past elsewhere without logging in for a similar period of time at least once (not that it's a smart thing to do but still).

[GamblingSiteFinder]

I would like some clarification as well, particularly on these two points:

The operator may permanently delete accounts that have not been accessed for two years and may make usernames of deleted accounts available for use with new accounts again.

What constitutes inactivity? Is logging in okay, or do wagers need to be placed?

All funds of deleted dormant accounts including their balance and any bankroll investments are forfeited by the user and assumed by the operator.

What happens with the bankroll investment in this case, is it dispersed among other bankrollers?

[malevolent]

The answer to your two questions is here, in the full ToS:

https://www.bustabit.com/tos

For this purpose, an account's last access time is the time that the user last signed in to the account or connected to the service while already signed in.

'Assumed by the operator' means the owner of the site keeps the funds, I think.

You have to accept the ToS on both sites, but I can't find it linked anywhere on bustabit.

[JollyGood]

The answer to your two questions is here, in the full ToS:

https://www.bustabit.com/tos

For this purpose, an account's last access time is the time that the user last signed in to the account or connected to the service while already signed in.

'Assumed by the operator' means the owner of the site keeps the funds, I think.

You have to accept the ToS on both sites, but I can't find it linked anywhere on bustabit.

By allowing sufficient time between the last time somebody accessed their account and whatever time frame is stated within the terms and conditions it gives plenty of clarity. By inserting a 24 month clause I would say that sounds about right and is a reasonable time but I take your point about people leaving funds on sites only to return to them later.

At that point there are a few options such as distributing the assumed funds one way or another towards investors or winners but if the OP decides those funds will be kept by him and it is clearly stated in the terms and condition then I see no problem with it.

I've noticed that bustabit and bustadice now have Terms of Service, and I also have noticed it includes some controversial clauses, so I have some questions:

1. "Users for which using the service is not legal in their applicable jurisdiction(s) are prohibited from using the service."

"To ensure that no prohibited users are using the service, the operator may demand proof of age, citizenship and residence of any user at his own discretion. If the user does not provide adequate proof at the operator's request they may be barred from further using the service."

How will you react to foreign governments requesting information about users accessing your website from foreign IP addresses?
Are you planning on using any 3rd party companies for KYCing of your users?
How long do you store user logs (IP addresses, user agents, deposit and withdrawal information) and private information used to confirm age/citizenship/residence? Can a user request the deletion of their data earlier?
Is it actually illegal to gamble and invest bitcoins in casino bankroll in the prohibited countries ("Aruba, Australia, Curaçao, France, Netherlands, Sint Maarten, United States of America")?

2. "The operator may permanently delete accounts that have not been accessed for two years and may make usernames of deleted accounts available for use with new accounts again."
[...]
"All funds of deleted dormant accounts including their balance and any bankroll investments are forfeited by the user and assumed by the operator."

Two years is a bit short, I've left some funds for this long in the past elsewhere without logging in for a similar period of time at least once (not that it's a smart thing to do but still).

There are problems however with what you pointed out regarding the possible need for KYC. I have a personal policy of never sending my ID to websites but those that do need to be very careful because nobody can say for sure what will happen to that data.

Not at all saying that Bustabit/Bustadice will do this but what happens if a user signs up and plays regularly, then after a few months wins a "big" amount but is blocked from withdrawing the funds unless KYC is sent. If it is a user with my principles that refuses to send KYC to any entity then what will happen to those funds?

We all know KYC has been used as an excuse by exchanges, gaming websites, bounty managers and more just as a ploy to either delay or refuse releasing funds. Again, not saying Bustabit/Bustadice will do it but others have done it and others are doing it.

Furthermore, with this update about terms and conditions more needs to be done such adding GDPR for European users and cookie notification.

Since when did Apis N.V. (the Government of Curacao licensed company) come in to existence? Maybe the terms and conditions were created and added after the licence was received and is a direct result of it.

[devans]

How will you react to foreign governments requesting information about users accessing your website from foreign IP addresses?

Such requests would be reviewed by our lawyers who would advise us on a case-by-case basis. Like any business, bustabit is obligated to comply with lawful court orders of course.

Are you planning on using any 3rd party companies for KYCing of your users?

No, KYC checks are so rarely required that that's not worth it. bustabit's default assumption for any given user is that they are not prohibited from using bustabit. A KYC check is only necessary if I have a specific reason to believe that someone is prohibited from using bustabit, e.g. if they themselves claim they are underage in chat. It's worth noting that due to the prevalence of VPNs, accessing bustabit from an IP address in a prohibited jurisdiction is not sufficient to trigger a KYC check.

How long do you store user logs (IP addresses, user agents, deposit and withdrawal information) and private information used to confirm age/citizenship/residence? Can a user request the deletion of their data earlier?

Currently connection logs, deposit histories and withdrawal histories are stored indefinitely. Information collected to confirm the user's age, citizenship and/or residency is exclusively used for that purpose, is deleted immediately afterwards and is not passed on to any third parties.

Is it actually illegal to gamble and invest bitcoins in casino bankroll in the prohibited countries ("Aruba, Australia, Curaçao, France, Netherlands, Sint Maarten, United States of America")?

I can't speak to the legality of gambling or investing Bitcoin in any of these jurisdictions. bustabit excludes users from these jurisdictions both from playing and investing not because it's illegal there (it may or may not be) but because our gaming license requires it. Conversely, a country not being on that list doesn't mean that online gambling is legal there (again, it may or may not be). Ultimately it's up to the user to ensure that they always complies with their local laws.

What constitutes inactivity? Is logging in okay, or do wagers need to be placed?

Signing in or connecting to the site while already signed in is all that's necessary for an account to be considered active. You don't need to wager, chat or do anything else. It goes without saying that bustabit will never delete dormant accounts before making a best effort to contact the owner first.

All funds of deleted dormant accounts including their balance and any bankroll investments are forfeited by the user and assumed by the operator.

What happens with the bankroll investment in this case, is it dispersed among other bankrollers?

That's probably how I'd handle it since it seems like the simplest solution on a technical level (doesn't require any bankroll operations). However, since that's still in the distant future I can't commit to a firm answer yet. At some point in the future I would like to start recycling accounts that are clearly unused and making their user names available again, but I don't have any specific plans regarding that yet.

[malevolent]

Thanks for answering.

From a privacy perspective it'd still be nice if the user could choose to delete at least some of the information stored related to their account after some amount of time has passed.

[devans]

There are problems however with what you pointed out regarding the possible need for KYC. I have a personal policy of never sending my ID to websites but those that do need to be very careful because nobody can say for sure what will happen to that data.

Not at all saying that Bustabit/Bustadice will do this but what happens if a user signs up and plays regularly, then after a few months wins a "big" amount but is blocked from withdrawing the funds unless KYC is sent. If it is a user with my principles that refuses to send KYC to any entity then what will happen to those funds?

We all know KYC has been used as an excuse by exchanges, gaming websites, bounty managers and more just as a ploy to either delay or refuse releasing funds. Again, not saying Bustabit/Bustadice will do it but others have done it and others are doing it.

Furthermore, with this update about terms and conditions more needs to be done such adding GDPR for European users and cookie notification.

Since when did Apis N.V. (the Government of Curacao licensed company) come in to existence? Maybe the terms and conditions were created and added after the licence was received and is a direct result of it.

KYC checks are driven solely by the legal requirements imposed on bustabit and we aren't obligated to perform a KYC check just because someone won a large amount. As I mentioned in my previous post, a KYC check is only necessary if there is a specific and plausible reason to believe that a user is prohibited from using bustabit, e.g. if they themselves claim they are underage.

If a user refuses or fails a KYC check we may restrict their account from further using the site, i.e. betting, investing and chatting, and demand that they withdraw their funds and refrain from using bustabit going forwards. Outside of extreme edge cases like being compelled to by a court order, bustabit will never prevent users from accessing their funds.

Apis N.V. was formally incorporated in January 2019. Whether and to what extent the GDPR applies to bustabit is still unclear.

[JollyGood]

There are problems however with what you pointed out regarding the possible need for KYC. I have a personal policy of never sending my ID to websites but those that do need to be very careful because nobody can say for sure what will happen to that data.

Not at all saying that Bustabit/Bustadice will do this but what happens if a user signs up and plays regularly, then after a few months wins a "big" amount but is blocked from withdrawing the funds unless KYC is sent. If it is a user with my principles that refuses to send KYC to any entity then what will happen to those funds?

We all know KYC has been used as an excuse by exchanges, gaming websites, bounty managers and more just as a ploy to either delay or refuse releasing funds. Again, not saying Bustabit/Bustadice will do it but others have done it and others are doing it.

Furthermore, with this update about terms and conditions more needs to be done such adding GDPR for European users and cookie notification.

Since when did Apis N.V. (the Government of Curacao licensed company) come in to existence? Maybe the terms and conditions were created and added after the licence was received and is a direct result of it.

KYC checks are driven solely by the legal requirements imposed on bustabit and we aren't obligated to perform a KYC check just because someone won a large amount. As I mentioned in my previous post, a KYC check is only necessary if there is a specific and plausible reason to believe that a user is prohibited from using bustabit, e.g. if they themselves claim they are underage.

I read the previous post, thank you.

If a user refuses or fails a KYC check we may restrict their account from further using the site, i.e. betting, investing and chatting, and demand that they withdraw their funds and refrain from using bustabit going forwards. Outside of extreme edge cases like being compelled to by a court order, bustabit will never prevent users from accessing their funds.

That part is great to read. Scam exchanges and scam gaming sites have used KYC as a ploy to freeze and effectively confiscate funds. Sadly selective scamming is reaching almost epidemic proportions now and shows no sign of letting up.

In the event where KYC becomes an issue and the user refuses to send it and you allow users to withdraw their before closing their account then it is an excellent way forward and only contributes further to the good standing and good reputation you have within the community.

Apis N.V. was formally incorporated in January 2019. Whether and to what extent the GDPR applies to bustabit is still unclear.

My understanding is that GDPR is compulsory on websites that serve residents of the European Union but enforcing that is another matter.

[malevolent]

Apis N.V. was formally incorporated in January 2019. Whether and to what extent the GDPR applies to bustabit is still unclear.

My understanding is that GDPR is compulsory on websites that serve residents of the European Union but enforcing that is another matter.

I think it's more complicated than that, bustabit might quailfy for an exemption/exception, they don't store much data to begin with and (I think) they aren't targeting nationals of any specific EU/EEA countries. But IANAL, maybe EU courts must make enough rulings for things to clarify.

[JollyGood]

Apis N.V. was formally incorporated in January 2019. Whether and to what extent the GDPR applies to bustabit is still unclear.

My understanding is that GDPR is compulsory on websites that serve residents of the European Union but enforcing that is another matter.

I think it's more complicated than that, bustabit might quailfy for an exemption/exception, they don't store much data to begin with and (I think) they aren't targeting nationals of any specific EU/EEA countries. But IANAL, maybe EU courts must make enough rulings for things to clarify.

Thank you for the post.

There might be a way websites serving EU citizens would not need to comply with GDPR but as of yet I have not seen cases and as you rightly pointed out it might be more complicated than the manner in which I put it. Some clarity on legality would be appreciated by users who might read this post.

From what I recall, any website that stores any information on EU citizens that reside inside the EU must comply. So for example an EU citizen holding a passport from any EU country but living outside the EU would not be covered but the hundreds of millions living within the EU member states are covered.

https://en.wikipedia.org/wiki/General_Data_Protection_Regulation
https://gdpr.eu/checklist/
https://www.csoonline.com/article/3202771/general-data-protection-regulation-gdpr-requirements-deadlines-and-facts.html

And this is the golden rule so far as I could remember: "Any company that stores or processes personal information about EU citizens within EU states must comply with the GDPR, even if they do not have a business presence within the EU"

As excellent as both Bustadice and Bustabit are and as highly in regard as the community hold its owner, complying with GDPR and adding a cookie notification would only enhance credibility to those not familiar with the background of the websites. Adding those would not take anything away from the website or the user experience so maybe it is worth the OP thinking about.

[M0w]

I have not checked the entire topic but I just saw the message that users from certain countries are prohibited to use the service.

I'm from the Netherlands so I'm not allowed to use this service. Does this also apply to investing? I have been an investor since February but never actually gambled on this site.

Does this mean I should withdraw all my funds? Is there any chance my account will be locked because I'm a Dutch resident?

[malevolent]

I'm from the Netherlands so I'm not allowed to use this service. Does this also apply to investing?

According to the new ToS, yes it does:

Continued use of the service implies consent to the new terms of service. For this purpose, remaining invested in the bankroll is considered use of the service.

Does this mean I should withdraw all my funds? Is there any chance my account will be locked because I'm a Dutch resident?

It seems to me the chance is low, at least for now, quoting devans:

KYC check is only necessary if I have a specific reason to believe that someone is prohibited from using bustabit, e.g. if they themselves claim they are underage in chat. It's worth noting that due to the prevalence of VPNs, accessing bustabit from an IP address in a prohibited jurisdiction is not sufficient to trigger a KYC check.

If a user refuses or fails a KYC check we may restrict their account from further using the site, i.e. betting, investing and chatting, and demand that they withdraw their funds and refrain from using bustabit going forwards. Outside of extreme edge cases like being compelled to by a court order, bustabit will never prevent users from accessing their funds.

And again from the ToS:

The operator not insisting on one of his rights granted by these terms of service in one or more specific instances shall not preempt the operator from making use of this right in the future

They're a legal business with a gambling license and unfortunately there are certain requirements imposed on them if they want to keep the license. I think these requirements aren't new but they might not have previously been enforced by the licensing authority.

[Timetwister]

I see daily wagered dropping lately. Maybe running some kind of promotion could be worth it.

[beerlover]

There might be a way websites serving EU citizens would not need to comply with GDPR but as of yet I have not seen cases and as you rightly pointed out it might be more complicated than the manner in which I put it. Some clarity on legality would be appreciated by users who might read this post.

From what I recall, any website that stores any information on EU citizens that reside inside the EU must comply. So for example an EU citizen holding a passport from any EU country but living outside the EU would not be covered but the hundreds of millions living within the EU member states are covered.

https://en.wikipedia.org/wiki/General_Data_Protection_Regulation
https://gdpr.eu/checklist/
https://www.csoonline.com/article/3202771/general-data-protection-regulation-gdpr-requirements-deadlines-and-facts.html

And this is the golden rule so far as I could remember: "Any company that stores or processes personal information about EU citizens within EU states must comply with the GDPR, even if they do not have a business presence within the EU"

As excellent as both Bustadice and Bustabit are and as highly in regard as the community hold its owner, complying with GDPR and adding a cookie notification would only enhance credibility to those not familiar with the background of the websites. Adding those would not take anything away from the website or the user experience so maybe it is worth the OP thinking about.

The real trick is, what is the "personal information" is regarding? For example, is storing the emails and passwords attached to a username considered a personal information? Does it have to be KYC? If not then does bustabit requires KYC by the law so they have to ask for it, if they have to ask for it then does that mean they have to comply with GDPR?

This goes round and round between each other, I think since they are not asking for KYC as far as I know, they don't have to comply with other laws as well, as long as they are legit and not stealing money (which we all know they don't) there is no need to comply with any law regarding certain one area for now, maybe ban USA gamblers because it is illegal for them but all rest (including EU) seems fine so far.