Guest Play
Guest limits use an HttpOnly cookie and a salted hash derived from request metadata such as IP address and user agent. Raw IP addresses are not stored in the game database for the guest quota.
Accounts
Account login is handled by Firebase Auth. PlayKeno.io stores the Firebase user id, optional email/display name, virtual balance, fairness seeds, and game history needed to run the free-play service.
Security
Cookies are signed, API requests are validated, and Cloudflare Turnstile can be enabled to reduce automated abuse.