Saved card details are a convenience most players stop noticing after the first deposit. Where those details actually live, and what protects them, depends entirely on the device you play from. On the Casushi iPhone app, card data sits in the Apple Keychain behind Face ID. On Android, the Casushi mobile site leans on Chrome autofill, which the casino neither encrypts nor controls. That difference is not cosmetic. It changes who holds the keys, how a breach would unfold, and what you can do about it.
The iOS app keeps card details inside Apple Keychain with Face ID gating
The Casushi app on iPhone does not maintain its own card vault. When you save a payment method, the credential is handed to the iOS Keychain, Apple’s system-level encrypted store that is tied to the device’s Secure Enclave. Casushi never holds the raw card number in a database it manages. It asks the Keychain for the credential at the moment of a cashier deposit, and the Keychain releases it only after Face ID confirms it is you.
This is the architecture the Casushi app supports natively, and it is why Face ID logins and payment confirmation feel like one continuous gesture. The biometric check is not a padlock bolted onto a web form. It is the gate on the credential itself. If someone picks up your unlocked iPhone, they still cannot pull the stored card without your face. Apple users download the Casushi app from the App Store, which means every build passes Apple’s review for how it touches Keychain APIs. That review is not a guarantee of good behaviour, but it does constrain what a casino app can do with your card data.
The trade-off is device-bound. Keychain items do not travel to an Android handset, and they do not sync to a Google account. Lose the iPhone and the credential goes with it, recoverable only through your Apple ID and a fresh device. For a player who wants their card details to exist in exactly one encrypted place, that is a feature, not a limitation.
On Android, Chrome autofill does the storage and the casino stays out of it
Casushi does not publish a standalone Android APK file. Android players access the Casushi site through a mobile browser, and in practice that means Chrome on the overwhelming majority of handsets. When you tick the box to save a card during checkout, the browser offers to store it. If you accept, Chrome writes the card number, expiry and security code into its own autofill store. The casino’s servers see the payment go through, but they do not hold the saved credential afterwards.
This is where the myth needs puncturing. Players assume that a saved card on a casino is protected by the casino. On Android browser play, it is not. Chrome’s autofill data is encrypted at rest on the device with a key tied to your Google account, but it is not encrypted by Casushi, and it can sync across every device signed into that Google account. A card saved while playing on a phone can surface as a suggestion on a laptop, a tablet, or a shared family device if the same account is signed in. The casino cannot see this, cannot audit it, and cannot revoke it.
Where the browser model helps and where it hurts
The browser model has real merits. There is no APK file to sideload, no third-party app store to trust, and no update mechanism outside Google Play’s patching. Chrome receives security fixes on a rapid cycle, faster than most casino apps ship their own. The responsive site detects screen dimensions automatically, so the layout adapts without a download. You can add a home screen shortcut and get an app-like launch without installing anything.
The costs are equally concrete. Chrome autofill does not gate a saved card behind biometrics by default, so an unlocked phone with the browser open can complete a deposit without a fingerprint or face check. https://casushi-online.uk/app/ offers additional context worth reviewing. The security code is stored alongside the card in many configurations, removing the one field that is supposed to prove physical possession. And sync means the blast radius of a compromised Google account now includes your payment credentials. None of this is Casushi’s doing, but it is the environment Casushi’s Android players operate in.
A practical middle path exists. Let Chrome remember the card, but switch off payment method sync in Chrome’s settings and require device unlock before autofill. You keep the speed of a saved card while cutting the cross-device exposure. It is a two-minute change most players never make.
What each storage model means for deposits, bonuses and responsible play
The storage question sits inside a wider mobile experience that is broadly the same on both platforms. The mobile lobby includes the welcome offer, and the Casushi app cashier manages payments with the same deposit limits and withdrawal rules whether you arrived via Keychain or Chrome. The Casushi mobile site offers responsible play tools, including deposit limits and session reminders, that apply to the account rather than the device. A saved card does not change your limits, and it does not bypass them.
What differs is the failure mode. On iOS, a stolen unlocked iPhone without your face yields nothing from the Keychain. On Android, a stolen unlocked phone with Chrome open and autofill enabled can yield a working card. That is the single most useful fact in this comparison, and it should shape how you secure each device. A six-digit PIN on the phone is table stakes. A biometric lock on the browser, where the platform supports it, closes most of the gap.
Push notifications deserve a mention because they interact with the same trust boundary. The iOS app can send deposit confirmations and bonus alerts through Apple’s notification service. Browser notifications on Android are managed by Chrome and can be switched off per site. Neither channel carries card data, but both can be used for social engineering, so treat an unexpected “confirm your payment” prompt with suspicion regardless of platform.
Here is how the two models compare on the points that actually matter to a player deciding where to save a card:
- Who encrypts the card: Apple Keychain on iOS, with the casino handing off the credential; Chrome’s own store on Android, with the casino out of the loop.
- Biometric gate: Face ID required before the Keychain releases a card; Chrome autofill typically requires only an unlocked device.
- Cross-device exposure: Keychain stays on the iPhone or iPad; Chrome autofill can sync to any device signed into the Google account.
- Recovery after loss: Apple ID and a new device restore the Keychain; a lost Android phone means revoking the Google session and re-entering the card.
- Who patches the software: Apple ships iOS and app updates; Google ships Chrome updates, with no casino APK file in the chain.
- Casino visibility: Casushi can audit what its app does with Keychain; it cannot see or control Chrome’s autofill store.
One clarification on this website: it operates as an information page only. It does not process payments, store cards, or run a cashier. The secure download and App Store listing links point to the real product; nothing here asks for card details, and any page that does while claiming to be an information resource should be treated as suspect.
For the cleanest setup, use the Casushi iPhone app with Face ID and let the Keychain hold the card, keeping the device passcode and Apple ID two-factor authentication switched on. On Android, play through Chrome, save the card only if you have disabled payment sync and enabled device-unlock for autofill, and review saved payment methods in Chrome’s settings every few months. Clear autofill entries for any card you no longer use, and remember that the casino’s responsible gambling tools control your spending but not your credential storage. The card lives where the platform puts it, so choose the platform whose storage model you actually trust.
