Privacy

Information LuckyPunk collects

• Account information: display name, coarse age group, account status, and an email address only when you connect one for recovery. LuckyPunk does not ask for or store your birthday.
• Game information: room appearance and statement, hides, clues, searches, captures, Bag custody, simulated balances and money states, attempts, and related timestamps.
• Device and security information: session/device label, browser user agent, request timing and errors, and keyed identifiers derived from an IP address and device identifier for rate limits, security, and coordinated-account detection.
• Optional communication information: notification preferences and encrypted push-subscription details when you enable web notifications.
• Safety and support information: Lounge opt-in, posts, blocks, reports, moderation actions, appeals, feedback, deletion status, and support messages you choose to send.

An under-13 or declined age answer creates no server account. Advertising identifiers and cross-app tracking are not collected in the current build.

Why it is used

LuckyPunk uses this information to operate and secure accounts, run the shared game, keep private walls and clues private, prevent duplicate or abusive actions, restore sessions, deliver requested notifications, respond to support, enforce age and safety boundaries, investigate reports, reconcile simulated balances, and measure reliability.

LuckyPunk does not sell personal information. The current build does not send requests to an ad network or use behavioural advertising.

Service providers and processing

The current service uses a LuckyPunk-controlled web/API edge and PostgreSQL database on Hetzner Cloud, Google Workspace for one-time recovery mail, and the push service selected by your browser when you enable notifications. A Sites-hosted copy is retained as a web rollback. These services may process information outside your country under their own infrastructure and security terms.

Information may also be disclosed when required by law, to protect a person or the service, or as part of a properly documented business transfer. Public APIs do not disclose private wall layouts, clues, or Bag position.

Age and advertising

The shared simulation is for players age 13 or older. The Lounge is unavailable below 16 and remains closed without monitored human coverage. If advertising is introduced later, this notice and the advertising controls must be updated first. Unknown-age and under-13 users will remain ineligible; ages 13–17 will receive provider-supported teen, non-personalized treatment. Viewing or clicking an ad will never grant money, attempts, clues, odds, or eligibility.

Retention and deletion

• Short-lived rate-limit records are generally kept for about two days; raw device-risk signals for up to about 30 days.
• Expired login challenges are removed shortly after expiry; expired sessions are generally removed after about 30 days.
• Terminal notifications/delivery records, prototype analytics, closed feedback, raw security events, and resolved safety evidence are generally minimized or removed after about 90 days unless an active safety or legal hold applies.
• Reconciliation evidence is generally kept for 90 days and retention-run evidence for about one year.
• Pseudonymous game and ledger records may remain where needed to preserve exact shared-game history, prevent abuse, and explain prior balance events.

You can request deletion in Me → Account & privacy. A seven-day cancellation window applies. When deletion completes, recovery identities and sessions are removed or revoked, public posts and decorations are removed, and the display name is replaced with an anonymous label. Read the deletion guide for details.

Your choices

Email recovery, web notifications, and the Lounge are optional. The Me screen lets you inspect sessions, revoke another device, download your data, and request or cancel deletion. Contact support@luckypunk.xyz for access, correction, an age-group correction, or a privacy question. Support will not ask for your password, sign-in link, recovery code, payment information, or government ID by email.