Privacy Policy
Effective Date: July 16, 2026 — Version 1.1
This Privacy Policy describes how Retsba LLC ("we", "us", "our"), the operator of Lucky Jack, collects, uses, and protects your information when you use our service.
1. Information We Collect
Account Information
- Username — chosen at signup, displayed publicly in games
- Email address — for password-based accounts and account recovery
- Phone number — for phone-based authentication via SMS
- OAuth profile data — provider ID and email from Google when you sign in with that service
Usage Data
- Game statistics (matches played, wins, losses, streaks)
- Login events (timestamp, auth method, IP address, user agent)
- Chat messages sent to other players
- Currency transactions and purchase history
- TOS acceptance records (version, timestamp, IP address, method)
Payment Data
- Blockchain wallet addresses used for stablecoin deposits and withdrawals
- Transaction hashes and amounts on Solana, Base, and Robinhood networks
- We do not store private keys or seed phrases
2. How We Use Your Information
- To create and manage your account
- To authenticate you and maintain your session
- To process game matches and track statistics
- To process cryptocurrency deposits and withdrawals
- To enable social features (friends, chat, challenges)
- To prevent fraud, cheating, and abuse
- To comply with legal requirements
3. Third-Party Services
We use the following third-party services that may process your data:
| Service |
Purpose |
Data Shared |
| Twilio |
SMS verification |
Phone number |
| Google OAuth |
Sign in with Google |
OAuth tokens, profile info |
| SendGrid |
Email delivery |
Email address, username |
| Solana & Base RPCs |
Blockchain transactions |
Wallet addresses, transaction data |
| Robinhood RPC |
Blockchain transactions |
Wallet addresses, transaction data |
4. Cookies and Sessions
- We use an httpOnly session cookie (
bja_session) to maintain your login session.
- This cookie is essential for authentication and cannot be disabled while using the service.
- For anonymous front-door and Play demo analytics, we use an httpOnly pseudonymous visitor cookie (
bja_v) to relate page loads and demo events. We do not store IP addresses, user agents, raw referrers, query strings, phone numbers, or email addresses with those demo events.
- Front-door attribution records may include the referring hostname and UTM source, medium, and campaign. Those records are retained for 90 days; the pseudonymous visitor cookie may remain for up to one year.
- Play demo analytics record whether Play was activated, time to activation, the highest round reached, an interaction-count high-water mark, skip/completion/exit outcomes, sound-toggle choices, whether music was audible at Play, signup-card and signup-method outcomes, and allowlisted signup error categories. At completion we sample whether the tab is hidden and milliseconds since the last pointer, keyboard, scroll, or touch input. We do not store input contents, pointer locations, keystrokes, or a detailed event history.
- If an anonymous visit creates or signs into an account, we may link that visit to the account to measure conversion. Account deletion removes that link while retaining pseudonymous aggregate/session facts for the stated retention period.
- We do not use advertising cookies or third-party behavioral tracking cookies.
5. Data Retention
- Account data is retained as long as your account is active.
- Deleted accounts have personal data removed, but anonymized game statistics may be retained.
- Login events and TOS acceptance records are retained for legal compliance.
- Anonymous Play demo session analytics are retained for 30 days. Hourly coverage counters are retained for 30 days and contain no visitor or request identifier.
- Chat messages may be retained for moderation purposes.
6. Data Security
- Passwords are hashed using bcrypt with salt rounds.
- Sessions use cryptographically signed JWT tokens in httpOnly cookies.
- Database connections use encrypted transport (SSL/TLS).
- We follow industry-standard security practices, but no system is perfectly secure.
7. Your Rights
Depending on your jurisdiction, you may have the following rights:
- Access — Request a copy of your personal data
- Correction — Request correction of inaccurate data
- Deletion — Request deletion of your account and personal data
- Portability — Request your data in a portable format
California Residents (CCPA)
If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of its sale. We do not sell your personal information.
8. Children's Privacy
Lucky Jack is not intended for anyone under the age of 18. We do not knowingly collect information from minors. If we learn we have collected data from a person under 18, we will delete it promptly.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the effective date. Material changes will be communicated through the service.
10. Contact
For privacy-related questions or to exercise your rights, contact us at info@luckyjack.xyz.
← Back to Lucky Jack