Privacy

What we collect

LuckyDuck stores:

• Your account identity (email and name), handled by Clerk
• Your ticket numbers and the draws they cover
• Your notification preferences
• Draw-check results for your tickets
• Notification delivery logs
• A small analytics log about notification permission and delivery
• For group pools: a first name an organizer chooses as a pending invite label (the invite link stops working after 14 days if never accepted), and, once you personally consent, your chosen display name, email address, and notification preferences for that group. If an organizer uploads a group agreement document, it's stored as a file so members can view it.
• For paid group pools: payment activity, processed directly by Stripe, not stored by us
• If you use the recommendation program: a link for each pool you organize, and a record of which pool's link was used by which organizer, so LuckyDuck can apply covered cycles. The organizer who shared a link sees only how many organizers used it, never who they are.

OneSignal separately holds a push subscription identifier for your device, so it can deliver notifications. Resend, our email provider, processes the email address and content of any message we send you. PostHog, our analytics provider, records how the app is used (pages visited, actions taken) and any errors it encounters, tied to a device identifier rather than your name. Stripe, our payment processor, handles payment details for paid group pools directly; LuckyDuck never sees or stores your full card number.

Why

We collect this so LuckyDuck can check your tickets against draw results, notify you when there's something to know, let you sign in to see your own tickets, process payments for paid group pools, and understand which parts of the app work well so we can fix or improve them.

Cookies

Clerk sets a cookie to keep you signed in. That one is needed to use the app. The first time you visit, a banner asks whether you allow analytics. If you accept, PostHog sets a cookie or similar identifier to recognize repeat visits and record how the app is used. If you decline, we don't run analytics: no analytics cookie is set and no usage events are recorded. We don't use advertising cookies, and we don't sell or share data with ad networks.

If you open a recommendation link, LuckyDuck also sets a functional cookie named ld_ref for 14 days, so it can credit the right pool if you create one. It isn't used for advertising.

Where it's stored

LuckyDuck runs on Railway, stores data in Neon, and stores files (ticket photos and group agreement documents) in Cloudflare R2. OneSignal, Resend, Stripe, and PostHog also process data outside Canada. That means your data may leave Canada.

Third parties

We use Clerk for sign-in, OneSignal for push notifications, Resend for email, PostHog for analytics, Stripe for payments, Railway for hosting, Neon for the database, and Cloudflare R2 for file storage. Administrators of LuckyDuck can access account and ticket data to provide support, investigate problems, or remove test and abusive data. We don't sell your data, and we don't run ads.

Your choices

You can delete a ticket at any time. You can delete your entire account from Settings → Account, which permanently removes your tickets, preferences, and check results, ends your access to groups you organize, and deletes your sign-in. This can't be undone. If you'd rather we do it for you, you can also contact us instead.

A group you organize is closed, not erased. When you delete your account, or an admin deletes the group, we remove its tickets, ticket photos, payment instructions, invite links, messages and members' email addresses, and we cut the group off from your account and from every member's account. What stays, permanently, is the group's record: the terms it ran on, who agreed to them and when (including the IP address and browser details recorded at the moment each person agreed), and any roster the organizer finalized or cycle the organizer cancelled (including display names). This is intentional: it's the evidence a group relies on to show who actually owned a share of a ticket, and it wouldn't be reliable evidence if it could be edited or removed later, including at the request of the person it describes. Payment references from Stripe for a group's service fee also stay, without the roster they were created for.

Two more things outlast a deletion. Our internal change history and audit log are append-only, so they keep earlier values (for example an email address or display name as it was before it was removed) and the identifier of the account that made a change. And records that name someone who ran the group, such as a cancellation or a recorded contribution, keep that account's internal ID, which stops pointing to anyone once the account is deleted.

The same applies if you were a member of someone else's group: if a cycle was finalized before you left or deleted your account, your display name and the record of your agreement stay in that group's permanent record. Nothing else about you does.

Group invite consent

Joining a group by email does not require an account. You choose your own display name and explicitly agree to receive messages from the group organizer and, separately, to automated draw-result emails. You can adjust either at any time, or unsubscribe entirely, from the link in any email we send. Unsubscribing stops all email for that group, including organizer messages and future invites; adjusting notifications changes only which automated emails you receive.

Email and CASL

Canada's anti-spam law (CASL) requires consent for commercial electronic messages. Automated draw-result and account emails are transactional, they're service messages tied to a service you're already using, not promotional, so CASL's consent requirement doesn't apply to them. Messages from a pool organizer, and any marketing email we might send in the future, are commercial: they require your opt-in consent, which we collect explicitly, and every such email includes a working unsubscribe link. Unsubscribing takes effect promptly.

Retention

We keep your data for as long as your account is active, or until you delete it or ask us to - except for a group's permanent record (its terms, the append-only ledger showing who agreed to them and when, and any finalized roster or cancellation), which is kept permanently as described under "Your choices" above. That permanence is intentional: it's what makes the record usable as evidence later. Deleting your account through Settings removes your data immediately, in the same request, rather than after a waiting period.

Ticket photos are the exception to "as long as your account is active". If you save a reference photo of a ticket, we delete it automatically one year (365 days) after the last draw date of that ticket, which is about the length of time the lottery operator allows for claiming a prize. You can also delete a photo yourself at any time, and deleting your account removes your photos too. Before a photo is stored, the barcode is blacked out, and we only keep the blacked-out version. We remove the photo record from our database and then delete the file from storage. This only applies to photos; your ticket numbers and check results are kept for as long as your account is active, as described above.

Canadian privacy law

PIPEDA is the federal law that applies to how Canadian businesses handle personal information. We aim to follow its principles, but we make no claim of formal compliance certification. If we ever have a data breach that creates a real risk of harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as required by law.

Access, correction, and complaints

Under PIPEDA, you can ask what personal information we hold about you and request a correction if it's wrong. Send that request through our contact page; we don't yet have a separate privacy officer, so requests go through the same channel as other questions and are handled by the person who runs LuckyDuck. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada.

Children

LuckyDuck isn't directed at children, and we don't knowingly collect information from anyone under the legal age to play the lottery (18 or 19, depending on the province), matching the eligibility requirement in our Terms.

Changes

We'll update this page if what we collect or how we use it changes.

Contact

Questions about your data, or requests to access or delete it, can be sent through our contact page.