LuckyRook Privacy Policy
1.Who We Are
This Privacy Policy explains how Empress Games LLC ("Empress Games LLC", "we", "us" or "our") collects, uses, shares and protects personal information when you use LuckyRook, including our website, web application, games, chat, clubs, store and related services (the "Service"). Empress Games LLC is the controller of the personal information described here.
This Policy is part of, and should be read together with, the LuckyRook Terms of Service. Capitalised words not defined here have the meaning given in the Terms.
THE SHORT VERSION: WE COLLECT WHAT WE NEED TO RUN YOUR ACCOUNT AND THE GAMES, KEEP THEM FAIR AND KEEP THEM SECURE. WE DO NOT SELL YOUR PERSONAL INFORMATION, WE DO NOT SHOW ADVERTISING, AND WE DO NOT USE THIRD-PARTY ADVERTISING OR ANALYTICS TRACKERS.
2.Information We Collect
Information you give us
- Account details: your username and password. Your password is never stored as written; we keep only a one-way bcrypt hash of it.
- Email address (optional): if you add one for account recovery. We send a code to confirm it, and we keep a pending, unconfirmed address only until it is confirmed or expires.
- Security settings: if you turn on two-factor authentication, the secret your authenticator app uses and one-way hashes of your recovery codes.
- Profile and customisation: your bio, avatar sigil, title, badge, tags, pinned trophies, equipped cosmetics, club details and anything else you add to your profile.
- Messages and posts: chat messages, direct messages, club chat, club messages of the day, club names and descriptions, and reactions.
- Support requests: the tickets you file, including their text and any screenshots you attach. Please do not put passwords or other sensitive information in a ticket or its screenshots.
- Settings and preferences: audio levels, display options, privacy choices (such as a private profile, who may message you, and streamer mode) and any responsible-gaming time-out you set.
- Terms acceptance: the version of the Terms of Service you accepted and when.
Information created when you use the Service
- Gameplay and account activity: the games you play, bets, rounds and their results, balances of Chips and Gold Bullion, level and XP, quests, achievements, streaks, rewards, leaderboard standings, items you own or equip, store and exchange transactions, friends, invites and club membership and activity.
- Presence: whether you are online and which game or table you are at, so that friends, club members and other players can see it (subject to your privacy settings).
- Sessions: when you sign in we create a session token (we store only a hash of it), and we record when it was created and last used and your browser's user-agent string, so you can see and sign out your devices in Settings.
- Technical information: your IP address, browser type and version, device and operating-system information, and the date and time of your requests. Like almost every website, our servers receive this with each request and may record it in logs.
Fraud-prevention information
The welcome bonus and sign-up are protected against abuse:
- Only if you allow "bonus protection" (in our cookie banner or when you choose to spin the welcome wheel), we set a first-party cookie (__emp_dev_id) holding a random, signed device identifier, valid for up to one year, and calculate a device fingerprint in your browser: a one-way hash of characteristics such as how your browser draws a small test image, your graphics renderer, screen size and colour depth, and time zone. We receive and store only the hash, never the underlying characteristics. When you spin the wheel we also store a one-way hash of your IP address with your reservation and the network range (subnet) your IP address belongs to.
- When an account is created, we record the network range (subnet) of the IP address it was created from, so that we can limit how many accounts are created from one network.
We use this information only to prevent duplicate bonuses, multiple accounts, fraud and abuse, never to advertise to you or to track you across other websites. You can withdraw your bonus-protection consent at any time in cookie settings.
Information from others
Other players may give us information about you, for example when they report you, mention you in chat or a support ticket, invite you to a club or table, or send you a friend request.
Payment information
Where we offer purchases, payments are handled by third-party payment processors. We do not receive or store your full card number. We receive and keep a record of each purchase (the item, amount, currency, time and a transaction reference) and any information the processor gives us to confirm the payment or to prevent fraud.
What we do not collect
We do not ask for your real name, postal address, date of birth, government ID, precise location, contacts, photos (other than screenshots you choose to attach to a support ticket), or biometric information. We do not knowingly collect sensitive information such as health, racial or ethnic origin, religious beliefs or sexual orientation, so please do not share it in chat, your profile or tickets.
3.How We Use Your Information
We use personal information to:
- provide the Service: create and run your account, sign you in, run the games and tables, keep your balances, items and progress, and show your profile, clubs, friends and leaderboards;
- keep your account secure: passwords, two-factor authentication, session management, account recovery and security notices;
- keep the games fair: detect and prevent cheating, collusion, bots operated by players, multiple accounts, bonus abuse, fraud and chargebacks;
- enforce our rules: review reports, moderate chat and other content, and enforce the Terms of Service;
- support you: answer tickets and investigate problems;
- communicate with you: send transactional emails (verification codes, password resets, security and account notices) and notices about changes to the Service, our Terms or this Policy;
- support responsible play: apply the time-out and other limits you set;
- operate and improve the Service: balance the game economy, fix bugs, and understand in aggregate how games and features are used, using our own data only; and
- meet legal obligations: comply with law, respond to lawful requests, and establish, exercise or defend legal claims.
We do not use your information for advertising, we do not build advertising profiles, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. Our automated anti-abuse checks (such as limits on sign-ups from one network) can stop an action from going ahead; if you think one has affected you wrongly, contact us and a person will review it.
4.Legal Bases (EEA, UK and Similar Laws)
If the law where you live requires a legal basis for processing personal information, we rely on:
- Contract: to provide the Service you signed up for under the Terms of Service (your account, the games, your items and progress, purchases and support);
- Legitimate interests: to keep the Service secure and fair, prevent fraud and abuse (including the sign-up network check described above), moderate content, improve the Service and defend legal claims. We balance these interests against your rights and do not rely on them where your interests override ours;
- Legal obligation: where we must keep or disclose information to comply with the law; and
- Consent: for the optional bonus-protection cookie and device fingerprint on the welcome wheel (as required by the ePrivacy rules on storing and reading information on your device), and anywhere else we ask for it. You can withdraw consent at any time in cookie settings without affecting earlier processing.
5.Who Can See Your Information
The Service is social. The following is visible to other players: your username, avatar, level and rank, title, badge, tags, username style and other cosmetics, club name and tag, leaderboard results, your seat and actions at tables, your chat and club messages, and your presence (online, in a game, or seated). Unless you make your profile private in Settings, your full profile is also visible, including your bio, trophies, statistics, win records and balances.
You control some of this in Settings: a private profile limits what others see to your name, look, level and club; direct message privacy controls who can message you; and streamer mode hides your balance and other players' names on your screen. Anything you post in public or club chat can be seen by others in that channel, and they may copy or share it.
7.Cookies and Similar Technologies
We use only first-party cookies and browser storage, almost all of them strictly necessary: to keep you signed in, remember your settings and your cookie choices, and make the Service work. The one optional category, bonus protection, is used only with your consent. We do not use advertising cookies, third-party cookies, tracking pixels or third-party analytics, and every font, stylesheet and script on our pages is served from our own servers, so visiting LuckyRook does not send your IP address to any other company. Our Cookie Policy (in the Support Codex and at /cookies) lists each one, and you can change your choice at any time in cookie settings.
Because we do not sell or share personal information or use advertising trackers, we have nothing for a "Do Not Track" or Global Privacy Control signal to switch off; if your browser sends one, you are already opted out of selling and sharing, which we never do.
8.How Long We Keep Information
We keep personal information for as long as your account is open and as needed to provide the Service, and afterwards only as long as reasonably necessary for the purposes described here. In particular:
- When you delete your account in Settings, we permanently delete your account and the information linked to it, including your profile, settings, security settings, sessions, balances and items, friends, direct messages, club chat messages, support tickets and their screenshots, and most records and statistics.
- Some records are kept after deletion because they are needed for the integrity of the games, to prevent abuse or to resolve disputes: records of individual game rounds in some games (for example Crash, Plinko, Doors, Slider, Slots and Coinflip duels, which other players' results and the provably-fair records depend on), club invitations and join requests, and the fraud-prevention records described above (device and network hashes linked to a welcome bonus or sign-up). The game and invitation records no longer carry your username: they are re-labelled with an anonymous account number. The fraud-prevention records may still show your former username.
- A username you give up (by changing it or deleting your account) is held for 30 days, during which no other player can take it, so nothing addressed to the old name can reach someone else.
- Public and table chat is held only in server memory for a short replay window and is not stored permanently; club chat and direct messages are stored until they are deleted with an account (or with a club).
- Session records are kept while your session is active and for a reasonable period afterwards for security.
- Purchase records are kept for as long as required for tax, accounting and legal purposes, even after an account is deleted, where the law requires it.
- Server logs are kept for a limited period for security and troubleshooting.
- We may keep information longer where the law requires it, or to establish, exercise or defend legal claims, or to enforce a ban.
9.How We Protect Information
We use reasonable technical and organisational measures appropriate to the information we hold, including one-way hashing of passwords (bcrypt), session tokens, recovery codes, password-reset tokens and verification codes; optional two-factor authentication; the ability to review and sign out every other session; confirmation of email changes; limits on repeated verification-code attempts; and restricted access to our systems.
No system is perfectly secure. You help protect your account by using a strong, unique password, turning on two-factor authentication, keeping your recovery codes safe and not sharing your account. If we become aware of a breach affecting your personal information, we will notify you and the authorities where the law requires it.
10.Your Rights and Choices
Choices available to everyone
- Access and correct much of your information directly in the Service, and change your username, email, password, profile and privacy settings in Settings.
- Delete your account at any time in Settings. Deletion is permanent.
- Control who sees you with a private profile, direct message privacy and streamer mode.
- Emails: transactional emails are needed to run your account; you can remove your email address at any time (but then we cannot help you recover a lost password).
Legal rights
Depending on where you live, you may have the right to: know what personal information we hold about you and how we use it; access it and receive a copy in a portable format; correct inaccurate information; delete it; restrict or object to certain processing (including processing based on our legitimate interests); withdraw consent; and opt out of the sale or sharing of personal information, targeted advertising or profiling (we do none of these). We will not discriminate against you for exercising any of these rights.
To make a request, open a Member Ticket in the Support Codex while signed in, or contact us at the address in Section 15. We will need to verify that the request comes from the account holder, usually by having it come from your signed-in account; if you contact us by email we may ask you to confirm details only the account holder would know. You may use an authorised agent where the law allows; we may ask for proof of their authority and to verify your identity directly. We will respond within the time the law requires (generally within 30 days in the EEA and UK and 45 days in U.S. states, which may be extended where the law allows).
If we decline your request, we will explain why. Where the law gives you a right to appeal, reply to our decision asking for an appeal and we will review it and tell you the result and, if we still decline, how to contact your state attorney general or data protection authority.
If you are in the EEA or UK you also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to address your concern first.
11.Additional Information for U.S. State Residents
This section applies to residents of California and other U.S. states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others). In the past 12 months we have collected the following categories of personal information, from the sources and for the purposes described above:
- Identifiers: username, email address, IP address, session and device identifiers.
- Account login credentials: username with password (stored hashed) and two-factor authentication secrets. Under California law these are "sensitive personal information"; we use them only to sign you in and secure your account, which is a permitted purpose, so there is no right to limit to exercise.
- Commercial information: records of Virtual Items obtained, and purchases where offered.
- Internet or other electronic network activity: gameplay, interactions with the Service, browser and device information and, if you allowed bonus protection, the fraud-prevention fingerprint hash.
- Audio, electronic or visual information: screenshots you attach to support tickets.
- Inferences: we do not create profiles to predict your characteristics or preferences for advertising; aggregate game-balancing analysis does not target you.
We disclose these categories for business purposes to the service providers described in "How We Share Information". We have not sold or shared (as those terms are defined under California law) personal information in the past 12 months, and we do not knowingly sell or share the personal information of consumers under 16. California residents may also request, once a year, information about disclosures to third parties for their direct marketing purposes; we make none.
12.International Users
We are based in the United States and the Service is operated from the United States. If you use the Service from elsewhere, your information will be transferred to, stored and processed in the United States and other countries where our service providers operate, whose data protection laws may differ from those in your country. Where the law requires it, we protect transfers of personal information from the EEA, UK and Switzerland with appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK Addendum.
13.Children
The Service is only for people aged 18 or older, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from someone under 18, we will close the account and delete the information, except what we must keep by law. If you believe a minor is using the Service, please contact us.
14.Changes to This Policy
We may update this Privacy Policy from time to time. The version and effective date at the top show when it last changed. If we make a material change, we will notify you through the Service (for example, in the Support Codex) or by email before it takes effect, where required. Where the law requires your consent to a change, we will ask for it.
15.Contact Us
For privacy questions or requests, the fastest way to reach us is a Member Ticket from the Support Codex (the ? button in the top bar). Our company details are also in our Impressum.
You can also write to:
- Empress Games LLC (operator of LuckyRook), Attn: Privacy
- Mail: [COMPANY MAILING ADDRESS]
- Email: [LEGAL CONTACT EMAIL]