1. Account Data
When you create a Lucky 7 account, we store:
| Data | Purpose | Basis | Retention |
|---|---|---|---|
| Email address | Account login, transactional emails | Required (account cannot function without it) | Never |
| Display name | Shown on your profile | Required | Never |
| Password hash | Authenticate you (scrypt; raw passwords are never stored) | Required | Never |
| Date of birth (age range only) | Enforce age requirements (13+, 16+ for merch) | Required | 90 days after account deletion |
| Email verified flag | Confirm you own the email address | Required | Never |
| Account creation date | Fraud prevention, account history | Required | Never |
| Discord ID / username | Linked Discord account (only if you connect it) | Optional, your choice | Immediately on unlink |
| Roblox ID / username | Linked Roblox account (only if you link in-game) | Optional, your choice | Immediately on unlink |
2. Session & Security Data
Each time you sign in, we record:
| Data | Purpose | Basis | Retention |
|---|---|---|---|
| IP address | Fraud detection, brute-force protection, security emails | Security (required for account protection) | 30 days (with your session) |
| City & country (derived from IP) | Shown in your Security tab so you can spot unauthorized logins | Security (can be disabled in account settings) | 30 days (with your session) |
| Browser & OS (from User-Agent) | Shown in your Security tab ("Chrome 124 on Windows 11") | Security (can be disabled in account settings) | 30 days (with your session) |
| Sign-in timestamp | Session management, security alerts | Required | 30 days (with your session) |
Under 18? We still collect IP, city/country, and browser for security purposes; these are needed to protect your account. We do not use them for marketing or analytics.
3. Submissions You Make
When you voluntarily submit content:
| Data | Purpose | Basis | Retention |
|---|---|---|---|
| Appeal content | Process your appeal | You submit it (required to process) | Until resolved or 2 years |
| Fan art submissions | Display in our fan art gallery (with your permission) | Voluntary | Until you request removal |
| Support tickets | Respond to your issue | You submit it (required to help you) | Until resolved or 1 year |
| Player reports | Review reported behaviour | You submit it (required to act on your report) | 90 days after resolution |
| Career applications | Review your application | You submit it (required to consider you) | 1 year or until you request deletion |
| Bug reports | Fix the bug | You submit it | 1 year after fix |
| Contact messages | Respond to your message | You submit it | 1 year |
4. In-Game Data (Roblox)
Our games run on Roblox. Roblox handles most data collection for in-game activity under their own Privacy Policy. We additionally collect:
| Data | Purpose | Basis | Retention |
|---|---|---|---|
| Roblox user ID | Link your Roblox account to L7 account, verify group membership | Optional, your choice | On unlink or account deletion |
| Anti-cheat events | Detect and action cheating/exploiting | Game security | 90 days |
| Link codes (temporary) | Verify your Roblox identity in-game | Generated per-request, used once | Expires in 10 minutes |
5. What We Do Not Collect
- We do not run advertising trackers or sell your data
- We do not use cookies for analytics (no Google Analytics, no Facebook Pixel)
- We do not store your raw password, only a salted hash
- We do not store your exact date of birth, only age-derived flags (is minor, needs parental consent)
- We do not collect payment card details; payments go through Whop or Roblox directly
- We do not share data with third parties except as required to operate (Resend for email, Upstash for storage, Vercel for hosting, Roblox for game data)
6. Children & Minors
We do not knowingly collect data from children under 13. If you are under 13, you cannot create an account, and any attempt to do so will result in your email being blocked from signup for 48 hours.
If you are 13-17 (a minor), we collect only what is strictly necessary to operate your account and keep it secure. We do not use your data for marketing, analytics, or profiling.
Users under 16 require parental consent to place merch orders.
7. How Long We Keep It
Active account data is kept for as long as your account exists. When you delete your account, your email is flagged for 90 days to prevent re-registration issues, then purged. Session data (IP, browser, city) is deleted after 30 days. You can request full deletion at any time via our Data Request page.
8. Your Controls
- Disable location & browser tracking — Account Settings → Security → uncheck "Record location and browser on sign-in"
- See all active sessions — Account → Security tab → Active Sessions
- Delete your account — Account → Settings → Delete Account
- Request a data export — /data-request → "Export my data"
- Request full erasure — /data-request → "Delete all my data"
- Contact us — support@lucky7entertainment.com
Questions? Email support@lucky7entertainment.com or visit our full Privacy Policy.