Privacy Policy

• Your saved tickets never leave your device. They are stored on the phone and matched on the phone, including when a notification wakes the app after a draw. There is no tickets table on the server and no way for the app to create one.
• Numbers you check on this website never leave your browser. The draw arrives with the page and the comparison runs locally.
• No tracking, ever. No advertising identifier, no analytics SDK, no third-party pixels, no cross-app or cross-site profiling, no data sold or shared for anyone else’s marketing.
• The exceptions are notifications, ticket scanning, anonymous counts of which numbers get looked up, and ticket pools. Each is described below.

The website sets no cookies, runs no analytics and asks for nothing. Our hosting provider, Vercel, processes ordinary server request logs, which include IP address, user agent and the page requested, for delivery, security and abuse prevention. We do not combine those logs with anything else and do not use them to identify individuals.

When you check numbers here, the draw results are already embedded in the page. Your numbers are compared in your browser and are not transmitted to us or to anyone.

These never leave the phone and are not backed up to any server we control:

• tickets you enter or scan and save, meaning their numbers, games, draw dates and multiplier choices;
• the results of matching those tickets against draws;
• any “prediction” or standing claim you record about a theory of your own;
• your display settings and the cached copy of recent results.

Deleting the app deletes all of it. We cannot recover it, because we never had it.

If you turn on notifications, the app sends our server an Apple Push Notification service device token, together with which games you want alerts for and any jackpot threshold you set. The token identifies a device installation to Apple’s push service. It is not linked to an identity, because the app has no accounts and no other identifier to link it to.

Draw notifications carry only the publicly published winning numbers. They never carry your ticket, because the server does not have it; the app matches your tickets locally when it wakes.

Turning notifications off in the app, or in iOS Settings, stops this. Deleting the app invalidates the token, and tokens that Apple reports as invalid are removed.

This is the one place a photograph you take leaves your device, and it is worth reading in full.

When you tap Scan and take a photo, the image is sent to our server function, which forwards it to a third-party AI provider to have the numbers read off it by automated text recognition. The recognised numbers come back to your phone. Nothing is saved anywhere until you have checked the reading against the ticket in your hand and tapped Save, and what is saved is saved locally.

We do not store the photograph. It is held in memory for the duration of that one request and is not written to disk, not logged and not retained by us.

The provider’s handling is not ours to promise away. We use AI providers on paid commercial terms under which the provider does not use submitted content to train its models. A provider may retain submitted content for a limited period for abuse detection and legal compliance. Your photograph is therefore briefly present in that provider’s systems, subject to its terms as well as ours, and we say so because a privacy policy that stopped at “discarded immediately” would be incomplete.

We may change AI providers as the technology moves. Any provider we use is bound by the same two conditions: no training on your content, and no retention beyond what abuse detection and the law require.

A photograph of a ticket can contain more than the ticket: a hand, a face, a countertop, a receipt, a room. Frame the shot on the ticket. Do not photograph anyone else’s information.

To limit the cost of automated abuse, each scan is counted against your device’s vendor identifier, an iOS-provided value scoped to our apps. We store counts and timestamps only: no image, no numbers, no device token. The vendor identifier is deliberately used instead of a Keychain value so that it does not survive reinstalling the app and cannot become a durable tracking identifier.

When you look a number up in the app’s analysis screen, the app records that a lookup happened. The stored row is four things: the game, the number, how far back you asked it to look, and the time it happened. Nothing else is sent: no device token, no vendor identifier, no session identifier, no account, no ticket, no IP address kept alongside it.

Because no identifier is stored, we cannot tell which rows came from the same person or the same device. We will not overclaim, though: rows carry a timestamp and an insertion order, so several lookups made seconds apart could in principle be inferred to be one person’s, in the same way that any timestamped log can be. We do not do this, it would tell us nothing useful, and there is no identifier to attach the inference to.

It is a count, not a profile, and it exists so we know which numbers people wonder about. It is not a ticket: a number you look up is not a number you bought, and we have no way to know what anyone bought.

A pool is a shared record, so unlike everything else in the app its contents necessarily go to the server. This applies only to a pool you deliberately create or join, and your consent is the act of creating or joining one.

A pool stores:

• the names and contribution amounts you enter for its members;
• the numbers on the pool’s tickets, the ticket’s printed serial, and a photograph of the ticket, which is what makes the record worth anything in a dispute;
• a random identifier for your app installation, kept in the device Keychain, so that entries you added stay attributable to you if you reinstall.

Unlike every other identifier here, the pool installation identifier survives reinstalling the app, because a pool member who lost their authorship would drop out of a record other people’s money depends on. It is never sent with a ticket scan, never joined to your push token, never used outside pools, and never synced to iCloud.

Everything within one pool is deliberately linked together, because a record whose entries could not be tied to each other would settle nothing. Anyone with the pool’s invitation link can read it. Only put in a pool what you are content for its members to see, and do not add another person’s name without their knowledge.

Your location, contacts, calendar, photo library, health data, financial data, browsing history, advertising identifier, name, email address, phone number or date of birth. We have no accounts, so there is nothing to sign in to and no password to lose.

• Supabase, which hosts the results database, the push registration and the pool records.
• Vercel, which hosts this website and its request logs.
• Third-party AI providers, which read the numbers off a scanned ticket photo, as described in clause 5.
• Apple, which delivers push notifications and distributes the app.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. There is no advertising on LottoScan.

Lunana Global Inc. is a company in British Columbia, Canada. Every processor listed above operates in the United States, so the limited data described in this policy is stored and processed in the United States and may transit other countries on its way there.

This has a consequence worth stating rather than burying: while data is held in the United States it is subject to the laws of that country, including lawful access by US courts, law enforcement and regulatory authorities, regardless of where you live. Using LottoScan means accepting that transfer. If it is not acceptable to you, the practical answer is not to use the scanner or pools, which are the only features that send anything meaningful.

We remain accountable for that information under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) while it is with a processor acting on our behalf, and we require comparable protection from each of them by contract.

• Ticket photographs sent for scanning: not retained by us at all. The AI provider’s own limited logging is described in clause 5.
• Scan rate-limit records: kept as one row per device vendor identifier, holding the running scan counts and the first and last time that identifier was seen. The row persists rather than expiring, so that a daily limit cannot be reset by waiting. It holds no image, no numbers and no push token, and the vendor identifier changes when you reinstall the app.
• Push tokens: until you disable notifications, delete the app, or Apple reports the token invalid.
• Anonymous number-lookup rows: retained indefinitely. They contain nothing that identifies anyone, as described in clause 6.
• Pool records, including ticket photographs: until the pool is deleted or we delete it on request. A pool is meant to outlast the draw it settles.

Most of what other services offer a rights request for, LottoScan solves by not having the data. Concretely:

• Delete the app and everything held locally is gone.
• Turn notifications off and the push token is released.
• Never open the scanner and no photograph is ever transmitted.
• For a pool, write to hello@lottoscan.co with the pool’s invitation link and we will delete it.

Depending on where you live you may have rights to know, access, correct, delete, or limit the use of personal information, and not to be discriminated against for exercising them, under PIPEDA in Canada, under the California Consumer Privacy Act and comparable state statutes in the United States, and under similar laws elsewhere. We honour those requests regardless of whether a given statute applies to us by its own revenue or volume thresholds, because arguing about thresholds is a worse use of everyone’s time than answering the question.

Write to hello@lottoscan.co. We may need to ask for the pool link or device details to locate anything, and if we genuinely hold nothing about you we will say so rather than invent a record to delete. If you are unsatisfied with our response you may complain to the Office of the Privacy Commissioner of Canada, or to your local supervisory authority.

LottoScan concerns lottery play and is not directed to children. We do not knowingly collect personal information from anyone under 13, and the app is rated for a mature audience. If you believe a child has provided information through the app, write to hello@lottoscan.co and it will be deleted.

Traffic is encrypted in transit. Database access from the app uses a public key restricted by row-level security to reading published results only; it cannot write tickets, read another pool, or reach the scanning quota table. Pool operations go through server-side functions that require the pool’s own token. No system is perfectly secure, and we do not claim otherwise.

If this policy changes materially, the effective date above changes and the change is described here. If a change ever widened what we collect, it would be stated plainly rather than folded into an existing sentence.

The organisation accountable for personal information under this policy, and its privacy contact, is:

Lunana Global Inc.
555 Burrard St., Vancouver, BC, V7X 1M8, Canada
hello@lottoscan.co